JP7850627B2 - Account Management Device - Google Patents

Description

This invention relates to an account management device.

For example, initiatives such as smart cities, which aim to create sustainable cities by solving urban challenges using ICT (Information and Communication Technology), are expected to increase opportunities to use digital services. When providing digital services tailored to individual users, it becomes necessary to register individual user accounts.

For example, Patent Document 1 discloses a technology relating to a business method in which a car dealer or insurance company sets fees using personal information, which is the user's authentication information, when providing services using vehicle history information such as the vehicle's driving history. This technology uses a personal ID card that stores authentication information including driver's license number, issuance date, expiration date, license conditions, name, date of birth, registered domicile, address, vehicle type, fingerprint data, facial photograph data, and password. In other words, a user utilizing the technology described in Patent Document 1 uses personal information, including name, address, and facial photograph data, as their account information.

Japanese Patent Publication No. 2002-279298

However, in the technology described in Patent Document 1, if the owner of a personal ID card uses the personal information recorded on that personal ID card in a second service different from the above-mentioned service and which is not compatible with that personal ID card, the personal information must be manually re-entered into the system providing the second service. In this case, for example, it may be difficult for elderly users to enter their personal information using IT equipment.

Therefore, the present invention aims to provide an account management device that, when an ID card corresponding to the first service is not compatible with the second service, allows a user to create an account for use with the second service without having to manually input their personal information into an IT device, by using the ID card corresponding to the first service.

A preferred embodiment of the present invention provides an account management device comprising: an image recognition unit that, upon registration of an account corresponding to a first person, generates a first string of characters representing personal information by image recognition of a first captured image generated when a first terminal device captures a printed document containing the personal information of the first person; a face ID management unit that, upon registration of an account corresponding to a first person, generates a face ID, which is an identifier that corresponds one-to-one with the face image of the first person, based on the face image of the first person, and manages the generated face ID in association with feature quantities related to the features of the face image; and an account management unit that, upon registration of an account corresponding to a first person, generates account information for the first person including the first string of characters and the face ID, and manages the generated account information.

According to the present invention, when an ID card corresponding to the first service is not compatible with the second service, an account management device can be provided that allows a user to create an account for use with the second service without having to manually input their personal information into an IT device, by using the ID card corresponding to the first service.

A diagram showing the overall configuration of account management system 1. A block diagram showing an example configuration of terminal device 20-1. A block diagram showing an example configuration of the account management device 10. A table showing an example configuration of a facial ID database (FDB). A table showing an example configuration for the account database ADB. A sequence diagram showing the operation of account management system 1 during account registration. A sequence diagram showing the operation of account management system 1 during user authentication. A sequence diagram showing the operation of account management system 1 during user authentication.

1: First Embodiment Hereinafter, an account management system 1 equipped with an account management device 10 according to the first embodiment of the present invention will be described with reference to Figures 1 to 8.

1-1: Configuration of the First Embodiment 1-1-1: Overall Configuration Figure 1 shows the overall configuration of the account management system 1 according to the first embodiment. As shown in Figure 1, the account management system 1 comprises an account management device 10, a terminal device 20-1, and a terminal device 20-2. In this embodiment, terminal devices 20-1 and 20-2 have the same configuration. However, terminal devices 20-1 and 20-2 do not have to have the same configuration as long as they have the functions described later. Hereinafter, terminal devices 20-1 and 20-2 may be collectively referred to as "terminal device 20". Furthermore, the account management device 10, terminal device 20-1, and terminal device 20-2 may be, for example, a smartphone or a tablet, or a PC (Personal Computer). Here, terminal device 20-1 is an example of a "first terminal device". Also, terminal device 20-2 is an example of a "second terminal device". Furthermore, terminal device 20-2 is an example of an "external device".

In the account management system 1, the account management device 10, terminal device 20-1, and terminal device 20-2 are connected to each other via a communication network (NET) so that they can communicate with one another.

The account management device 10 generates account information associated with user U's account when user U uses terminal device 20-1. Here, "account" refers to a unique identifier or right of user U, used by the user to access the computer through the OS (Operating System) or network. If user U's account is a unique identifier, it is used on the computer to identify user U and manage information specific to user U. "Account information" includes, for example, at least one of the following: user U's name, address, telephone number, date of birth, email address, password, or credit card number. Here, user U is an example of "the first person."

Furthermore, when user U uses terminal device 20-2, the account management device 10 performs user U authentication using the already generated account information. Here, "user authentication" refers to the authentication of user U as a legitimate user of a service provided by the computer via the OS or network. During user authentication, user U enters their account information into the computer. The computer authenticates user U as a legitimate user based on the account information entered by user U.

For example, if the service is a book lending service provided by a local government, User U enters their account information into the account management device 10. As described later, in this embodiment, User U enters their own facial image into the account management device 10 as their account information. As a result, User U is authenticated as a legitimate user of the lending service. Subsequently, the account management device 10 outputs, for example, User U's name and address, which are included in User U's account information, to the terminal device 20-2. As a result, User U's name and address are automatically entered into the input fields on the screen used to access the lending service in the terminal device 20-2.

Furthermore, if the account management device 10 is linked to the server providing the above-mentioned rental service, the account management device 10 may output user U's name and address to the server instead of terminal device 20-2. Alternatively, if the account management device 10 is integrated into the system providing the above-mentioned rental service, the account management device 10 does not need to output user U's name and address to external devices.

Terminal device 20-1 is a device used by user U when registering an account. Terminal device 20-1 is, for example, a PC installed in a public place and is preferably shared by multiple users U. However, terminal device 20-1 is not limited to a terminal device installed in a public place; it may also be a terminal device used privately by user U.

Terminal device 20-2 is a device used by user U to perform identity verification using already generated account information. Terminal device 20-2 is, for example, a smartphone, tablet, or PC owned by user U, and is preferably used privately by user U. However, terminal device 20-2 is not limited to a terminal device used privately by user U; it may also be a terminal device installed in a public place.

1-1-2: Configuration of Terminal Device 20-1 Figure 2 is a block diagram showing an example configuration of terminal device 20-1. Terminal device 20-1 comprises a processing unit 21, a storage device 22, a communication device 23, a display 24, an input device 25, and an imaging device 26. Each element of terminal device 20-1 is interconnected by one or more buses for communicating information.

The processing unit 21 is a processor that controls the entire terminal device 20-1. The processing unit 21 is configured using, for example, one or more chips. The processing unit 21 is configured using, for example, a central processing unit (CPU) including interfaces with peripheral devices, an arithmetic unit, and registers. Some or all of the functions of the processing unit 21 may be implemented by hardware such as a DSP, ASIC, PLD, or FPGA. The processing unit 21 executes various processes in parallel or sequentially.

The storage device 22 is a recording medium that the processing unit 21 can read and write to. The storage device 22 also stores multiple programs, including the control program PR2 executed by the processing unit 21.

The communication device 23 is hardware acting as a transmitting and receiving device for communicating with other devices. The communication device 23 is also referred to as, for example, a network device, network controller, network card, or communication module. The communication device 23 may include a connector for wired connection and an interface circuit corresponding to the connector. Furthermore, the communication device 23 may include a wireless communication interface. Examples of wired connection connectors and interface circuits include products compliant with wired LAN, IEEE 1394, and USB. Examples of wireless communication interfaces include products compliant with wireless LAN and Bluetooth®.

The display 24 is a device that displays images and text information. The display 24 displays various images under the control of the processing unit 21. For example, various display panels such as liquid crystal display panels and organic EL (Electro-Luminescence) display panels are suitably used as the display 24.

The input device 25 receives input from user U of terminal device 20-1. For example, the input device 25 includes a pointing device such as a keyboard, touchpad, touch panel, or mouse. If the input device 25 includes a touch panel, it may also function as the display 24.

The imaging device 26 captures images of the external space in which an object exists. The imaging device 26 also outputs imaging information representing the image obtained by capturing the external space. The imaging device 26 includes, for example, a lens, an image sensor, an amplifier, and an AD converter. Light focused through the lens is converted by the image sensor into an analog imaging signal. The amplifier amplifies the imaging signal and outputs it to the AD converter. The AD converter converts the amplified analog imaging signal into digital imaging information. The converted imaging information is output to the processing device 21.

In this embodiment in particular, the imaging device 26 captures a printed document containing user U's personal information and generates an image of the document. Here, the image of the document is an example of the "first image." "Printed document containing user U's personal information" refers, for example, to an ID card with user U's personal information printed on it. "User U's personal information" refers to information about user U that allows user U to be identified by other users. "User U's personal information" includes, for example, at least one of the following: user U's name, address, telephone number, date of birth, email address, password, or credit card number. "ID card" refers to, for example, a driver's license, health insurance card, passport, or My Number card. Furthermore, the imaging device 26 outputs the generated image of the printed document containing user U's personal information to the processing device 21.

Furthermore, the imaging device 26 captures the face of user U and generates a facial image of user U. The imaging device 26 then outputs the generated facial image of user U to the processing device 21.

The processing unit 21 functions as an acquisition unit 211, an output unit 212, a generation unit 213, and a display control unit 214 by reading and executing the control program PR2 from the storage device 22.

The acquisition unit 211 acquires a facial image of user U and an image of a printed document containing user U's personal information from the imaging device 26. This image is an example of the "first image."

The output unit 212 outputs the first captured image, which is the facial image of user U and the image of the printed document containing user U's personal information, acquired by the acquisition unit 211, to the account management device 10.

Subsequently, as described later, the account management device 10 generates a string representing user U's personal information by performing image recognition on the first captured image, which is an image of a printed document containing user U's personal information. This string is an example of the "first string." The account management device 10 then outputs the generated string to the terminal device 20-1. The acquisition unit 211 retrieves the first string from the account management device 10.

The generation unit 213 generates a hash value by transforming the first string acquired by the acquisition unit 211 using a hash function. This hash value is an example of the "first hash value." The first hash value corresponds one-to-one with the first string. The output unit 212 outputs the first hash value generated by the generation unit 213 to the account management device 10.

The display control unit 214 displays a message for user U on the display 24. For example, when terminal device 20-1 instructs user U to capture an image of user U's face using the imaging device 26, a message indicating this instruction is displayed on the display 24. The same applies when terminal device 20-1 instructs user U to capture an image of user U's personal information printed on a document using the imaging device 26.

1-1-3: Configuration of Account Management Device 10 Figure 3 is a block diagram showing an example configuration of the account management device 10. The account management device 10 comprises a processing unit 11, a storage device 12, a communication device 13, a display 14, and an input device 15. Each element of the account management device 10 is interconnected by one or more buses for communicating information.

The processing unit 11 is a processor that controls the entire account management device 10. The processing unit 11 is configured using, for example, one or more chips. The processing unit 11 is configured using, for example, a central processing unit (CPU) including interfaces with peripheral devices, an arithmetic unit, and registers. Some or all of the functions of the processing unit 11 may be implemented by hardware such as a DSP, ASIC, PLD, and FPGA. The processing unit 11 executes various processes in parallel or sequentially.

The storage device 12 is a recording medium that the processing unit 11 can read and write to. The storage device 12 also stores multiple programs, including the control program PR1 executed by the processing unit 11.

Furthermore, the storage device 12 stores the face ID database FDB and the account database ADB. The face ID database FDB is a database of face IDs. Here, "face ID" is an identifier generated by the account management device 10 from the face image of user U obtained from the terminal device 20-1, and it corresponds one-to-one with the face image of user U.

Figure 4 is a table showing an example of the configuration of the Face ID Database (FDB). The Face ID Database (FDB) stores a set of a face image, face ID, feature quantities related to the features of the face image, and a first hash value. Here, "feature quantities related to the features of the face image" refers to data that represents the features of the face image. These feature quantities include, for example, features related to the contour of the face, the area of the face, the parts included in the face, and the relative positions between those parts. The Face ID Database (FDB) stores, for example, a face image file with the filename "001.jpg", a face ID represented by the string "C87K91", a feature quantity file with the filename "001.csv", and a first hash value represented by the numerical value "733673904" as a set.

The Account Database (ADB) is a database of user accounts. The account information for user U includes user U's user ID, a first string related to user U, and user U's face ID. Here, "user ID" is the identifier for user U. There is a one-to-one correspondence between user ID and user U.

Figure 5 is a table showing an example of the structure of the account database (ADB). The account database (ADB) stores pairs of user IDs, a first string, and a face ID. For example, the account database (ADB) stores a pair of user IDs represented by the string "AAA", a first string represented by the string "BJUGHSK", and a face ID represented by the string "C87K91". For the sake of explanation, in the table in Figure 5, the "first string" is listed as a random combination of letters. However, in reality, the "first string" is a string representing the personal information of user U, as described above.

Returning to Figure 3, the communication device 13 is hardware acting as a transmitting and receiving device for communicating with other devices. The communication device 13 is also referred to as, for example, a network device, network controller, network card, or communication module. The communication device 13 may include a connector for wired connection and an interface circuit corresponding to the connector. Furthermore, the communication device 13 may include a wireless communication interface. Examples of wired connection connectors and interface circuits include products compliant with wired LAN, IEEE 1394, USB, etc. Examples of wireless communication interfaces include products compliant with wireless LAN and Bluetooth®, etc.

The display 14 is a device that displays images and text information. The display 14 displays various images under the control of the processing unit 11. For example, various display panels such as liquid crystal display panels and organic EL (Electro-Luminescence) display panels are suitably used as the display 14.

The input device 15 receives operations from the administrator of the account management device 10. For example, the input device 15 includes a keyboard, touchpad, touch panel, or a pointing device such as a mouse. If the input device 15 includes a touch panel, it may also function as the display 14.

The processing unit 11 functions as an acquisition unit 111, an extraction unit 112, an image recognition unit 113, an output unit 114, a face ID management unit 115, and an account management unit 116 by reading and executing the control program PR1 from the storage device 12. Of the functions of the acquisition unit 111, the extraction unit 112, the image recognition unit 113, the output unit 114, the face ID management unit 115, and the account management unit 116, the functions related to account registration will be explained first.

The acquisition unit 111 acquires a first image from the terminal device 20-1, which is an image of user U's face and an image of a printed document containing user U's personal information.

The extraction unit 112 extracts feature quantities related to the characteristics of the face image from the face image of user U acquired by the acquisition unit 111.

The image recognition unit 113 performs image recognition on the captured image of the printed document containing user U's personal information acquired by the acquisition unit 111, thereby generating a first string representing the personal information.

The output unit 114 outputs the first string generated by the image recognition unit 113 to the terminal device 20-1. Subsequently, the acquisition unit 111 retrieves the first hash value generated using the first string from the terminal device 20-1.

The face ID management unit 115 generates a face ID based on the user U's face image. The face ID management unit 115 also manages the generated face ID in association with the face image's feature quantities. For example, the face ID management unit 115 associates the face ID, face image feature quantities, and first hash value with each other and stores them in the face ID database FDB stored in the storage device 12.

The account management unit 116 generates account information for user U, including user U's user ID, a first string related to user U, and user U's face ID. Here, user U's face ID is identical to the face ID of user U stored in the face ID database FDB. The account management unit 116 also manages the generated account information for user U. For example, the account management unit 116 stores the generated account information for user U in the account database ADB stored in the storage device 12.

As a result, if an ID card corresponding to the first service is not compatible with the second service, the user can use the ID card corresponding to the first service to create an account for the second service without having to manually enter their personal information into IT equipment. For example, if user U's ID card is a My Number Card, user U can use the My Number Card to access services provided by government agencies as the first service. In addition, user U can use the same My Number Card to create an account for an online shopping site as the second service.

Next, we will explain the operation of each component during user authentication.

The acquisition unit 111 acquires the face image of user U from the terminal device 20-2.

The extraction unit 112 extracts feature quantities related to the characteristics of the face image of user U from the face image acquired by the acquisition unit 111 from the terminal device 20-2.

The Face ID Management Unit 115 identifies the Face ID corresponding to the face image of user U obtained from the terminal device 20-2, based on the degree of agreement between the feature quantities related to the features of user U's face image, extracted by the Extraction Unit 112, and the feature quantities stored in the Face ID Database FDB. Specifically, the Face ID Management Unit 115 identifies the Face ID corresponding to the feature quantity closest to the feature quantity related to the features of user U's face image obtained from the terminal device 20-2, among the Face IDs stored in the Face ID Database FDB. Alternatively, the Face ID Management Unit 115 identifies the Face ID corresponding to the feature quantity whose difference from the feature quantity related to the features of user U's face image obtained from the terminal device 20-2 is within a threshold, among the Face IDs stored in the Face ID Database FDB.

The account management unit 116 identifies account information containing the face ID identified by the face ID management unit 115 from among the account information stored in the account database ADB.

The output unit 114 outputs the first string of characters included in the account information identified by the account management unit 116 to the terminal device 20-2.

As a result, user U can perform identity verification without having to manually enter the authentication information recorded on their ID card into IT equipment.

Next, we will explain the operation of each component when multiple facial IDs corresponding to user U's facial image exist during the user authentication process described above.

As a prerequisite, the account management device 10 is assumed to have already registered account information corresponding to multiple individuals. Specifically, the terminal device 20-1 is assumed to have output multiple first captured images to the account management device 10 by capturing images of printed materials containing multiple pieces of personal information corresponding one-to-one with multiple individuals. Furthermore, the image recognition unit 113 of the account management device 10 is assumed to have performed image recognition on the multiple first captured images, thereby generating multiple first strings that correspond one-to-one with the multiple pieces of personal information and represent multiple pieces of personal information. Furthermore, the face ID management unit 115 of the account management device 10 is assumed to have generated multiple face IDs that correspond one-to-one with the facial images of multiple individuals based on the facial images of multiple individuals. In addition, the face ID management unit 115 manages the generated multiple face IDs, feature quantities related to the characteristics of the facial images of multiple individuals, and multiple first hash values generated from the multiple first strings, which correspond one-to-one with the multiple first strings, by associating them with each other.

Here, during user U's authentication, assume that the face IDs corresponding to the face image acquired from terminal device 20-2 (the second terminal device) are included among multiple face IDs stored in the face ID database FDB. As an example, consider a case where one person among several individuals with similar faces (like twins) performs authentication, and the face IDs corresponding to their own face image include not only their own face ID but also the face IDs of others, resulting in multiple face IDs.

The output unit 114 outputs specific information to the terminal device 20-2 indicating that multiple face IDs corresponding to the face images acquired from the terminal device 20-2 are included in the face ID database FDB.

In this case, as described later, the terminal device 20-2 captures a printed document containing user U's personal information and generates an image of the document. This image is an example of a "second image." The acquisition unit 111 in the account management device 10 acquires the second image from the terminal device 20-2.

The image recognition unit 113 performs image recognition on the second captured image acquired by the acquisition unit 111 to generate a second string representing the personal information of user U.

The Face ID Management Unit 115 generates a hash value by converting the second string generated by the Image Recognition Unit 113 using a hash function. This hash value is an example of a "second hash value." Furthermore, based on the similarities and differences between the first and second hash values, the Face ID Management Unit 115 identifies one face ID from multiple face IDs corresponding to user U's face image. Specifically, in the Face ID Database FDB, the Face ID Management Unit 115 identifies one face ID from multiple face IDs corresponding to user U's face image where the first hash value associated with that face ID matches the second hash value.

As a result, the account management device 10 can eliminate the possibility that the facial ID identified as the user's facial ID is not limited to one, for example, when one person among several people with similar faces, such as twins, attempts identity authentication. On the other hand, if the facial ID identified as the user's facial ID can be uniquely identified from the outset, the account management device 10 can omit the generation of a second string using image recognition with a second captured image, and the generation of a second hash value corresponding to the second string. As a result, the account management device 10 can reduce its processing load.

1-1-4: Configuration of Terminal Device 20-2 The configuration of terminal device 20-2 is the same as the configuration example of terminal device 20-1 shown in Figure 2, so its illustration is omitted. In the following, for the sake of simplicity, the components included in terminal device 20-2 will be described mainly as those included in processing unit 21.

The acquisition unit 211 acquires the user U's face image from the imaging device 26.

The output unit 212 outputs the user U's face image acquired by the acquisition unit 211 to the account management device 10. Subsequently, the acquisition unit 211 acquires the first string from the account management device 10.

Furthermore, if the account management device 10 has multiple face IDs corresponding to user U's face image, the display control unit 214 will display a message on the display 24 instructing the user U to capture a printed copy of their personal information using the imaging device 26. User U will then capture a printed copy of their personal information using the imaging device 26.

In this case, the acquisition unit 211 acquires an image of the printed document containing user U's personal information from the imaging device 26. As described above, this image is an example of a "second image." The output unit 212 outputs the second image to the account management device 10. Subsequently, the acquisition unit 211 acquires the first string from the account management device 10.

1-2: Operation of the First Embodiment The operation of the account management system 1 according to the first embodiment will be described below with reference to Figures 6 to 8.

1-2-1: Operation during account registration Figure 6 is a sequence diagram showing the operation of the account management system 1 during account registration.

In step S1, the processing unit 21 in the terminal device 20-1 functions as an acquisition unit 211. The processing unit 21 acquires the user U's face image from the imaging device 26.

In step S2, the processing unit 21 in the terminal device 20-1 functions as an output unit 212. The processing unit 21 outputs the user U's face image acquired in step S1 to the account management device 10. The processing unit 11 in the account management device 10 functions as an acquisition unit 111. The processing unit 11 acquires the user U's face image from the terminal device 20-1.

In step S3, the processing unit 11 of the account management device 10 functions as an extraction unit 112. The processing unit 11 extracts feature quantities related to the characteristics of the face image from the face image of user U acquired in step S2.

In step S4, the processing unit 21 in the terminal device 20-1 functions as an acquisition unit 211. The processing unit 21 acquires a first image from the imaging device 26, which is an image of the printed document containing user U's personal information.

In step S5, the processing unit 21 in the terminal device 20-1 functions as an output unit 212. The processing unit 21 outputs the first image, which is an image of the printed document containing user U's personal information acquired in step S4, to the account management device 10. The processing unit 11 in the account management device 10 functions as an acquisition unit 111. The processing unit 11 acquires the first image, which is an image of the printed document containing user U's personal information, from the terminal device 20-1.

In step S6, the processing unit 11 of the account management device 10 functions as an image recognition unit 113. The processing unit 11 performs image recognition on the first captured image, which is an image of the printed document containing user U's personal information acquired in step S5, and generates a first string of characters representing the personal information.

In step S7, the processing unit 11 of the account management device 10 functions as an output unit 114. The processing unit 11 outputs the first string generated in step S6 to the terminal device 20-1. Furthermore, the processing unit 21 of the terminal device 20-1 functions as an acquisition unit 211. The processing unit 21 acquires the first string from the account management device 10.

In step S8, the processing unit 21 in the terminal device 20-1 functions as a generation unit 213. The processing unit 21 generates a first hash value by converting the first string obtained in step S7 using a hash function.

In step S9, the processing unit 21 in the terminal device 20-1 functions as an output unit 212. The processing unit 21 outputs the first hash value generated in step S8 to the account management device 10. Furthermore, the processing unit 11 in the account management device 10 functions as an acquisition unit 111. The processing unit 11 acquires the first hash value from the terminal device 20-1.

In step S10, the processing unit 21 in the terminal device 20-1 functions as a face ID management unit 115. The processing unit 21 generates a face ID based on the face image of user U.

In step S11, the processing unit 11 of the account management device 10 functions as a face ID management unit 115. The processing unit 21 associates the face ID generated in step S10, the feature quantities related to the features of the face image extracted in step S3, and the first hash value obtained in step S9, and stores them in the face ID database FDB stored in the storage device 12.

In step S12, the processing unit 11 of the account management device 10 functions as an account management unit 116. The processing unit 11 generates account information for user U, including user U's user ID, the first string generated in step S6, and the face ID generated in step S11.

In step S13, the processing unit 11 of the account management device 10 functions as an account management unit 116. The processing unit 11 stores the user U's account information, generated in step S12, in the account database ADB stored in the storage device 12.

The order of operations S1 to S13 may be rearranged as appropriate, as long as it allows for the generation of user U's account information.

1-2-2: First Operation During User Authentication Figure 7 is a sequence diagram showing the operation of the account management system 1 during user authentication. Note that the operation shown in Figure 7 is the operation when there is only one face ID corresponding to the face image of user U obtained from the terminal device 20-2.

In step S21, the processing unit 21 in the terminal device 20-2 functions as an acquisition unit 211. The processing unit 21 acquires the user U's face image from the imaging device 26.

In step S22, the processing unit 21 in the terminal device 20-2 functions as an output unit 212. The processing unit 21 outputs the user U's face image acquired in step S21 to the account management device 10. The processing unit 11 in the account management device 10 functions as an acquisition unit 111. The processing unit 11 acquires the user U's face image from the terminal device 20-2.

In step S23, the processing unit 11 of the account management device 10 functions as an extraction unit 112. The processing unit 11 extracts feature quantities related to the characteristics of the face image of user U, which was acquired in step S22.

In step S24, the processing unit 11 of the account management device 10 functions as a face ID management unit 115. Based on the degree of agreement between the feature quantities extracted in step S23 and the feature quantities stored in the face ID database FDB, the processing unit 11 identifies the face ID corresponding to the face image of user U obtained from the terminal device 20-2. Here, it is assumed that only one face ID is identified.

In step S25, the processing unit 11 of the account management device 10 functions as an account management unit 116. The processing unit 11 identifies account information, including the face ID identified in step S24, from among the account information stored in the account database ADB.

In step S26, the processing unit 11 of the account management device 10 functions as an output unit 114. The processing unit 11 outputs the first string contained in the account information identified in step S25 to the terminal device 20-2. Furthermore, the processing unit 21 of the terminal device 20-2 functions as an acquisition unit 211. The processing unit 21 acquires the first string from the account management device 10.

The order of operations in steps S21 to S26 may be rearranged as appropriate, as long as the account management device 10 can output the first string to the terminal device 20-2.

1-2-3: Second Operation During User Authentication Figure 8 is a sequence diagram showing the operation of the account management system 1 during user authentication. Note that the operation shown in Figure 8 is the operation when there are multiple face IDs corresponding to the face image of user U obtained from the terminal device 20-2.

In step S31, the processing unit 21 in the terminal device 20-2 functions as an acquisition unit 211. The processing unit 21 acquires the user U's face image from the imaging device 26.

In step S32, the processing unit 21 in the terminal device 20-2 functions as an output unit 212. The processing unit 21 outputs the user U's face image, acquired in step S31, to the account management device 10. The processing unit 11 in the account management device 10 functions as an acquisition unit 111. The processing unit 11 acquires the user U's face image from the terminal device 20-2.

In step S33, the processing unit 11 of the account management device 10 functions as an extraction unit 112. The processing unit 11 extracts feature quantities related to the characteristics of the face image of user U, which was acquired in step S32.

In step S34, the processing unit 11 of the account management device 10 functions as a face ID management unit 115. Based on the degree of agreement between the feature quantities related to the features of user U's face image extracted in step S33 and the feature quantities stored in the face ID database FDB, the processing unit 11 identifies the face ID corresponding to user U's face image obtained from the terminal device 20-2. Here, it is assumed that there are multiple identified face IDs.

In step S35, the processing unit 11 of the account management device 10 functions as an output unit 114. The processing unit 11 outputs specific information to the terminal device 20-2 indicating that the face ID corresponding to the face image acquired from the terminal device 20-2 is included multiple times among the multiple face IDs stored in the face ID database FDB. Furthermore, the processing unit 21 of the terminal device 20-2 functions as an acquisition unit 211. The processing unit 21 outputs specific information from the account management device 10 indicating that the face ID corresponding to the face image acquired from the terminal device 20-2 is included multiple times among the multiple face IDs stored in the face ID database FDB.

In step S36, the processing unit 21 in the terminal device 20-2 functions as an acquisition unit 211. The processing unit 21 acquires a second image from the imaging device 26, which is an image of the printed document containing user U's personal information.

In step S37, the processing unit 21 in the terminal device 20-2 functions as an output unit 212. The processing unit 21 outputs the second image, which is an image of the printed document containing user U's personal information acquired in step S36, to the account management device 10. The processing unit 11 in the account management device 10 functions as an acquisition unit 111. The processing unit 11 acquires the second image, which is an image of the printed document containing user U's personal information, from the terminal device 20-2.

In step S38, the processing unit 11 of the account management device 10 functions as an image recognition unit 113. The processing unit 11 performs image recognition on the second captured image, which is an image of the printed document containing user U's personal information acquired in step S37, and generates a second string of characters representing the personal information.

In step S39, the processing unit 11 of the account management device 10 functions as a face ID management unit 115. The processing unit 11 generates a second hash value by converting the second string generated in step S38 using a hash function.

In step S40, the processing unit 11 of the account management device 10 functions as a face ID management unit 115. From the multiple face IDs identified in step S34, the processing unit 11 identifies one face ID whose first hash value matches the second hash value generated in step S39.

In step S41, the processing unit 11 of the account management device 10 functions as an account management unit 116. The processing unit 11 identifies account information, including the face ID identified in step S40, from among the account information stored in the account database ADB.

In step S42, the processing unit 11 of the account management device 10 functions as an output unit 114. The processing unit 11 outputs the first string contained in the account information identified in step S41 to the terminal device 20-2. Furthermore, the processing unit 21 of the terminal device 20-2 functions as an acquisition unit 211. The processing unit 21 acquires the first string from the account management device 10.

The order of operations in steps S31 to S42 may be rearranged as appropriate, as long as the account management device 10 can output the first string to the terminal device 20-2.

1-3: Effects of the First Embodiment According to the above description, the account management device 10 according to this embodiment comprises an image recognition unit 113, a face ID management unit 115, and an account management unit 116. When registering an account corresponding to user U as a first person, the image recognition unit 113 generates a first captured image generated by the terminal device 20-1, which is a first terminal device, capturing a printed document of user U's personal information, and generates a first string of characters indicating the above personal information by image recognition. When registering an account corresponding to user U as a first person, the face ID management unit 115 generates a face ID, which is an identifier that corresponds one-to-one with the face image of user U, based on the face image of user U, and manages the generated face ID in association with feature quantities related to the features of the face image. When registering an account corresponding to user U, the account management unit 116 generates account information for user U, including the first string of characters and the face ID, and manages the generated account information.

The account management device 10, with the above configuration, allows a user to create an account for the second service without manually entering their personal information into an IT device, even if the ID card corresponding to the first service is not compatible with the second service. For example, an elderly person unfamiliar with IT device operation can easily create an account for the second service based on simple operations. Furthermore, by using an ID card readily available to anyone, such as a My Number Card, as the printed personal information, user U can create an account for digital services without possessing an IT device such as a smartphone or an email address for using IT devices. Moreover, since keyboard input is not required for account creation, the account management device 10 can prevent malicious individuals from entering information.

Furthermore, in the account management device 10 according to this embodiment, when authenticating user U as the first person, the face ID management unit 115 identifies a face ID corresponding to the face image acquired from terminal device 20-2, the second terminal device, based on the degree of agreement between the feature quantities related to the features of the face image acquired from terminal device 20-2, the second terminal device, and the feature quantities related to the features of the face image acquired from terminal device 20-1, the first terminal device. Also, when authenticating user U as the first person, the account management unit 116 identifies account information corresponding to the identified face ID and outputs the first string contained in the identified account information to terminal device 20-2.

The account management device 10, with the above configuration, allows user U to authenticate their identity without having to manually enter their personal information. In particular, user U only needs to capture an image of their face using the imaging device 26 on the terminal device 20-2, thus increasing the convenience of identity authentication.

Furthermore, in the account management device 10 according to this embodiment, when registering accounts corresponding to multiple people, the image recognition unit 113 performs image recognition on multiple first captured images generated by the terminal device 20-1, which is a first terminal device, capturing printed materials of multiple pieces of personal information that correspond one-to-one with multiple people, thereby generating multiple first strings that correspond one-to-one with multiple pieces of personal information and represent multiple pieces of personal information. Also, when registering accounts corresponding to multiple people, the face ID management unit 115 generates multiple face IDs that correspond one-to-one with the face images of multiple people based on the face images of multiple people, and manages multiple first hash values generated from the generated multiple face IDs, feature quantities related to the features of the face images of multiple people, and multiple first strings that correspond one-to-one with the multiple first strings, in association with each other. During the authentication of user U as the first person, if the face ID management unit 115 obtains a face image from terminal device 20-2 as the second terminal device and multiple face IDs are included among the multiple face IDs, the image recognition unit 113 generates a second string representing user U's personal information by performing image recognition on a second captured image generated when terminal device 20-2 captures a printed document containing user U's personal information. During user U's authentication, the face ID management unit 115 generates a second hash value from the second string and identifies one face ID from the multiple face IDs based on the similarity or difference between the first and second hash values.

The account management device 10, with the above configuration, eliminates the possibility that, for example, when one person among several people with similar faces, such as twins, attempts identity verification, the facial ID identified as their own facial ID may not be limited to just one. In other words, the account management device 10 eliminates the possibility of identifying multiple facial IDs as user U's facial ID, rather than just one uniquely associated with user U. In such cases, user U only needs to capture images of their face and printed personal information using the imaging device 26 on the terminal device 20-2, thus increasing the convenience of identity verification.

2. Modifications This disclosure is not limited to the embodiments illustrated above. Specific examples of modifications are given below. Two or more embodiments may be arbitrarily selected from the following examples and combined.

2-1: Variation 1
As described above, when user U is authenticated, if multiple face IDs are initially identified as face IDs corresponding to user U's face image, the face ID management unit 115 in the account management device 10 generates a second hash value by converting the second string using a hash function. In this modified example 1, the second hash value may be output from the account management device 10 to the terminal device 20-2 and then stored in the terminal device 20-2. In this case, when user U authenticates for the second time or later using the terminal device 20-2, the terminal device 20-2 outputs the second hash value to the account management device 10 instead of the second captured image. The face ID management unit 115 in the account management device 10 identifies one face ID based on the similarities and differences between the first hash value corresponding to each of the multiple face IDs and the second hash value obtained from the terminal device 20-2. Specifically, the face ID management unit 115 identifies one face ID from among multiple face IDs whose first hash value matches the second hash value.

As a result, since multiple facial IDs were identified, after initial authentication by having the user U photograph a printed copy of their personal information with the second terminal device, the user U does not need to photograph the printed copy of their personal information again with terminal device 20-2 when performing further authentication.

2-2: Modification 2
As described above, user U uses terminal device 20-1 when registering an account and terminal device 20-2 when authenticating their identity. In the first embodiment, terminal device 20-1 and terminal device 20-2 are different devices. However, in this modified example 2, terminal device 20-1 and terminal device 20-2 may be the same terminal device 20.

As a result, user U can use the same terminal device 20 for both account registration and identity verification. For example, user U can perform both account registration and identity verification by using terminal device 20, which is owned by the user.

2-3: Variation 3
In the first embodiment described above, during user authentication, the account management device 10 outputs a first string to the terminal device 20-2. However, the target to which the account management device 10 outputs the first string is not limited to the terminal device 20-2. For example, the account management device 10 may output the first string to a server that provides services using the Internet. This server is an example of an "external device".

2-4: Variation 4
In the first embodiment described above, during user authentication, if multiple facial IDs were initially identified, the terminal device 20-2 captured an image of user U's personal information printout. However, the terminal device 20-2 may capture both user U's face and user U's personal information printout, rather than being limited to cases where multiple facial IDs are identified. In this case, the account management device 10 uses both user U's facial image and a second captured image, which is an image of user U's personal information printout, to perform user U's authentication through multi-factor authentication.

3. Other (1) In the embodiments described above, ROM and RAM were given as examples for the storage devices 12 and 22, but other suitable storage media include flexible disks, magneto-optical disks (e.g., compact disks, digital multipurpose disks, Blu-ray® disks), smart cards, flash memory devices (e.g., cards, sticks, key drives), CD-ROMs (Compact Disc-ROMs), registers, removable disks, hard disks, floppy® disks, magnetic strips, databases, servers, and other appropriate storage media. The program may also be transmitted from a network via a telecommunications line. The program may also be transmitted from a communication network NET via a telecommunications line.

(2) In the embodiments described above, the information, signals, etc., may be represented using any of the various different techniques. For example, the data, instructions, commands, information, signals, bits, symbols, chips, etc., which may be referred to throughout the above description, may be represented by voltage, current, electromagnetic waves, magnetic fields or magnetic particles, optical fields or photons, or any combination thereof.

(3) In the embodiments described above, the input and output information may be stored in a specific location (e.g., memory) or managed using a management table. The input and output information may be overwritten, updated, or appended to. The output information may be deleted. The input information may be transmitted to other devices.

(4) In the embodiments described above, the determination may be made by a value represented using one bit (0 or 1), by a boolean value (true or false), or by a numerical comparison (for example, a comparison with a predetermined value).

(5) The processing procedures, sequences, flowcharts, etc., exemplified in the embodiments described above may be rearranged in order, as long as there is no inconsistency. For example, the methods described in this disclosure present various step elements using an exemplary order and are not limited to the specific order presented.

(6) Each function illustrated in Figures 1 to 8 is implemented by any combination of at least one of hardware and software. Furthermore, the method of implementing each functional block is not particularly limited. That is, each functional block may be implemented using a single device that is physically or logically coupled, or it may be implemented using two or more physically or logically separated devices connected directly or indirectly (e.g., using wired or wireless connections). A functional block may also be implemented by combining software with the single device or the multiple devices described above.

(7) The programs illustrated in the embodiments described above should be broadly interpreted to mean instructions, instruction sets, code, code segments, program code, programs, subprograms, software modules, applications, software applications, software packages, routines, subroutines, objects, executable files, execution threads, procedures, functions, etc., whether they are called software, firmware, middleware, microcode, hardware description languages, or by other names.

Furthermore, software, instructions, information, etc., may be transmitted and received via a transmission medium. For example, if software is transmitted from a website, server, or other remote source using at least one of wired technologies (such as coaxial cable, fiber optic cable, twisted pair, or digital subscriber line (DSL)) and wireless technologies (such as infrared or microwave), then at least one of these wired and wireless technologies is included within the definition of a transmission medium.

(8) In each of the aforementioned forms, the terms “system” and “network” shall be used interchangeably.

(9) The information, parameters, etc., described in this disclosure may be expressed using absolute values, relative values from a given value, or corresponding other information.

(10) In the embodiments described above, the account management device 10 and terminal devices 20-1 to 20-2 may be mobile stations (MS). A mobile station may also be referred to by those skilled in the art as a subscriber station, mobile unit, subscriber unit, wireless unit, remote unit, mobile device, wireless device, wireless communication device, remote device, mobile subscriber station, access terminal, mobile terminal, wireless terminal, remote terminal, handset, user agent, mobile client, client, or several other appropriate terms. Furthermore, in this disclosure, terms such as “mobile station,” “user terminal,” “user equipment (UE),” and “terminal” may be used interchangeably.

(11) In the embodiments described above, the terms “connected,” “coupled,” or any variation thereof, mean any direct or indirect connection or coupling between two or more elements, including the presence of one or more intermediate elements between two elements that are “connected” or “coupled” with each other. The coupling or connection between elements may be a physical coupling or connection, a logical coupling or connection, or a combination thereof. For example, “connection” may be reinterpreted as “access.” As used in this disclosure, two elements are considered to be “connected” or “coupled” with each other using at least one of one or more wires, cables, and printed electrical connections, and, in some non-limiting and non-exclusive examples, electromagnetic energy having wavelengths in the radio frequency domain, microwave domain, and optical (both visible and invisible) domain.

(12) In the embodiments described above, the phrase "based on" does not mean "based solely on" unless otherwise specified. In other words, the phrase "based on" means both "based solely on" and "based at least on."

(13) The terms “determining” and “determining” as used in this disclosure may encompass a wide variety of actions. “Determining” may include, for example, judging, calculating, computing, processing, deriving, investigating, looking up, searching, or inquiring (e.g., searching in a table, database, or other data structure), or ascertaining. “Determining” may also include receiving (e.g., receiving information), transmitting (e.g., sending information), inputting, outputting, or accessing (e.g., accessing data in memory). Furthermore, "judgment" and "decision" can include considering something as having been "judged" or "decided" after resolving, selecting, choosing, establishing, comparing, etc. In other words, "judgment" and "decision" can include considering some action as having been "judged" or "decided." Also, "judgment (decision)" can be reinterpreted as "assuming," "expecting," or "considering."

(14) In the embodiments described above, where “include,” “including,” and variations thereof are used, these terms are intended to be inclusive, as is the term “comprising.” Furthermore, the term “or” as used in this disclosure is not intended to be exclusive OR.

(15) In the present disclosure, if articles are added through translation, such as a, an, and the in English, the present disclosure may include the fact that the noun following these articles is plural.

(16) In this disclosure, the term “A and B are different” may mean “A and B are different from each other.” The term may also mean “A and B are each different from C.” Terms such as “separate” and “combined” may be interpreted similarly to “different.”

(17) Each aspect/embodiment described herein may be used individually, in combination, or switched between as needed during implementation. Furthermore, notification of specific information (e.g., notification of "being X") is not limited to explicit notification, but may also be implicit (e.g., by not providing such notification).

While the present disclosure has been described in detail above, it will be clear to those skilled in the art that the present disclosure is not limited to the embodiments described herein. The present disclosure can be implemented in modified and altered forms without departing from the intent and scope of the present disclosure as defined by the claims. Therefore, the descriptions in this disclosure are illustrative and not restrictive in any way.

1…Account Management System, 10…Account Management Device, 11…Processing Device, 12…Storage Device, 13…Communication Device, 14…Display, 15…Input Device, 20…Terminal Device, 21…Processing Device, 22…Storage Device, 23…Communication Device, 24…Display, 25…Input Device, 26…Imaging Device, 111…Acquisition Unit, 112…Extraction Unit, 113…Image Recognition Unit, 114…Output Unit, 115…Face ID Management Unit, 116…Account Management Unit, 211…Acquisition Unit, 212…Output Unit, 213…Generation Unit, 214…Display Control Unit, PR1…Control Program, PR2…Control Program

Claims (3)

When registering an account corresponding to a first person, an image recognition unit generates a first captured image by image recognition of a first captured image generated when a first terminal device captures a printed document containing the personal information of the first person, thereby generating a first string of characters representing the personal information.
A face ID management unit generates a face ID, which is an identifier that corresponds one-to-one with the face image of the first person, when registering an account corresponding to the first person, and manages the generated face ID in association with feature quantities related to the features of the face image.
An account management unit generates account information for the first person, including the first string and the face ID, when registering an account corresponding to the first person, and manages the generated account information.
Equipped with ,
When authenticating the first person, the face ID management unit identifies the face ID corresponding to the face image acquired from the second terminal device based on the degree of agreement between the feature quantities relating to the features of the face image acquired from the second terminal device and the feature quantities relating to the features of the face image acquired from the first terminal device.
When authenticating the first person, the account management unit identifies account information corresponding to the identified facial ID, and outputs the first string contained in the identified account information to an external device.
When registering an account for multiple individuals, the image recognition unit performs image recognition on multiple first captured images generated by the first terminal device capturing printed materials containing multiple pieces of personal information that correspond one-to-one with the multiple individuals, thereby generating multiple first strings that correspond one-to-one with the multiple pieces of personal information and represent the multiple pieces of personal information.
When registering accounts corresponding to the aforementioned multiple persons, the face ID management unit generates multiple face IDs that correspond one-to-one with the face images of the aforementioned multiple persons based on the face images of the aforementioned multiple persons, and manages the generated multiple face IDs, feature quantities relating to the features of the face images of the aforementioned multiple persons, and multiple first hash values generated from the aforementioned multiple first strings that correspond one-to-one with the aforementioned multiple first strings, in association with each other.
When authenticating the first person, if the face ID management unit finds that multiple face IDs corresponding to the face image acquired from the second terminal device are included among the multiple face IDs, the image recognition unit generates a second string of characters indicating the personal information of the first person by performing image recognition on a second captured image generated when the second terminal device captures a printed document containing the personal information of the first person.
An account management device that, upon authentication of the first person, generates a second hash value from the second string, and identifies one face ID from the multiple face IDs based on the similarity or difference between the first hash value and the second hash value . When authenticating the first person, the facial ID management unit outputs the generated second hash value to the second terminal device.
Upon further authentication of the first person, the facial ID management unit obtains the second hash value stored in the second terminal device from the second terminal device, and identifies the one facial ID based on the similarity or difference between the first hash value and the obtained second hash value.
The account management device according to claim 1 . The account management device according to claim 1 , wherein the first terminal device and the second terminal device are the same terminal device.