JP2008040743A - Information carrier with IC and information management method - Google Patents

Abstract

Provided is an information carrier with an IC capable of safely managing personal authentication information recorded in an information carrier with an IC and improving convenience.
A storage unit storing a plurality of personal authentication information and personal authentication information stored in the storage unit are selected in descending order of priority given to the individual authentication information. Authentication execution means for performing personal authentication, and priority update means for updating the priority of personal authentication information so that the priority of personal authentication information that has been authenticated as a result of performing authentication processing by the authentication execution means is higher And with.
[Selection] Figure 2

Description

  The present invention relates to an information carrier with an IC on which personal authentication information including biometric information such as a face, a fingerprint, a vein, a voice print, and an iris print is recorded, and an information management method for managing the recorded information.

  2. Description of the Related Art Conventionally, there are known personal authentication methods and systems that are executed using the above-described biometric information at the time of personal authentication at the time of transaction settlement, such as a cash card or credit card, or personal authentication at entry / exit in a security area. In such personal authentication, even if it is the same person, there are many variations in input data due to physical condition etc., and it has been pointed out that sufficient accuracy cannot be obtained. A personal authentication method for performing personal authentication has been proposed (see, for example, Patent Document 1). According to the technique disclosed in Patent Document 1, a plurality of pieces of biological information are registered in advance with respect to the person to be authenticated. Therefore, when authentication is required, Since the individual verification is performed and the individual verification results are integrated, a recognition result with high accuracy can be obtained regardless of variations in input data.

However, it is necessary to perform each biometric authentication in a predetermined pattern in a predetermined order. For this reason, it is inefficient depending on the application. For example, whether or not biometric authentication is performed depending on time and place. There is a problem that it is not possible to use the information in a highly flexible manner, such as deciding on a combination or changing the combination or order depending on the person to be authenticated. In order to solve such a problem, an authentication apparatus capable of arbitrarily changing the combination and order of biometric authentication and performing efficient personal authentication in consideration of time and place factors in the combination. Has been proposed (see, for example, Patent Document 2).
JP 2001-351507 A JP 2006-085251 A

  By the way, personal authentication based on biometric information has a feature that can prevent unauthorized use, but it is difficult to make the recognition rate of the person 100%, and even the person himself may be determined to be another person. is there. Thus, even if the person is determined to be another person, there is a problem in terms of convenience because a situation in which the service cannot be received occurs when the user wants to receive the service. For this reason, the threshold of similarity of pattern matching using biometric information is adjusted to increase the probability that the person is determined to be the person.

  However, reducing the similarity threshold for pattern matching of biometric information and increasing the probability that the person is determined to be the person is likely to increase the possibility that the other person is determined to be the person. This means that it is difficult to achieve both convenience and safety. For this reason, it is necessary to protect personal authentication information securely and safely.

  The present invention has been made in view of such circumstances. An information carrier with an IC capable of safely managing personal authentication information recorded in an information carrier with an IC and improving convenience, and The purpose is to provide an information management method.

  The present invention selects a storage means storing a plurality of pieces of personal authentication information and the personal authentication information stored in the storage means in descending order of priority given to each personal authentication information. And priority for updating the priority of the personal authentication information so that the priority of the personal authentication information that has been authenticated as a result of performing the authentication processing by the authentication execution means is higher. And a rank updating means.

  The present invention is characterized in that the personal authentication information is biometric information.

  The present invention selects a storage means storing a plurality of pieces of personal authentication information and the personal authentication information stored in the storage means in descending order of priority given to each personal authentication information. An information management method for an information carrier with an IC provided with an authentication execution means for executing personal authentication, and the priority of personal authentication information that can be authenticated as a result of performing authentication processing by the authentication execution means is high. It has a priority update step for updating the priority of the personal authentication information.

  According to the present invention, when authentication is not possible, another authentication application is executed to perform personal authentication, and among a plurality of authentication applications that can be executed, if there is an authentication application that can be authenticated, the user is a valid user. As a result, it is possible to execute a desired application, so that it is possible to reduce the possibility that the user is determined to be another person but the convenience can be improved. In addition, since the authenticated authentication application is preferentially executed, it is possible to increase the possibility that the user can be authenticated by the initial authentication application.

  Hereinafter, an information carrier with an IC according to an embodiment of the present invention will be described with reference to the drawings. Here, an IC card will be described as an example of the information carrier with IC according to the present invention. FIG. 1 is a block diagram showing the configuration of the embodiment. In this figure, reference numeral 1 denotes an IC card terminal that inserts an IC card 2 into an insertion slot and reads / writes information stored in the IC card 2. For example, an automatic teller machine installed in a bank or the like (ATM).

  Reference numeral 11 denotes a control unit that performs overall control of processing operations of the IC card terminal 1. Reference numeral 12 denotes an input unit composed of a touch panel or the like capable of operating numeric keys, function keys, character keys, and the like. Reference numeral 13 denotes a display unit composed of a display device or the like. The input unit 12 and the display unit 13 may be configured to be integrated. Reference numeral 14 denotes an input / output unit that exchanges information with the IC card 2. Reference numeral 15 denotes a biometric information acquisition unit that reads biometric information (biometrics) such as a face, fingerprint, vein, voice print, iris print, and the like. The biological information acquisition unit 15 can read at least two pieces of biological information among biological information such as a face, a fingerprint, a vein, a voice print, and an iris print. Here, a description will be given assuming that fingerprints and veins can be read. Reference numeral 16 denotes an authentication processing unit that performs authentication by comparing the biometric information acquired by the biometric information acquisition unit 15 with the personal authentication information stored in the IC card 2. Reference numeral 17 denotes an application execution unit that executes an application (for example, cash payment) when authentication is performed by the authentication processing unit 16 and it is confirmed that the user is a valid user.

  Reference numeral 21 denotes a control unit that performs overall control of processing operations in the IC card 2. Reference numeral 22 denotes a program storage unit in which an application program to be executed in the IC card 2 is stored. Reference numeral 23 denotes an input / output unit that exchanges information with the IC card terminal 1. Reference numeral 24 denotes an application information storage unit in which information on applications that can be executed in the IC card 2 is stored. Reference numerals 25 and 26 denote authentication information storage units each storing two pieces of biometric information among biometric information such as the user's face, fingerprint, vein, voice print, iris print, and the like of the IC card 2. Here, description will be made assuming that fingerprint information and vein information are stored.

  Next, information stored in the application information storage unit 24 shown in FIG. 1 will be described with reference to FIG. The application information storage unit 24 stores an ID for identifying an application that can be executed using the IC card 2 (this is referred to as an application ID (AID)). The size of the application ID is stored at the top of the application ID, and the application ID and the priority of the application (the smaller the value, the higher the priority) are stored following the size of the application ID. FIG. 3 shows an example in which there are three application IDs stored in the application information storage unit 24. The application here is, for example, an application that outputs application list information, an application that performs fingerprint authentication, an application that performs vein authentication, or the like.

  Next, operations of the IC card terminal 1 and the IC card 2 shown in FIG. 1 will be described with reference to FIG. FIG. 2 is a flowchart showing an operation of performing authentication by another authentication application when one application among the authentication applications that can be executed using the IC card 2 cannot be authenticated.

  First, when detecting that the IC card 2 is inserted into the insertion slot of the IC card terminal 1, the control unit 11 causes the display unit 13 to select an application to be executed on the IC card terminal 1. Display a message. Here, the user operates the input unit 12 to select “cash payment”. In response to this, the control unit 11 specifies an AID and transmits a command for selecting an application for reading the application list information to the IC card 2 via the input / output unit 14 (step S1). In response to this, the control unit 21 receives an application selection command transmitted from the IC card terminal 1 via the input / output unit 23, and based on whether or not the selected application can be executed. A response is made to the IC card terminal 1 as to whether or not the application has been selected (step S2). Then, the control unit 21 reads the application list information stored in the application information storage unit 24 and responds to the IC card terminal 1. The application list information is received by the control unit 11 and held inside (steps S3 and S4).

  Next, the control unit 11 refers to the internally stored application list information, selects the application with the highest priority assigned to each application, inputs a command for selecting this application by specifying the AID. It transmits to the IC card 2 through the output unit 14 (step S5). In response to this, the control unit 21 receives an application selection command transmitted from the IC card terminal 1 via the input / output unit 23, and based on whether or not the selected application can be executed. A response is made to the IC card terminal 1 as to whether or not the application has been selected (step S6). Here, it is assumed that the fingerprint authentication application is selected.

  Next, when the application can be selected, the control unit 11 displays a message indicating that fingerprint authentication is performed on the display unit 13. On the other hand, the user causes the biometric information acquisition unit 15 to read the fingerprint of his / her finger. The control unit 11 reads this biological information and holds it inside. Then, the control unit 11 transmits an authentication (fingerprint) command to the IC card 2. The control unit 21 that has received this authentication command reads the biometric information (fingerprint information) stored in the authentication information storage unit 25 and transmits it to the IC card terminal 1. Upon receiving this biometric information, the authentication processing unit 16 collates the received biometric information with the biometric information stored therein, and executes personal authentication based on whether or not they match (steps S7 and S8). .

  Next, the control part 11 determines whether it was able to authenticate as a result of performing this authentication process (step S9). If the result of this determination is that authentication has failed, the controller 11 determines whether or not all authentication applications have been selected and executed (step S10). If there is an authentication application that has not yet been selected as a result of this determination, the process returns to step S5 to select the authentication application (vein authentication) with the next highest priority and repeat the same processing. If all authentication applications have been executed but authentication has failed, the control unit 11 closes the authentication application that could not be authenticated and displays a message indicating that the authentication cannot be performed on the display unit 13 for processing. Is finished (step S11).

  Next, when the authentication is successful in step S9, the user is regarded as a valid user, and the application (cash payment) is also instructed to be executed to the application execution unit 17. In response to this, the application execution unit 17 executes the designated application. In addition, the control unit 11 determines whether or not the priority order of the authentication application that can be authenticated is a priority order of “2” or higher (step S12). As a result of this determination, when the priority of the authentication application that can be authenticated is “1”, the control unit 11 ends the process. On the other hand, when the priority of the authentication application that can be authenticated is the priority after “2”, the control unit 11 transmits a command for changing the priority to the IC card 2 (Step S1). S13). This command includes the AID of the authentication application that can be authenticated. In response, the control unit 21 updates the priority order stored in the application information storage unit 24 (step S14). At this time, the control unit 21 sets the priority of the AID authentication application notified from the IC card terminal 2 to “1”, and sequentially lowers the priority of other authentication applications as necessary.

  In this way, if authentication is not possible, authentication is performed by executing another authentication application, and if there is an application that can be authenticated among a plurality of authentication applications that can be executed, it is regarded as a valid user. Since the desired application can be executed, it is possible to reduce the possibility that the person himself / herself is determined to be another person. In addition, since the authenticated authentication application is preferentially executed, it is possible to increase the possibility that the user can be authenticated by the initial authentication application.

  The information management process is performed by recording a program for realizing the function of the processing unit in FIG. 1 on a computer-readable recording medium, causing the computer system to read and execute the program recorded on the recording medium. You may go. Here, the “computer system” includes an OS and hardware such as peripheral devices. The “computer-readable recording medium” refers to a storage device such as a flexible medium, a magneto-optical disk, a portable medium such as a ROM and a CD-ROM, and a hard disk incorporated in a computer system. Further, the “computer-readable recording medium” refers to a volatile memory (RAM) in a computer system that becomes a server or a client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. In addition, those holding programs for a certain period of time are also included.

  The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, and what is called a difference file (difference program) may be sufficient.

It is a block diagram which shows the structure of one Embodiment of this invention. It is a flowchart which shows operation | movement of the apparatus shown in FIG. It is explanatory drawing which shows the format of the information memorize | stored in the application information storage part 24 shown in FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... IC card terminal, 11 ... Control part, 12 ... Input part, 13 ... Display part, 14 ... Input / output part, 15 ... Biometric information acquisition part, 16 ... Authentication processing unit, 17 ... application execution unit, 2 ... IC card, 21 ... control unit, 22 ... program storage unit, 23 ... input / output unit, 24 ... application information storage unit , 25, 26... Authentication information storage unit

Claims (3)

Storage means for storing a plurality of personal authentication information;
Authentication execution means for selecting personal authentication information in descending order of priority given to each personal authentication information from among the personal authentication information stored in the storage means, and executing personal authentication;
A priority order updating means for updating the priority order of the personal authentication information so that the priority order of the personal authentication information that can be authenticated as a result of performing the authentication process by the authentication execution means is increased. With information carrier.   The information carrier with IC according to claim 1, wherein the personal authentication information is biometric information. A plurality of personal authentication information stored in the storage means, and the personal authentication information stored in the storage means is selected in descending order of priority given to each personal authentication information, An information management method in an information carrier with an IC comprising an authentication execution means for executing authentication,
An information management method comprising a priority update step of updating the priority of the personal authentication information so that the priority of the personal authentication information that has been authenticated as a result of performing the authentication process by the authentication execution means is increased. .

Images