JP2011209940A - Device and method for detecting unauthorized access - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an unauthorized access detection device and method which has a high detection accuracy over an unauthorized access.SOLUTION: The unauthorized access detection device is equipped with: an authentication result management part which manages an authentication result when comparing and collating the user ID and biological information received from a client terminal with the user ID and biological information registered beforehand; and a trend extraction part which detects the unauthorized access, based on the extraction result of a fluctuation trend of a collating score for each user ID, and a fluctuation trend of biological data quality for collation from the authentication result.

Description

  The present invention relates to an unauthorized access detection device and an unauthorized access detection method according to a biometric authentication system.

  In a biometric authentication system, a biometric sensor connected to a client terminal acquires biometric information during authentication. The image processing unit of the client terminal corrects the biological information by performing processing such as noise removal on the input biological information. Further, the feature extraction unit extracts feature information, creates biometric data for verification used for biometric authentication, and sends the biometric data to the server-side matcher. The matcher performs identity determination using biometric data (registration template) registered in advance and biometric data for verification sent from the feature extraction unit, and returns a verification result to the client terminal.

  There are a plurality of places that can be attack points in the biometric authentication system. In a client-server biometric authentication system that uses ID and biometric information to verify the identity, the number of consecutive authentication failures for a predetermined period is recorded as a countermeasure against unauthorized access to the system, and the number of authentication failures exceeds the threshold. If this happens, it is regarded as unauthorized access and a user account is locked. Further, ID information and biometric information input in the past are recorded, and unauthorized access is estimated by comparing the ID information and biometric information input at the time of authentication with the ID information and biometric information input in the past. There is a way to judge. These typical unauthorized access detection methods can protect the system from an attack of a malicious person who attempts to access the system by impersonating a legitimate user. Patent Document 1 discloses an unauthorized access monitoring method for a hill climb attack, which is an example of unauthorized access.

JP 2000-132515 A

  However, in the technique of Patent Document 1, when the ID information matches and the biometric information does not match, there is a problem that it is impossible to distinguish whether the authentication failure has continued due to unauthorized access or whether the authorized user has repeated the authentication failure. is there. Biometric authentication has characteristics that when a legitimate user repeatedly fails to authenticate, the quality of the biometric data for verification does not vary and the variation of the verification score does not vary. On the other hand, in the case of hill cli attack, biometric data for verification is changed, and authentication is repeatedly requested. Therefore, if the quality of the biometric data for verification and the verification score vary, or if the quality of the biometric data for verification does not vary and the verification score varies, the behavior differs from that when the authorized user repeatedly fails authentication. It can be seen. Therefore, it is necessary to provide a method for discriminating unauthorized access and authentication failure of a legitimate user from the fluctuation of the collation score and the fluctuation of the biometric data quality for collation.

  The present invention has been made in view of the above problems, and an object thereof is to provide an unauthorized access detection device and an unauthorized access detection method having high detection accuracy for unauthorized access.

  In order to solve the above-described problem, the unauthorized access detection device disclosed in the specification manages an authentication result when a user ID and biometric information received from a client terminal are compared with a user ID and biometric information registered in advance. An authentication result management unit, and a tendency extraction unit that detects unauthorized access based on an extraction result of a verification tendency of a verification score for each user ID and a verification trend of biometric data quality for verification from the authentication result. .

  In order to solve the above problem, the unauthorized access detection method disclosed in the specification manages an authentication result when comparing and collating ID information and biometric information received from a client terminal with previously registered ID information and biometric information. An authentication result management step, and a tendency extraction step of detecting unauthorized access based on an extraction result of a verification tendency for each user ID and a fluctuation tendency of biometric data quality for verification from the authentication result.

  According to the unauthorized access detection device and the unauthorized access detection method disclosed in the specification, high detection accuracy for unauthorized access can be realized.

It is a figure for demonstrating the attack point of a fingerprint authentication system. It is a figure for demonstrating the kind of attack. It is a figure for demonstrating the countermeasure method with respect to each attack. It is a figure for demonstrating correction of the data for fingerprint collation. 1 is a block diagram of a biometric authentication system including an unauthorized access detection device according to Embodiment 1. FIG. It is a device block diagram of a client terminal and an authentication server. It is a figure for demonstrating an example of user identification information. It is a figure for demonstrating an example of an authentication result. It is a figure for demonstrating an example of the histogram of the pixel value of a fingerprint authentication image. It is an example of high-quality fingerprint image data. It is an example of fingerprint image data with low quality. It is an example of fingerprint image data with low quality. It is an example of fingerprint image data with low quality. It is an example of fingerprint image data with low quality. An example of the fluctuation data of a collation score is shown. An example of variation data of collation fingerprint data is shown. It is a figure which shows a specific unauthorized access determination policy. It is a flowchart which shows the flow of an unauthorized access judgment process. It is a figure for demonstrating extraction of the variance value of fingerprint data quality for collation. It is a figure for demonstrating the predefined unauthorized access determination policy. It is a figure for demonstrating the example of the dispersion | distribution value of a collation score, and the dispersion | distribution value of fingerprint data quality for collation. It is a figure for demonstrating the weight used when calculating a risk evaluation value. It is a figure for demonstrating an unauthorized access determination policy. It is a figure for demonstrating the fluctuation data of the position of the feature point in a predetermined period. It is a figure which shows the example of the fingerprint data for collation combined. It is a figure for demonstrating an unauthorized access determination policy. It is a figure for demonstrating the fluctuation data of the angle of the feature point in a predetermined period. It is a figure for demonstrating the angle of a feature point. It is a figure for demonstrating an unauthorized access determination policy. It is a figure for demonstrating the fluctuation data of the number of the feature points in a predetermined period. It is a figure for demonstrating an unauthorized access determination policy. It is a figure for demonstrating the fingerprint data for collation in a predetermined period. It is a figure for demonstrating an unauthorized access determination policy. It is a block diagram of the biometrics authentication system provided with the unauthorized access detection apparatus which concerns on Example 2. FIG. It is a figure for demonstrating the information contained in the image acquired from the sensor. It is a figure for demonstrating the example of a code description. It is a figure which shows an example of a code management table. It is a figure which shows the example of the code description to the fingerprint data for collation. It is a figure for demonstrating the detail of a sensor. It is a figure which shows the fingerprint image data after the correction | amendment in which the code was described. It is a figure for demonstrating the detail of a sensor. It is a figure which shows the fingerprint image data after the correction | amendment in which the code was described. It is a figure for demonstrating the detail of a sensor. It is a block diagram of the biometrics authentication system provided with the unauthorized access detection apparatus which concerns on Example 3. FIG. It is a figure for demonstrating an example of the flowchart performed in the case of the automatic learning of an attack pattern. It is a figure for demonstrating an example of the automatic learning result of an attack pattern. It is a figure for demonstrating an example of the unauthorized access determination policy in which the pattern of unauthorized access was reflected. It is a figure which shows the automatic learning result of an attack pattern. It is a figure which shows the example of the unauthorized access determination policy in which the automatically learned content was reflected. It is a figure which shows the automatic learning result of an attack pattern. It is a figure which shows the example of the unauthorized access determination policy in which the automatically learned pattern was reflected. It is a figure which shows an example of an automatic learning result. It is a figure which shows the example of the unauthorized access determination policy in which the automatically learned pattern was reflected. It is a figure which shows the automatic learning result of an attack pattern. It is a figure which shows the example which decrypted the encrypted fingerprint data for a comparison contained in the authentication result, and managed with the management table. It is a figure which shows the example of the unauthorized access determination policy in which the automatically learned pattern was reflected. It is a block diagram of the biometrics authentication system provided with the unauthorized access detection apparatus which concerns on Example 4. FIG.

  First, an attack method of a client / server type fingerprint authentication system will be described. FIG. 1 is a diagram for explaining an attack point of the fingerprint authentication system. Referring to FIG. 1, there are about eight places that can be attack points. FIG. 2 is a diagram for explaining the types of attacks. FIG. 3 is a diagram for explaining a countermeasure method for each attack. The following example mainly relates to a countermeasure against Hill climb attack of Type 4.

The flow of hill climb attack is shown below.
1) A plurality of biometric data for matching having the same number of feature points are created.
2) The user ID is fixed, the verification fingerprint data created in 1) is sent to the server, and the score is accumulated for each combination of the user ID and the verification biometric data.
3) Extract biometric data for collation that maximizes the collation score.
4) The fingerprint data for verification is corrected as shown in FIG. 4 and sent to the server using the same user ID as in 2) above, and a score is accumulated for each combination of the user ID and biometric data for verification. Extract fingerprint data for verification that maximizes. Referring to FIG. 4, the feature point is moved (FIG. 4A), the direction of the feature point is moved (FIG. 4B), and the feature point is newly added / deleted.
5) Repeat 4) until successful authentication

  FIG. 5 is a block diagram of the biometric authentication system 100 including the unauthorized access detection device according to the first embodiment. As an example, the biometric authentication system 100 is a biometric authentication system that performs fingerprint authentication. Referring to FIG. 5, biometric authentication system 100 has a configuration in which client terminal 10 is connected to authentication server 30 via network 20. As the network 20, a communication network formed by a public network, the Internet, an intranet, or the like can be used.

  The client terminal 10 includes an ID input unit 11, an image processing unit 12, a feature extraction unit 13, a quality extraction unit 14, a communication unit 15, and a sensor 40. The authentication server 30 includes a registration template storage unit 31, a matcher 32, an access control unit 33, an authentication result management unit 34, and a tendency extraction unit 35.

  FIG. 6 is a device configuration diagram of the client terminal 10 and the authentication server 30. Referring to FIG. 6, the client terminal 10 includes a CPU (Central Processing Unit) 101, a RAM (Random Access Memory) 102, an HDD (Hard Disk Drive) 103, an input / output interface 104, a LAN interface 105, and the like. Each device is connected by a bus. When the CPU 101 executes a program stored in the HDD 103 or the like, the ID input unit 11, the image processing unit 12, the feature extraction unit 13, and the quality extraction unit 14 are realized in the client terminal 10. Further, the LAN interface 105 functions as the communication unit 15.

  The authentication server 30 includes a CPU (central processing unit) 201, a RAM (random access memory) 202, an HDD (hard disk drive) 203, an input / output interface 204, a LAN interface 205, and the like. Each device is connected by a bus. When the CPU 201 executes a program stored in the HDD 203 or the like, the registration template storage unit 31, the matcher 32, the access control unit 33, the authentication result management unit 34, and the trend extraction unit 35 are realized in the authentication server 30. .

  Referring to FIG. 5, the ID input unit 11 acquires a user ID input by a user. The image processing unit 12 acquires fingerprint image data input from the sensor 40. Next, the image processing unit 12 performs image correction such as removing noise from the fingerprint image data, and passes the fingerprint image data to the feature extraction unit 13. The feature extraction unit 13 generates verification fingerprint data from the fingerprint image data and passes it to the quality extraction unit 14. The quality extraction unit 14 extracts the quality of the fingerprint data for verification from the fingerprint image data by a predetermined quality determination method. The communication unit 15 transmits user identification information including the IP address of the client terminal 10, the biometric authentication type, the user ID, the fingerprint data for verification, the quality of the fingerprint data for verification, and the like to the authentication server 30 together with the authentication request. FIG. 7 is a diagram for explaining an example of user identification information. The biometric authentication type is information for specifying the biometric authentication type such as fingerprint authentication and vein authentication.

  The matcher 32 acquires a registration template corresponding to the user ID included in the user identification information from the registration template storage unit 31 and performs matching with the fingerprint data for verification transmitted from the client terminal 10. The matcher 32 calculates a matching score obtained as a result of matching. The matching score is synonymous with the matching degree in matching, and increases as the matching degree in matching increases. The access control unit 33 returns authentication success (Yes) to the client terminal 10 if the matching score is equal to or greater than a predefined threshold. On the other hand, if the verification score is less than the threshold value, the access control unit 33 returns authentication failure (No), and requests biometric authentication from the client terminal 10 again.

  The authentication result management unit 34 accumulates authentication results. FIG. 8 is a diagram for explaining an example of the authentication result. The authentication result includes a user ID, biometric authentication type, biometric data for verification, biometric data quality for verification, verification score, authentication result, and the like. The quality of biometric data for verification is determined using the number of feature points used in fingerprint authentication, a peak value calculated from a histogram of pixel values, and the like.

  FIG. 9 is a diagram for explaining an example of a histogram of pixel values of a fingerprint authentication image. Referring to FIG. 9, two peak values of a ridge and a valley appear in the pixel value histogram. If the distance d between the two peak values is larger than the predetermined value, the ridges and valleys of the fingerprint appear clearly. Therefore, since the biometric data for verification can be regarded as data suitable for fingerprint authentication, it has a high quality value. On the other hand, if the distance d between the two peak values is smaller than the predetermined value, the fingerprint ridges and valleys do not appear clearly. Therefore, the biometric data for verification can be regarded as data that is not suitable for fingerprint authentication.

  Note that the fingerprint data for verification and the registration template are created by digitizing fingerprint image data, and include feature point information, shape information, and the like used for verification. FIG. 10 is an example of high-quality fingerprint image data. The fingerprint image data in FIG. 10 clearly shows fingerprint ridges and valleys.

  FIG. 11A to FIG. 14B are examples of low-quality fingerprint image data. In the fingerprint image data of FIGS. 11A and 11B, the fingerprint is faint white. Such fingerprint image data tends to be easily created when the finger is dry. In the fingerprint image data of FIGS. 12A and 12B, the fingerprint is painted black. Such fingerprint image data tends to be easily created when the finger is wet. In the fingerprint image data of FIG. 13, the ridges and valleys of the fingerprint are unclear. Such fingerprint image data tends to be easily created when a finger is pressed too hard. The fingerprint image data of FIGS. 14A and 14B is an example in which there is a problem when reading a fingerprint. FIG. 14A shows an example in which fingers are placed too far in front. FIG. 14B shows an example in which the finger is displaced to the right side of the fingerprint sensor. Such fingerprint image data lacks feature point information and shape information necessary for fingerprint authentication. When the quality of the fingerprint data for verification is low, the extraction accuracy (reproducibility of extraction) of the minutia (fingerprint branch points and end points) is deteriorated, and the degree of matching with the registered template tends to be low at the time of verification. FIG. 15 shows an example of collation score variation data. FIG. 16 shows an example of fluctuation data of collation fingerprint data quality.

  Fingerprint image data with high quality is suitable for fingerprint authentication and is likely to succeed in fingerprint authentication. On the other hand, fingerprint image data with low quality tends to fail in fingerprint authentication. When an authorized user continuously fails in authentication, biometric data quality for verification is low and the verification score tends to be low. On the other hand, when authentication failure continues due to unauthorized access, an unauthorized access person picks up biometric data for verification from a set of biometric data for verification prepared in advance, or processes the biometric data for verification to the authentication server 30. Send it. In this case, there is a tendency that biometric data quality for collation varies and a collation score varies, and a collation score tends to vary although the biometric data quality for collation is constant. Therefore, in this embodiment, when the authentication fails continuously, the unauthorized access is determined by paying attention to the combination of the biometric data quality for verification and the fluctuation of the verification score, which are seen in such unauthorized access. FIG. 17 shows a specific unauthorized access determination policy. When the variance value of the collation score and the variance value of the fingerprint data quality for collation are larger than a predetermined value, it can be determined that the variation is present.

  FIG. 18 is a flowchart showing the flow of unauthorized access determination processing. Referring to FIG. 18, the trend extraction unit 35 of the authentication server 30 extracts the variation data of the matching score for a predetermined period from the authentication result (step S1). As an example, the variance value of the collation score is extracted as the variation data of the collation score when the authentication fails five or more times continuously for 3 minutes for each user ID. Next, the trend extraction unit 35 extracts variation data of the fingerprint data quality for verification for a predetermined period from the authentication result (step S2). As an example, as a variation data of the fingerprint data quality for collation, a variance value of the fingerprint data quality for collation when the authentication fails five times or more continuously for 3 minutes for each user ID is extracted. FIG. 19 shows the result.

  Next, the tendency extraction unit 35 performs unauthorized access determination for each user ID using the predefined unauthorized access determination policy shown in FIG. 20 (step S3). In the example of the unauthorized access determination policy of FIG. 20, when the variance value of the collation score is not less than a predetermined value (for example, 10 or more) or the variance value of the fingerprint data quality for collation is not less than a predetermined value (for example, 10 or more). Next, the trend extraction unit 35 determines whether or not unauthorized access (attack) has been detected (step S4). If it is determined as “Yes” in step S4, the access control unit 33 invalidates the user's fingerprint authentication and notifies the system administrator to that effect. In the example of FIG. 19, since the collation score variance value of the user ID User0001 is 10 based on the authentication result, the access control unit 33 determines that the authentication request for User0001 is an attack and notifies the system administrator to that effect. Thereafter, the execution of the flowchart ends. Further, even when it is determined “No” in step S4, the execution of the flowchart is ended.

  As described above, the verification score and the quality of the biometric data for verification vary between when a legitimate user continuously fails in fingerprint authentication and when unauthorized authentication is attempted and fingerprint authentication fails continuously. Is different. In this embodiment, unauthorized access is determined using this characteristic. Therefore, it is possible to determine whether a user who has continuously failed in authentication is a legitimate user or an unauthorized accessor. In addition, measures such as invalidation of fingerprint authentication and a higher collation threshold value can be taken only for a user ID for which unauthorized access is attempted without impairing the convenience of a legitimate user.

(Other examples)
Subsequently, another process of the unauthorized access determination method will be described. The flow of processing is the same as the flow of unauthorized access determination processing shown in FIG. However, in this example, the processing when performing the unauthorized access determination processing in step 3 of FIG. In this example, the trend extraction unit 35 calculates the risk evaluation value by multiplying the variance value of the matching score and the variance value of the fingerprint data quality for verification as shown in FIG. 21 by the weight shown in FIG. Furthermore, the tendency extraction unit 35 determines unauthorized access using the unauthorized access determination policy of FIG.

  The setting of the weight can be arbitrarily set. For example, the weight may be set to a high value when authentication failures of a specific user are concentrated in a short period of time. In the example of FIG. 22, a user who uses fingerprint authentication for the first time is set to 1 when the first authentication failure takes into account that the fingerprint input operation is unfamiliar. Further, the weight is set to 2 when the authentication fails for the second time, n is set to the weight when the authentication fails for the nth time, and the weight is increased as the number of times increases. The weight setting may be defined in advance by the system, or may be dynamically changed from the authentication result.

  In the example of FIG. 23, when the risk evaluation value is a predetermined value or more (for example, 100 or more), it is determined that the authentication has failed continuously due to the attack, and the risk evaluation value is less than the predetermined value (for example, less than 100). In addition, it is determined that the authorized user has continuously failed in authentication. In the example of FIG. 21, since the risk evaluation value of User0001 is 100, User0001 is determined to be an attack.

  According to this example, it is possible to determine the unauthorized access by performing the risk evaluation using the weight for the collation score variance value and the collation fingerprint data quality variance value. As a result, the accuracy of detecting the authentication failure of a legitimate user and the authentication failure due to unauthorized access, such as the detection accuracy of a legitimate user who has continuously failed in authentication due to unfamiliar fingerprint input operation, is improved. be able to.

(Other examples)
Next, still another process of the unauthorized access determination method will be described. The flow of processing is the same as the flow of unauthorized access determination processing shown in FIG. However, in this example, the processing when performing the unauthorized access determination processing in step 3 is different. In this example, the trend extraction unit 35 extracts variation data of the position of the feature point in a predetermined period as shown in FIG. 24 from the fingerprint data for verification included in the authentication result. In FIG. 24, as the variation data of the position of the feature point, the position of the feature point when the authentication fails five times or more continuously for 3 minutes for each user ID is extracted. In the example of FIG. 24, the position data of the feature point of User0001 is extracted.

  Referring to FIG. 24, the positions of the feature points other than the feature point 00000002 are the same, but the feature point 00000002 changes every time. The fingerprint data for verification is described in a binary format because it is encrypted and stored in the authentication result. Therefore, in order for the trend extraction unit 35 to check the content of the fingerprint data for verification, it is necessary to decrypt the encrypted data. FIG. 25 shows an example of the combined fingerprint data for verification.

  Next, the trend extraction unit 35 determines unauthorized access using the unauthorized access determination policy shown in FIG. Here, in the fingerprint authentication, the position of the feature point may be blurred when the fingerprint input operation is shaken. Therefore, even when there is a slight shift in the (x, y) coordinate value (for example, when the x coordinate value is shifted by 1), the same position may be determined. In the example of FIG. 26, the variance value of the collation score is a predetermined value or more (for example, 10 or more) or the variance value of the fingerprint data quality for collation is a predetermined value or more (for example, 10 or more), and a predetermined ratio or more (for example, 90% or more). If there is a feature point having the same position and a different position each time, it is determined that the attack is an attack. In User 0001, as described in the first embodiment, the matching score variation and the matching fingerprint data quality variation correspond to this condition, and the feature point position variation condition also corresponds to the data of FIG. The attack is determined.

  If unauthorized access is determined based on the variation of the position of the feature point, it is possible to cope with the case where the position of the feature point included in the fingerprint data for verification is illegally modified and repeatedly attacked by the hill climb attack. Further, since the variance of the collation score and the fluctuation of the fingerprint data for collation are used in the attack determination, it is possible to determine whether the user who has continuously failed in authentication is a legitimate user or an unauthorized access person. Further, it is possible to take measures such as invalidating fingerprint authentication only for a user ID for which unauthorized access is attempted without impairing the convenience of a legitimate user.

(Other examples)
Next, still another process of the unauthorized access determination method will be described. The flow of processing is the same as the flow of unauthorized access determination processing shown in FIG. However, in this example, the processing when performing the unauthorized access determination processing in step 3 is different. In this example, the tendency extraction unit 35 extracts the variation data of the angle of the feature point during a predetermined period as shown in FIG. 27 from the fingerprint data for verification included in the authentication result. In the example of FIG. 27, as the variation data of the angle of the feature point, the angle of the feature point when the authentication fails five times or more continuously for 3 minutes for each user ID is extracted. In the example of FIG. 27, the angle data of the feature point of User0001 is extracted.

  Referring to FIG. 27, the angles of the feature points other than the feature point 00000002 are the same, but the feature point angle of the feature point 00000002 changes every time. The fingerprint data for verification is described in a binary format because it is encrypted and stored in the authentication result. Therefore, in order for the trend extraction unit 35 to check the content of the fingerprint data for verification, it is necessary to decrypt the encrypted data.

  FIG. 28A and FIG. 28B are diagrams for explaining the angles of feature points. Referring to FIG. 28A, the fingerprint ridge has a branching partway along the way. In addition, referring to FIG. 28 (b), the fingerprint ridge has a portion interrupted in the middle. The end points and branch points of the ridges are called fingerprint feature points. These feature points have various distributions depending on the individual. When comparing two fingerprints, there is a method for comparing the positions, shapes, and directions of these feature points to determine whether they are the same fingerprint. The angle of the feature point is a numerical expression of the direction of the feature point with reference to the position of the feature point, as indicated by the arrows in FIGS. 28 (a) and 28 (b).

  Next, the tendency extraction unit 35 determines unauthorized access using the unauthorized access determination policy shown in FIG. Here, in the fingerprint authentication, when the fingerprint input operation is shaken, the angle of the feature point may be shaken. Therefore, even when there is a subtle shift in angle (for example, a shift of 5 degrees), the same angle may be determined. In the example of FIG. 29, the variance value of the collation score is a predetermined value or more (for example, 10 or more) or the variance value of the fingerprint data quality for collation is a predetermined value or more (for example, 10 or more), and a predetermined ratio or more (for example, 90% or more). If there is a feature point having the same angle and a different angle each time, it is determined as an attack. As described in the first embodiment, User0001 corresponds to the fluctuation of the matching score and the fluctuation of the fingerprint data quality for the matching, and the fluctuation condition of the angle of the feature point also corresponds to the data of FIG. It is determined as an attack.

  If unauthorized access is determined based on the change in the angle of the feature point, it is possible to cope with the case where the angle of the feature point included in the fingerprint data for verification is illegally modified and repeatedly attacked by the hill climb attack. Further, since the variance of the collation score and the fluctuation of the fingerprint data for collation are used in the attack determination, it is possible to determine whether the user who has continuously failed in authentication is an authorized user or an unauthorized access. Further, it is possible to take measures such as invalidating fingerprint authentication only for a user ID for which unauthorized access is attempted without impairing the convenience of a legitimate user.

(Other examples)
Next, still another process of the unauthorized access determination method will be described. The flow of processing is the same as the flow of unauthorized access determination processing shown in FIG. However, in this example, the processing when performing the unauthorized access determination processing in step 3 is different. In this example, the trend extraction unit 35 extracts variation data of the number of feature points in a predetermined period as shown in FIG. 30 from the fingerprint data for verification included in the authentication result. In FIG. 30, as the variation data of the number of feature points, the number of feature points in the case where authentication fails five times or more continuously for 3 minutes for each user ID is extracted.

  Referring to FIG. 30, the number of feature points other than User0001 is the same, but the number of feature points of feature point User0001 varies every time. The fingerprint data for verification is described in a binary format because it is encrypted and stored in the authentication result. Therefore, in order for the trend extraction unit 35 to check the content of the fingerprint data for verification, it is necessary to decrypt the encrypted data.

  Next, the trend extraction unit 35 determines unauthorized access using the unauthorized access determination policy shown in FIG. Here, in fingerprint authentication, when the pressure at the time of fingerprint input is strong, the feature point may not be detected. Therefore, even when there is a slight deviation in the number of feature points (for example, when one feature point is reduced), if there is no large variation in the number of feature points, it may be determined that the number of feature points is the same. In the example of FIG. 31, the collation score variance value is a predetermined value or more (for example, 10 or more), or the collation fingerprint data quality variance value is a predetermined value or more (for example, 10 or more), and a predetermined ratio or more (for example, 90% or more). If there is a feature point that has the same number of feature points and a different number of times, the attack point is determined. As User0001, as shown in the first embodiment, the fluctuation of the matching score and the fluctuation of the fingerprint data quality for matching correspond to this condition, and the fluctuation condition of the number of feature points also corresponds to the data of FIG. It is determined as an attack.

  If unauthorized access is determined based on fluctuations in the number of feature points, it is possible to cope with cases in which the number of feature points included in the fingerprint data for verification is illegally modified and repeatedly attacked by a hill climb attack. Further, since the variance of the collation score and the fluctuation of the fingerprint data for collation are used in the attack determination, it is possible to determine whether the user who has continuously failed in authentication is an authorized user or an unauthorized access. Further, it is possible to take measures such as invalidating fingerprint authentication only for a user ID for which unauthorized access is attempted without impairing the convenience of a legitimate user.

(Other examples)
Next, still another process of the unauthorized access determination method will be described. The flow of processing is the same as the flow of unauthorized access determination processing shown in FIG. However, in this example, the processing when performing the unauthorized access determination processing in step 3 is different. In this example, the trend extracting unit 35 extracts collation fingerprint data for a predetermined period as shown in FIG. 32 from the collation fingerprint data included in the authentication result. In FIG. 32, for each user ID, fingerprint data for verification of a user ID that has failed to authenticate five times or more continuously for 3 minutes is extracted. In the example of FIG. 32, the first to fifth verification fingerprint data of the encrypted User0001 are all different. The first to fifth matching fingerprint data of User0011 are all the same.

  Next, the trend extraction unit 35 determines unauthorized access using the unauthorized access determination policy shown in FIG. In the example of FIG. 33, the collation score variance value is a predetermined value or more (for example, 10 or more) or the collation fingerprint data quality variance value is a predetermined value or more (for example, 10 or more), and the fingerprint for collation is continuously five times or more. If the data is different, it is determined as an attack.

  If unauthorized access is determined based on the combination of the fingerprint data for verification, it is possible to cope with the case where the fingerprint data for verification is illegally changed / set by the hill climb attack and repeatedly attacked. In addition, since the change in the verification score and the change in the quality of the fingerprint data for verification are used in the attack determination, it is possible to determine whether the user who has continuously failed in authentication is a legitimate user or an unauthorized accessor. Further, it is possible to take measures such as invalidating fingerprint authentication only for a user ID for which unauthorized access is attempted without impairing the convenience of a legitimate user.

  In fingerprint authentication, since up to 10 fingers can be registered, different fingerprint data for collation is not input continuously 11 times or more. Normally, 2 to 3 fingers out of 10 fingers are used for fingerprint authentication, so the condition setting example of the above five times is described. The thumb, the little finger, and the finger that is not the dominant hand are not often used because the input operation of the fingerprint is difficult.

  FIG. 34 is a block diagram of a biometric authentication system 100a including an unauthorized access detection device according to the second embodiment. Referring to FIG. 34, biometric authentication system 100a includes authentication server 30a instead of authentication server 30. The authentication server 30 a is different from the authentication server 30 in that a code generation unit 36 and a code check unit 37 are further provided. When the CPU 201 in FIG. 6 executes a program stored in the HDD 203 or the like, the code generation unit 36 and the code check unit 37 are realized in the authentication server 30a. In the present embodiment, the ID input unit 11, the image processing unit 12, the feature extraction unit 13, and the quality extraction unit 14 can communicate with the code generation unit 36 and the code check unit 37 via the communication unit 15. .

  The ID input unit 11 acquires a user ID input by the user. When the fingerprint data is input, the sensor 40a accesses the authentication server 30a via the communication unit 41, acquires the code from the code generation unit 36, and describes the code in the fingerprint image data. The image processing unit 12 receives the fingerprint image data to which the code is attached from the sensor 40a, and sends the code and the user ID included in the fingerprint image data to the authentication server 30a via the communication unit 15.

  FIG. 35 is a diagram for explaining information included in an image acquired from the sensor 40a. The image acquired from the sensor 40a includes header information, fingerprint image data size, fingerprint image data start position, fingerprint image data, and the like. When the sensor 40a acquires the code via the communication unit 41, the sensor 40a describes the code in the header information. The code generated by the code generation unit 36 is automatically generated using a user ID, time information, and the like as a seed value, and is different each time. The codes included in the header information include a fingerprint image data code acquired from the sensor 40a and a fingerprint image data code corrected by the image processing unit 12. The former is set in the fingerprint image data received by the image processing unit 12, and the latter is set in the fingerprint image data received by the feature extraction unit 13.

  FIG. 36A and FIG. 36B are diagrams for explaining a code description example. FIG. 36A shows an example in which a code is assigned to the fingerprint image data of User0001 acquired from the sensor 40a. FIG. 36B shows an example in which the fingerprint image data is illegally changed.

  The code check unit 37 checks the user ID and code transmitted from the client terminal 10 against the code management table stored when the code is generated by the code generation unit 36, and checks whether the codes match. FIG. 37 shows an example of the code management table. If the codes match, the image processing unit 12 performs image correction such as noise removal of the fingerprint image data. Also, the image processing unit 12 receives a code to be added to the fingerprint image data corrected by the image processing unit 12 from the code generation unit 36 via the communication unit 15 and describes the code in the fingerprint image data.

  On the other hand, if the codes do not match, the code check unit 37 returns an error to the client terminal 10 and interrupts the authentication process. Next, when the codes match, the feature extraction unit 13 extracts the fingerprint image data code corrected by the image processing unit 12 from the fingerprint image data, and the code included in the fingerprint image data via the communication unit 15 The user ID is sent to the authentication server 30a.

  Similarly, the code check unit 37 checks whether the user ID and the code transmitted from the client terminal 10 match with the information stored when the code is generated by the code generation unit 36. When the codes match, the feature extraction unit 13 generates collation fingerprint data, receives the code to be given to the collation fingerprint data from the code generation unit 36 via the communication unit 15, and describes it in the collation fingerprint data To do. FIG. 38 shows an example of code description in the fingerprint data for verification. In the example of FIG. 38, the code generated by the code generation unit 36 is described in the header information.

  On the other hand, if the codes do not match, the code check unit 37 returns an error to the client terminal 10 and interrupts the authentication process. Next, if the codes of the fingerprint data for verification match, the quality extraction unit 14 extracts the code for fingerprint data for verification from the fingerprint data for verification, and the code included in the fingerprint data for verification via the communication unit 15. And the user ID are transmitted to the authentication server 30a. Similarly, the code check unit 37 matches the user ID and code transmitted from the client terminal 10 with the code management table (FIG. 37) stored when the code is generated by the code generation unit 36. Check if it is. When the codes match, the client terminal 10 issues an authentication request to the authentication server 30a via the communication unit 15. The subsequent processing of the authentication server 30a is the same as that of the first embodiment. On the other hand, if the codes do not match, the code check unit 37 returns an error to the client terminal 10 and interrupts the authentication process.

  FIG. 39 is a diagram for describing the details of the sensor 40a. Referring to FIG. 39, sensor 40 a includes a communication unit 41 and a sensor unit 42. The communication unit 41 includes a code assignment control module 43 and a wireless module 44. When a fingerprint is input from the sensor unit 42, the code addition control module 43 acquires the code from the authentication server 30a via the wireless LAN and adds the code to the fingerprint image data.

  Hereinafter, specific examples will be described. Assume that the ID input unit 11 acquires a user ID (User0001) input by the user. In this case, when fingerprint data is input, the sensor 40a accesses the authentication server 30a via the wireless module 44, acquires the code from the code generation unit 36, and codes the fingerprint image data input from the sensor 40a. Is described.

  In the example of FIG. 36A, a code of 0000000000000000013 is described. Next, the image processing unit 12 receives the fingerprint image data input from the sensor 40a, and extracts a code portion. In the example of FIG. 36B, since the fingerprint image data is illegally changed, the code 0000000000000100000 is extracted from the fingerprint image data. Next, the image processing unit 12 sends the code 0000000000000100000 extracted from the fingerprint image data together with the user ID (User0001) to the authentication server 30a via the communication unit 15.

  The code check unit 37 refers to the code management table (FIG. 37) stored when the code is generated by the code generation unit 36. The code check unit 37 extracts 0000000000000000013, which is the code of the fingerprint image data acquired from the sensor 40a, and compares it with the code 0000000000000100000 sent from the client terminal 10. The code checking unit 37 determines that the validity of the fingerprint image data acquired from the sensor 40a has not been confirmed because the two codes do not match. In this case, the code check unit 37 returns an error to the client terminal 10 and interrupts the process.

  As described above, whether the fingerprint image data transferred to the image processing unit 12 is fingerprint image data acquired from the sensor 40a or fingerprint image data transferred from a fingerprint image data set prepared in advance by an unauthorized accessor. Discrimination becomes possible. In the example of FIG. 1 and FIG. 2, it is possible to protect against attacks by Type 1.

(Other examples)
Another example of unauthorized access determination processing will be described. First, the ID input unit 11 acquires the user ID (User0001) input by the user. The image processing unit 12 checks the validity of the fingerprint image data acquired from the sensor 40a, and performs image correction such as noise removal on the fingerprint image data when the validity is confirmed.

  Next, the image processing unit 12 accesses the authentication server 30a via the communication unit 15, acquires the code of User0001 from the code generation unit 36, and describes the code in the corrected fingerprint image data. In the example of FIG. 40A, a code of 0000000000000100110 is assigned to the fingerprint image data corrected by the image processing unit 12. Next, the feature extraction unit 13 receives the corrected fingerprint image data from the image processing unit 12 and extracts a code. In the example of FIG. 40B, since the fingerprint image data is illegally changed, the code 0000000000000100001 is extracted from the corrected fingerprint image data.

  Next, the feature extraction unit transmits the code 0000000000000100001 extracted from the fingerprint image data together with the user ID (User0001) to the authentication server 30a via the communication unit 15. The code check unit 37 refers to the code management table (FIG. 37) stored when the code is generated by the code generation unit 36. The code check unit 37 extracts the code 0000000000000100110 of the fingerprint image data corrected by the image processing unit 12 and compares it with the code 0000000000000100001 transmitted from the client terminal 10. The code checking unit determines that the validity of the fingerprint image data corrected by the image processing unit 12 has not been confirmed because the two codes do not match. In this case, the code check unit 37 returns an error to the client terminal 10 and interrupts the process.

  FIG. 41 is a diagram for explaining the details of the sensor 40a used in this example. Referring to FIG. 41, sensor 40a may include a communication unit 45 and an image processing unit 46. The communication unit 45 may include a code assignment control unit 47 and a communication control unit 48. The code addition control unit 47 acquires a code from the authentication server 30a via the communication control unit 48, and adds a code to the corrected fingerprint image data.

  As described above, whether the fingerprint image data passed to the feature extraction unit 13 is fingerprint image data acquired from the sensor 40a or fingerprint image data passed from a data set of fingerprint image data prepared in advance by an unauthorized accessor. Discrimination becomes possible. In the example of FIG. 1 and FIG. 2, it is possible to protect against attacks by Type2.

(Other examples)
Another example of unauthorized access determination processing will be described. First, the ID input unit 11 acquires the user ID (User0001) input by the user. The image processing unit 12 checks the validity of the fingerprint image data acquired from the sensor 40a, and performs image correction such as noise removal on the fingerprint image data when the validity is confirmed.

  Next, the image processing unit 12 confirms the correctness of the corrected fingerprint image data, and sends the corrected fingerprint image data to the feature extraction unit 13 when the correctness is confirmed. Next, the feature extraction unit 13 creates verification data from the corrected fingerprint image data, accesses the authentication server 30a via the communication unit 15, acquires the code of User0001 from the code generation unit 36, and performs verification. Write a code in biometric data.

  In the example of the code management table in FIG. 37, a code of 0000000002000000004 is assigned to the fingerprint image data corrected by the image processing unit 12. FIG. 42A shows an example of code assignment. Next, the quality extraction unit 14 receives the fingerprint data for verification from the feature extraction unit 13 and acquires a code. Here, it is assumed that the fingerprint image data is illegally changed as shown in FIG. In the example of FIG. 42B, since the collation fingerprint data is illegally changed, the code 0000000000000100005 is extracted from the collation fingerprint data. Next, the quality extraction unit 14 transmits the code 0000000000000100005 extracted from the fingerprint data for verification together with the user ID to the authentication server 30a via the communication unit 15.

  The code check unit 37 refers to the code management table (FIG. 37) stored when the code is generated by the code generation unit 36. The code check unit 37 extracts the code 0000000002000000004 of the fingerprint data for collation generated by the feature extraction unit 13 and compares it with the code 0000000000000100005 transmitted from the client terminal 10. The code check unit 37 determines that the validity of the collation fingerprint data generated by the feature extraction unit 13 cannot be confirmed because the two codes do not match. In this case, the code check unit 37 returns an error to the client terminal 10 and interrupts the process.

  FIG. 43 is an example of a sensor 40a used in this example. Referring to FIG. 43, sensor 40a may include a communication unit 45 and a feature extraction unit 49. Further, the communication unit 45 includes a code assignment control unit 47 and a communication control unit 48. The code assignment control unit 47 acquires a code from the authentication server 30a via the communication control unit 48, and assigns the code to the fingerprint data for verification.

  As described above, the fingerprint data for verification passed to the quality extraction unit 14 is transferred from the fingerprint data for verification generated by the feature extraction unit 13 or a data set of verification fingerprint data prepared in advance by an unauthorized accessor. It becomes possible to determine whether the fingerprint data is for verification. In the example of FIG. 1 and FIG. 2, it is possible to protect against attacks caused by Type 3.

  FIG. 44 is a block diagram of the biometric authentication system 100b including the unauthorized access detection device according to the third embodiment. Referring to FIG. 44, in biometric authentication system 100b, authentication server 30b is provided instead of authentication server 30. The authentication server 30b differs from the authentication server 30 in that a screen control unit 38 is further provided. When the CPU 201 in FIG. 6 executes a program stored in the HDD 203 or the like, the screen control unit 38 is realized in the authentication server 30b.

  The ID input unit 11 acquires a user ID input by the user. The image processing unit 12 acquires the fingerprint image data input from the sensor 40 and passes it to the image processing unit 12. Next, the image processing unit 12 performs image correction such as removing noise from the fingerprint image data, and passes the fingerprint image data to the feature extraction unit 13. The feature extraction unit 13 generates verification fingerprint data from the fingerprint image data. The quality extraction unit 14 extracts the quality of the fingerprint data for verification from the fingerprint image data by the above-described quality determination method. The communication unit 15 transmits user identification information including the IP address of the client terminal 10, the biometric authentication type, the user ID, the fingerprint data for verification, the quality of the fingerprint data for verification, and the like to the authentication server 30b together with the authentication request.

  The matcher 32 of the authentication server 30 b acquires a registration template corresponding to the user ID included in the user identification information transmitted from the client terminal 10 from the registration template storage unit 31. The matcher 32 performs matching with the fingerprint data for verification transmitted from the client terminal 10. The matcher 32 calculates a matching score obtained as a result of matching. The access control unit 33 returns authentication success (Yes) to the client terminal 10 if the matching score is equal to or greater than a predefined threshold. On the other hand, if the verification score is less than the threshold, the access control unit 33 returns an authentication failure (No) and prohibits the user from accessing the system. The authentication result management unit 34 accumulates authentication results.

  When the authentication failure is repeated continuously, the tendency extraction unit 35 extracts the fluctuation data of the matching score and the fluctuation data of the fingerprint data for matching for a predetermined period for each user ID from the authentication result. When determining that the attack is an attack, the trend extraction unit 35 returns authentication failure to the client terminal 10 a predetermined number of times, and repeatedly transmits an authentication request to the client terminal 10. In the meantime, the authentication result management unit 34 accumulates the authentication result. On the other hand, the tendency extraction unit 35 automatically learns the attack pattern and reflects the attack pattern in the unauthorized access determination policy.

  FIG. 45 is a diagram for explaining an example of a flowchart executed during automatic learning of attack patterns. Referring to FIG. 45, trend extraction unit 35 extracts verification score fluctuation data (dispersion value) for a predetermined period from the authentication result (step S11). Next, the tendency extraction unit 35 extracts quality variation data (dispersion value) of the fingerprint data for verification for a predetermined period from the authentication result (step S12). Next, the trend extraction unit 35 reflects the unauthorized access pattern in the unauthorized access determination policy from the data obtained in Step S1 and Step S2 (Step S13). Thereafter, the execution of the flowchart ends.

  FIG. 46 is a diagram for explaining an example of an attack pattern automatic learning result. In the example of FIG. 46, it is found that the variance value of the collation score is 10 and the variance value of the fingerprint data quality for collation is 9 when the fingerprint authentication request of User0001 is continuously input to the authentication server due to unauthorized access. .

  When the authentication failure reaches a predetermined number of times, the screen control unit 38 displays a false login screen and returns authentication success. Thereafter, the screen control unit 38 periodically appears to disconnect the session with the client terminal 10 and transmits an authentication request to the client terminal 10 again. Similarly, the authentication result management unit 34 accumulates logs. The trend extraction unit 35 automatically learns attack patterns. The access control unit 33 reflects the attack pattern in the unauthorized access determination policy. FIG. 47 is a diagram for explaining an example of an unauthorized access determination policy in which an unauthorized access pattern is reflected. In the example of FIG. 47, the unauthorized access determination criterion of User0001 is changed to a collation score variance value ≧ predetermined value (for example, 10) or a collation fingerprint data quality variance value ≧ predetermined value (for example, 9).

  According to this embodiment, the unauthorized access pattern is automatically reflected in the unauthorized access determination policy. As a result, even if the system developer does not have a high level of expertise regarding fingerprint authentication, it is possible to easily take countermeasures against attacks. Moreover, it is possible to extract an attack pattern continuously when the authentication server 30b determines an attack. Thereby, it is possible to automatically improve the accuracy of unauthorized access detection without the effort of the system administrator. The trend extraction unit 35 may automatically learn the attack pattern for each IP address of the client terminal 10 and for each biometric authentication type.

(Other examples)
The trend extracting unit 35 may extract variation data of the position of the feature point in a predetermined period. The trend extraction unit 35 performs unauthorized access determination for each user ID using a predefined unauthorized access determination policy. In the unauthorized access determination policy according to this example, a case where there are feature points having the same position and different positions each time at a predetermined ratio or more (for example, 90% or more) is determined as unauthorized access. In the example of FIG. 24, since the positions of feature points of a predetermined ratio or more (for example, 90% or more) are the same and the position of the feature point ID 00000002 is different every time, it is determined as unauthorized access.

  Next, the access control unit 33 returns authentication failure to the client terminal 10 a predetermined number of times (for example, up to 5 times). The authentication result management unit 34 accumulates the authentication result during the log. The trend extraction unit 35 automatically learns attack patterns. FIG. 48 shows an automatic learning result of attack patterns. In the example of FIG. 24, the X position of the feature point is incremented by 1 every time authentication fails continuously, so the pattern ID 00000001 of FIG. 48 is added.

  Thereafter, the screen control unit 38 displays a screen as if the client terminal 10 was pseudo-logged in to the system, periodically pseudo-sequentially disconnects the session, and again requests authentication from the client up to a predetermined number of times. Accept. Similarly, the trend extracting unit 35 automatically learns and updates the attack pattern of FIG. In the example of FIG. 48, pattern ID00000002 to ID00000007 are added. Thereafter, the screen control unit 38 reflects the contents of the automatically learned patterns 00000001 to 00000007 on the unauthorized access determination criterion based on the data automatically learned in FIG. 48 to the access control unit 33. FIG. 49 shows an example of an unauthorized access determination policy in which the automatically learned content is reflected.

  According to this example, the variation pattern of the position of the feature point included in the fingerprint data for verification at the time of unauthorized access reception is analyzed, and the variation pattern is automatically reflected in the unauthorized access determination policy. As a result, even if the system developer does not have a high level of expertise regarding fingerprint authentication, it is possible to easily take countermeasures against attacks. Moreover, it is possible to extract an attack pattern continuously when the authentication server 30b determines an attack. Thereby, it is possible to automatically improve the accuracy of unauthorized access detection without the effort of the system administrator.

(Other examples)
The tendency extracting unit 35 may extract variation data of the angle of the feature point during a predetermined period. The trend extraction unit 35 performs unauthorized access determination for each user ID using a predefined unauthorized access determination policy. In the unauthorized access determination policy according to this example, it is determined that unauthorized access exists when there are feature points having the same angle and different angles each time at a predetermined ratio or more (for example, 90% or more). In the example of FIG. 27, the angle of feature points equal to or greater than a predetermined ratio (for example, 90% or more) is the same, and the angle of the feature point ID 00000002 is different every time, so it is determined that the access is unauthorized.

  Next, the access control unit 33 returns authentication failure to the client a predetermined number of times (for example, up to 5 times). The authentication result management unit 34 accumulates the authentication result during the log. The trend extraction unit 35 automatically learns attack patterns. FIG. 50 shows an automatic learning result of an attack pattern. In the example of FIG. 27, the X of the feature point is increased by 10 degrees every time authentication fails continuously, so the pattern ID 00000001 of FIG. 50 is added.

  Thereafter, the screen control unit 38 causes the client terminal 10 to display a screen as if it were logged in to the system in a pseudo manner, periodically disconnects the session in a pseudo manner, and again from the client terminal 10 until a predetermined number of times. Accept authentication request. Similarly, the trend extraction unit 35 automatically learns and updates the attack pattern of FIG. In the example of FIG. 50, a pattern ID 00000002 is added. Thereafter, the screen control unit 38 reflects the contents of the automatically learned patterns I00000001 to 00000007 on the unauthorized access determination criteria based on the data automatically learned in FIG. FIG. 51 shows an example of an unauthorized access determination policy in which an automatically learned pattern is reflected.

  According to this example, the variation pattern of the angle of the feature point included in the fingerprint data for verification at the time of unauthorized access reception is analyzed, and the variation pattern is automatically reflected in the unauthorized access determination policy. As a result, even if the system developer does not have a high level of expertise regarding fingerprint authentication, it is possible to easily take countermeasures against attacks. Moreover, it is possible to extract an attack pattern continuously when the authentication server 30b determines an attack. Thereby, it is possible to automatically improve the accuracy of unauthorized access detection without the effort of the system administrator.

(Other examples)
The trend extraction unit 35 may extract variation data of the number of feature points in a predetermined period. The tendency extraction unit 35 performs unauthorized access determination for each user ID using a predefined unauthorized access determination policy. For example, a case where the number of feature points is different every time is determined as unauthorized access. In the example of FIG. 30, since the number of feature points of User0001 is different every time, it is determined as unauthorized access.

    Next, the access control unit 33 returns an authentication failure to the client terminal 10 a predetermined number of times (here, up to 5 times). The authentication result management unit 34 accumulates the authentication result during the log. The trend extraction unit 35 automatically learns attack patterns. FIG. 52 shows an example of the automatic learning result. In the example of FIG. 30, the number of feature points increases by 1 every time authentication fails continuously, so the pattern ID 00000001 of FIG. 52 is added.

  Thereafter, the screen control unit 38 causes the client terminal 10 to display a screen as if it were logged in to the system in a pseudo manner, periodically disconnects the session in a pseudo manner, and again from the client terminal 10 until a predetermined number of times. Accept authentication request. Similarly, the trend extraction unit 35 automatically learns and updates the attack pattern of FIG. In the example of FIG. 52, a pattern ID 00000002 is added. Thereafter, the screen control unit 38 reflects the contents of the automatically learned patterns I00000001 to 00000002 on the unauthorized access determination criteria based on the data automatically learned in FIG. FIG. 53 shows an example of an unauthorized access determination policy in which an automatically learned pattern is reflected.

  According to this example, the variation pattern of the number of feature points included in the fingerprint data for verification at the time of unauthorized access reception is analyzed, and the variation pattern is automatically reflected in the unauthorized access determination policy. As a result, even if the system developer does not have a high level of expertise regarding fingerprint authentication, it is possible to easily take countermeasures against attacks. Moreover, it is possible to extract an attack pattern continuously when the authentication server 30b determines an attack. Thereby, it is possible to automatically improve the accuracy of unauthorized access detection without the effort of the system administrator.

(Other examples)
The trend extraction unit 35 may extract variation data of a combination of fingerprint data for verification when authentication fails for a predetermined number of times. The trend extraction unit 35 performs unauthorized access determination for each user ID using a predefined unauthorized access determination policy. In the unauthorized access determination policy according to this example, the case where the fingerprint data for verification is different continuously for 5 times or more is determined as unauthorized access. In the example of FIG. 32, since the fingerprint data for collation of User0001 is different every time, it is determined as unauthorized access.

  The access control unit 33 returns authentication failure to the client terminal 10 a predetermined number of times (for example, up to 5 times). The authentication result management unit 34 accumulates the authentication result during the log. The trend extraction unit 35 automatically learns attack patterns. FIG. 54 shows an automatic learning result of an attack pattern. FIG. 55 shows an example in which the encrypted fingerprint data for verification included in the authentication result is decrypted and managed by the management table. In the attack pattern management table of FIG. 54, the combination of fingerprint data for verification can be efficiently managed by using the fingerprint data management table for verification of FIG. The example of FIG. 54 is an example in which different verification fingerprint data is sent from the client every time authentication fails continuously, and a combination of verification fingerprint data is added with the pattern ID 00000001 of FIG.

  Thereafter, the screen control unit 38 causes the client terminal 10 to display a screen as if it were logged in to the system in a pseudo manner, periodically disconnects the session in a pseudo manner, and again authenticates from the client terminal 10 up to a predetermined number of times. Accept the request. Similarly, the trend extracting unit 35 automatically learns and updates the attack pattern of FIG. In the example of FIG. 54, a pattern ID 00000002 is added. Thereafter, the screen control unit 38 reflects the contents of the automatically learned patterns I00000001 to 00000002 on the unauthorized access determination criterion based on the data automatically learned in FIG. FIG. 56 shows an example of an unauthorized access determination policy in which an automatically learned pattern is reflected.

  According to this example, a combination of fingerprint data for verification at the time of unauthorized access reception is analyzed, and the combination is automatically reflected in the unauthorized access determination policy. As a result, even if the system developer does not have a high level of expertise regarding fingerprint authentication, it is possible to easily take countermeasures against attacks. Moreover, it is possible to extract an attack pattern continuously when the authentication server 30b determines an attack. Thereby, it is possible to automatically improve the accuracy of unauthorized access detection without the effort of the system administrator.

  FIG. 57 is a block diagram of a biometric authentication system 100c including an unauthorized access detection device 50 according to the fourth embodiment. In the biometric authentication system 100c, an unauthorized access detection device 50 is provided as a device separate from the authentication server. The tendency extraction unit 35 is provided not in the authentication server 30 but in the unauthorized access detection device 50. According to this configuration, it is possible to reduce the load on the authentication server 30 by executing unauthorized access detection with a dedicated device.

  Although the embodiments of the present invention have been described in detail above, the present invention is not limited to such specific embodiments, and various modifications and changes can be made within the scope of the gist of the present invention described in the claims. It can be changed.

(Appendix)
(Appendix 1)
An authentication result management unit for managing an authentication result when comparing and collating biometric information received from a client terminal with biometric information registered in advance;
An unauthorized access detection device comprising: a tendency extracting unit that detects unauthorized access by extracting a variation tendency of a verification score and a variation trend of biometric data quality for verification from the authentication result.
(Appendix 2)
The unauthorized access detection device according to claim 1, wherein the tendency extraction unit performs weighting according to the number of authentication trials on the extracted change in the verification score and the change in the quality of biometric data for verification.
(Appendix 3)
The authentication result management unit holds biometric data for verification,
The trend extraction unit extracts a change in the position of the feature point included in the biometric data for verification input in the past, and changes the change in the verification score, the change in the quality of the biometric data for verification, and the position of the feature point. The unauthorized access detection device according to appendix 1, wherein unauthorized access is detected based on fluctuation.
(Appendix 4)
The authentication result management unit holds biometric data for verification,
The trend extraction unit extracts a change in angle of a feature point included in biometric data for verification input in the past, and calculates a change in the verification score, a change in quality of the biometric data for verification, and an angle of the feature point. The unauthorized access detection device according to appendix 1, wherein unauthorized access is detected based on fluctuation.
(Appendix 5)
The authentication result management unit holds biometric data for verification,
The trend extraction unit extracts a variation in the number of feature points included in biometric data for collation input in the past, and the variation in the collation score, the variation in the quality of the biometric data for collation, and the number of the feature points The unauthorized access detection device according to appendix 1, wherein unauthorized access is detected based on fluctuation.
(Appendix 6)
The authentication result management unit holds biometric data for verification,
The trend extracting unit detects unauthorized access based on a combination of a change in collation score, a fluctuation in biometric data quality for collation, and biometric data for collation set at the time of past authentication. Unauthorized access detection device.
(Appendix 7)
A code generation unit that generates an arbitrary code and adds the code to the biometric information acquired by the biometric sensor of the client terminal;
Supplementary note 1 comprising: a code check unit that verifies the validity of the biometric data by comparing the code added by the code generation unit with the code included in the biometric data acquired by the biometric sensor. The unauthorized access detection apparatus in any one of -6.
(Appendix 8)
A code generation unit that generates an arbitrary code and adds the code to the biological information obtained by the biological information processing unit correcting the biological information acquired by the biological sensor of the client terminal;
A code check unit that verifies the validity of the biometric data by comparing the code added by the code generation unit with the code included in the biometric information output from the biometric information processing unit. The unauthorized access detection device according to any one of appendices 1 to 6.
(Appendix 9)
A code generation unit that generates an arbitrary code and adds the code to biometric data for collation obtained by the feature extraction unit extracting biometric information acquired by the biometric sensor of the client terminal;
A code check unit that verifies the validity of the biometric data by comparing the code added by the code generation unit with the code included in the biometric matching data output from the feature extraction unit; The unauthorized access detection device according to any one of appendices 1 to 6.
(Appendix 10)
An access control unit that transmits authentication success information or authentication failure information to the client terminal for each biometric authentication,
When detecting an unauthorized access, the trend extracting unit transmits the authentication failure information to the client terminal up to a predetermined number of times, and automatically learns a variation in a matching score and a variation in a matching biological quality from repeatedly input biological information. The unauthorized access detection device according to any one of appendices 1 to 9, wherein:
(Appendix 11)
An access control unit for transmitting authentication success information or authentication failure information to the client terminal;
When detecting the unauthorized access, the tendency extracting unit transmits the authentication failure information to the client terminal up to a predetermined number of times, and detects a change in the position of the feature point included in the biometric data for verification from the biometric information repeatedly input. The unauthorized access detection device according to any one of appendices 1 to 9, wherein automatic learning is performed.
(Appendix 12)
An access control unit for transmitting authentication success information or authentication failure information to the client terminal;
When detecting the unauthorized access, the tendency extracting unit transmits the authentication failure information to the client terminal up to a predetermined number of times, and changes the angle of the feature point included in the biometric data for verification from the biometric information repeatedly input. The unauthorized access detection device according to any one of appendices 1 to 9, wherein automatic learning is performed.
(Appendix 13)
An access control unit for transmitting authentication success information or authentication failure information to the client terminal;
When detecting an unauthorized access, the trend extracting unit transmits the authentication failure information to the client terminal up to a predetermined number of times, and changes the number of feature points included in the biometric data for verification from the biometric information repeatedly input. The unauthorized access detection device according to any one of appendices 1 to 9, wherein automatic learning is performed.
(Appendix 14)
An access control unit for transmitting authentication success information or authentication failure information to the client terminal;
The trend extraction unit transmits the authentication failure information to the client terminal up to a predetermined number of times when unauthorized access is detected, and automatically learns a combination of biometric data for verification from biometric information that is repeatedly input. The unauthorized access detection device according to any one of appendices 1 to 9.
(Appendix 15)
When unauthorized access is detected by the trend extraction unit, the image processing apparatus further includes a screen control unit that displays a simulated screen on the client terminal.
The unauthorized access detection apparatus according to any one of appendices 10 to 14, wherein the tendency extraction unit re-requests the client terminal for biometric authentication after displaying the screen after login.
(Appendix 16)
An authentication result management step for managing an authentication result when the biometric information received from the client terminal is compared with biometric information registered in advance;
And a tendency extracting step of detecting unauthorized access by extracting a verification score and a fluctuation tendency of biometric data quality for verification from the authentication result.

DESCRIPTION OF SYMBOLS 10 Client terminal 11 ID input part 12 Image processing part 13 Feature extraction part 14 Quality extraction part 15 Communication part 30 Authentication server 31 Registration template memory | storage part 32 Matcher 33 Access control part 34 Authentication result management part 35 Trend extraction part 36 Code generation part 37 Code check unit 38 Screen control unit 100 Biometric authentication system

Claims (10)

An authentication result management unit for managing an authentication result when comparing and collating biometric information received from a client terminal with biometric information registered in advance;
An unauthorized access detection device comprising: a tendency extracting unit that detects unauthorized access by extracting a variation tendency of a verification score and a variation trend of biometric data quality for verification from the authentication result.   The unauthorized access detection apparatus according to claim 1, wherein the tendency extraction unit performs weighting according to the number of authentication trials on the extracted fluctuation of the matching score and the fluctuation of the quality of biometric data for matching. The authentication result management unit holds biometric data for verification,
The trend extraction unit extracts a change in the position of the feature point included in the biometric data for verification input in the past, and changes the change in the verification score, the change in the quality of the biometric data for verification, and the position of the feature point. The unauthorized access detection device according to claim 1, wherein unauthorized access is detected based on fluctuation. The authentication result management unit holds biometric data for verification,
The trend extraction unit extracts a change in angle of a feature point included in biometric data for verification input in the past, and calculates a change in the verification score, a change in quality of the biometric data for verification, and an angle of the feature point. The unauthorized access detection device according to claim 1, wherein unauthorized access is detected based on fluctuation. The authentication result management unit holds biometric data for verification,
The trend extraction unit extracts a variation in the number of feature points included in biometric data for collation input in the past, and the variation in the collation score, the variation in the quality of the biometric data for collation, and the number of the feature points The unauthorized access detection device according to claim 1, wherein unauthorized access is detected based on fluctuation. The authentication result management unit holds biometric data for verification,
The trend extracting unit detects unauthorized access based on a combination of a change in collation score, a fluctuation in biometric data quality for collation, and biometric data for collation set at the time of past authentication. The unauthorized access detection device described. A code generation unit that generates an arbitrary code and adds the code to the biometric information acquired by the biometric sensor of the client terminal;
The code check unit for verifying the validity of the biometric data by comparing the code added by the code generation unit and the code included in the biometric data acquired by the biometric sensor. The unauthorized access detection device according to any one of 1 to 6. A code generation unit that generates an arbitrary code and adds the code to the biological information obtained by the biological information processing unit correcting the biological information acquired by the biological sensor of the client terminal;
A code check unit that verifies the validity of the biometric data by comparing the code added by the code generation unit with the code included in the biometric information output from the biometric information processing unit. The unauthorized access detection apparatus according to any one of claims 1 to 6. A code generation unit that generates an arbitrary code and adds the code to biometric data for collation obtained by the feature extraction unit extracting biometric information acquired by the biometric sensor of the client terminal;
A code check unit that verifies the validity of the biometric data by comparing the code added by the code generation unit with the code included in the biometric matching data output from the feature extraction unit; The unauthorized access detection device according to any one of claims 1 to 6. An authentication result management step for managing an authentication result when the biometric information received from the client terminal is compared with biometric information registered in advance;
A method of extracting unauthorized access by extracting a verification score and a variation tendency of biometric data quality for verification from the authentication result, and an unauthorized access detection method comprising:

Images