JP2014134986A - Biological authentication method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a biological authentication technology to which high security is granted so as to prevent unauthorized access even in the case where biological information is illegally acquired or leaked.SOLUTION: When performing authentication while using a plurality of biological information items, authentication in a pattern indicating an order of a plurality of biological authentication operations is used together. It is determined whether an input order (input pattern) of kinds (portions) of inputted biological information is matched with a preset authentication pattern and if it is possible to be matched, collation of biological information is performed but if not matched, processing is performed as an authentication failure. Thus, when the authentication pattern is not matched, the collation of the biological information can be omitted and efficiency of biological authentication can be improved or the risk of leakage of biological information can be reduced.

Description

  The present invention relates to authentication using biometric authentication. In particular, the present invention relates to a technique using a plurality of biological information. Further, the authentication technique of the present invention can be applied to entry / exit management.

  At present, biometric authentication using vein information or the like is widely used for entrance / exit management and the like. Patent Document 1 has been proposed as a technique for maintaining a higher level of safety of biological information. In Patent Document 1, not only biometric information that can be read in daily life, or forgery / falsification of information, but also the knowledge information of the registrant, by adding angle information and authenticating both of them, It is described that it is possible to provide a biometric information authentication system and a biometric information authentication method imparted with higher security that can prevent unauthorized access.

JP 2010-79633 A

  In Patent Document 1, for example, when there is a brute force attack, if there is an authentication request using leaked biometric information (fingerprint authentication using a deceased fingerprint, face authentication using a leaked image, iris authentication, etc.) There is a concern that the authentication will be based only on the angle, and the safety will be weak. In particular, when entry / exit management is performed, there is a leakage of confidential information, and a higher level of safety is required.

  That is, it is an object of the present invention to provide a biometric authentication technology with high security capable of preventing unauthorized access even when biometric information is obtained illegally or leaked. To do.

  In order to solve the above problem, in the present invention, when authentication is performed using a plurality of pieces of biometric information, authentication using a pattern indicating the order of a plurality of pieces of biometric authentication is used in combination. Here, it is determined whether the input order (input pattern) of the type (part) of the input biometric information matches a preset authentication pattern, and if there is a possibility of matching, biometric information is collated. If they do not match, it is processed as an authentication failure.

  Here, in the present invention, when determining whether or not the input pattern and the authentication pattern match, individual (or more) parts constituting a plurality of pieces of biological information are compared, and if they match, the compared biological information is obtained each time. You may collate, or you may compare an input pattern and the whole authentication pattern, and when this result corresponds, comparison of each biometric information may be performed.

  Accordingly, when the authentication patterns do not match, the verification of biometric information can be omitted, and biometric authentication can be made more efficient and the risk of leakage of biometric information can be reduced.

  ADVANTAGE OF THE INVENTION According to this invention, the biometrics technique with higher security which can respond also to a leak etc. can be provided.

It is an example of a function structure of one Embodiment of this invention. It is an example of the flowchart which shows the basic operation | movement by 1st embodiment of this invention. It is an example of the action according to the authentication pattern registration table and authentication pattern which are arrange | positioned at an authentication pattern judgment server. It is an example of the biometric template arrange | positioned at a biometrics authentication server.

Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
FIG. 1 is an example of a block diagram when a plurality of biometric authentications and pattern authentications are configured in a network according to an embodiment of the present invention.

  The client 100 includes a user ID input function 101, a biometric information reading function 102, a communication function 103, a data bus 104, and a message display display function 105. The biometric information reading function includes a plurality of reading functions for each biometric authentication part (for example, fingerprint, finger vein, palm vein, face authentication, iris authentication, etc.).

  The authentication pattern determination server 110 includes an authentication pattern determination function 111, a storage function 112, a communication function 113, and a data bus 114.

  The biometric authentication server 120 includes a biometric authentication function 121, a storage function 122, a communication function 123, and a data bus 124. The biometric authentication function includes a plurality of authentication functions for each biometric authentication site (for example, fingerprint, finger vein, palm vein, face authentication, iris authentication, etc.).

  The communication network 130 connects the client 100, the authentication pattern determination server 110, and the biometric authentication server 120 via a network.

Below, the schematic procedure of the process of this embodiment is shown using FIG.
Step S <b> 100: The client 100 receives an input of a user ID from the user and transmits the information to the authentication pattern determination server 110. This user ID identifies a corresponding user, and may be input with a numeric keypad or the like, or may be input by reading from a medium such as an IC card.

  Step S101: The authentication pattern determination server 110 reads the authentication pattern information corresponding to the user ID based on the user ID information received from the client. That is, the authentication pattern registration information in FIG. 3 is searched using the member ID as a key. For example, when the user ID is “123456”, information of “pattern numbers 1 to 3” of the “user ID” is searched. Thereafter, a message prompting the client for biometric authentication is displayed. This message also displays the “pattern number” of the retrieved information. Then, the user is prompted to specify which pattern number to use.

  At this time, based on the information of the user ID, the biometric template information possessed by the user ID in the biometric DB is activated using the activation flag, and the biometric information used for the current authentication is specified in advance. Thus, a processing procedure for efficiently performing biometric information matching processing may be used.

Steps S102 to S105: This part is an iterative process. When the authentication pattern is composed of 1 to N biometric authentications, the biometric authentication is repeated a maximum of N times. Hereinafter, the processing contents of steps S102 to S105 will be described.
Step S102: Accept the selection of “pattern number” from the user. Then, the user instructs the N-th biometric authentication part corresponding to the pattern number selected by his / her own judgment. Then, the client 100 transmits an authentication request including information indicating the instructed biometric authentication part m. The selected pattern number is transmitted to the authentication pattern determination server 110 when the first part is read or transmitted. Further, it may be configured to transmit “Nth” in accordance with the transmission of the biometric authentication part m. In addition, one “pattern number” may be used, and display or designation for prompting designation of “pattern number” may be omitted.

  Step S103: In the authentication pattern determination server 110, if the N-th authentication part of the authentication pattern indicated by the specified pattern number matches the biometric authentication part m received in the authentication request, the pattern authentication is OK. The process proceeds to step S104. If they do not match, authentication is failed and the process proceeds to step S190.

Note that, by making a transition from S103 to S190, the verification processing in S104 can be saved.
In addition, steps S102 to S105 are not repeatedly performed for each input of biometric information, but the entire input pattern and authentication pattern are compared with each other, and if they match, the biometric information is collated collectively. Also good. In this case, a plurality of input biometric information is stored in the client 100, and when it is determined that they match, the information is collectively transmitted to the authentication server 130.

  Step S104: The biometric authentication server performs biometric authentication of the received biometric part m. This is realized by the following processing not shown in FIG. In S <b> 102, the user reads the biometric information m, which is biometric information, of the biometric authentication part m, and transmits the biometric information m to the biometric authentication server 120 via the authentication pattern determination server 110. The biometric authentication server 120 uses information and biometric information m indicating the biometric authentication part m and biometric authentication template registration information and biometric registration information (finger vein registration information and fingerprint registration information) illustrated in FIG. Run. The content can be realized by matching with biometric information registration information that the biometric authentication server 120 has. More preferably, the following control may be performed. This example is an example in which each user uses one pattern number. When a plurality of pattern numbers are used, biometric template registration information is provided for each pattern number and the authentication pattern determination server 110 is used. The pattern number received by the biometric authentication server 120 may be specified.

  First, the biometric authentication server 120 receives the user ID from the authentication pattern determination server 110 when the authentication pattern determination server 110 receives information indicating the biometric authentication information m (especially the first time, such as the first time). And the information of the received user ID is specified among biometric template registration information. When the user ID is “123456”, it is the enclosed portion of FIG. Here, the activation flag is set to “1” for each piece of biometric information for each flag being “1” (this is also the portion surrounded by FIG. 4 for the user ID “123456”).

  Then, when the biological information m is transmitted, information whose activation flag is “1” is narrowed down as a comparison target, and the read biological information is compared with the registered biological information as shown in FIG. For this reason, the activation flag may be recorded by developing the registration information in a cache or transmitting it to another comparison-dedicated device. For comparison, the biological information read every Nth time may be received and compared, or the biological information of the entire pattern may be compared together.

  As a result of the above determination, if biometric authentication is successful, the process proceeds to step S105. If the biometric authentication fails, the authentication is failed and the process proceeds to step S190.

Step S105: The authentication pattern determination server determines whether the Nth authentication of the read authentication patterns is the last of the patterns. If it is the last, the process proceeds to step S110. If it is not the last, the process proceeds to step S102 again.
Step S110: The authentication pattern determination server reads the action registration information associated with the current authentication pattern, and transitions to step S180 to instruct the client 100 to execute the action.

Step S180: The client 100 displays an authentication success message and executes an action associated with the current authentication pattern.
Step S190: The client displays an authentication failure message and ends.

  According to this embodiment, in the case of leaked biometric information (unauthorized authentication request using fingerprint authentication using residual fingerprint, face authentication using leaked image, iris authentication, etc.) A combination of knowledge information called an authentication pattern that can be known only to the person to be authenticated can be provided with a biometric authentication system and an authentication method imparted with high security.

  Further, by registering an action corresponding to the authentication pattern in advance, for example, an authentication pattern in the case of an unauthorized authentication request can be detected as being attacked.

  In addition to the authentication pattern that only the user can know, the authentication pattern must be attacked by registering an attack pattern that is frequently used statistically when making an unauthorized authentication request. There is also an effect that can be detected.

100 Client 110 Authentication Pattern Judgment Server 120 Biometric Authentication Server

Claims (5)

In a biometric authentication method using a plurality of biometric information,
In the storage device, for each person to be authenticated, an authentication pattern indicating a plurality of pieces of biological information and an input order of parts indicating the types of the pieces of biological information is stored.
Receiving input of biometric information of the person to be authenticated,
Determining whether the input pattern indicating the input order of the parts in the input of the received biometric information matches the authentication pattern;
A biometric authentication method characterized by performing biometric authentication by collating the input biometric information with the biometric information stored in the storage device when there is a possibility of coincidence. The biometric authentication method according to claim 1,
The determination of whether the input pattern and the authentication pattern match is performed by comparing one or more parts constituting the plurality of biological information,
The biometric authentication method is characterized in that the biometric information is collated each time the biometric information corresponding to the compared parts is matched when the comparison is matched. The biometric authentication method according to claim 1,
Judgment whether the input pattern and the authentication pattern match, comparing the input pattern and the entire authentication pattern by the operation to the person to be authenticated,
The biometric authentication method is characterized in that, when the comparison matches, the biometric information is collated. The biometric authentication method according to any one of claims 1 to 3,
The biometric authentication method, wherein a part of the input pattern is designated by the person to be authenticated. The biometric authentication method according to any one of claims 1 to 4,
Receiving input of identification information for identifying itself from the person to be authenticated;
Among the biological information of the storage device, the biological information corresponding to the received identification information is distinguished from other biological information,
A biometric authentication method, wherein the distinguished biometric information is checked against the input biometric information.

Images