JP4564943B2 - Biometric authentication device, terminal device and automatic transaction device - Google Patents

Description

  The present invention relates to a biometric authentication apparatus for identifying a person using biometric information, for example, a fingerprint or a vein pattern, and a method for the biometric authentication. In particular, in order to prevent biometric information acquired by the authentication device from going out of the device and being misused by a third party, the present invention relates to a biometric information acquisition process and an apparatus and method for executing the authentication process inside the authentication device. Is.

  In the withdrawal of deposits at financial institutions and electronic commerce using the Internet, biometric authentication for identity verification is extremely important to prevent impersonation of others. As a general authentication method, authentication by inputting a card having a magnetic stripe and a personal identification number, or authentication by collating a signature on the back of the card with a signature at the time of product purchase is widely performed.

  However, security problems have been pointed out in such conventional personal authentication methods. In the case of a combination of a cash card having a magnetic stripe and a password input, if the magnetic information and the password are stolen by a third party, it becomes possible to easily withdraw a deposit. Alternatively, in the case of a signature, a third party may be promoted by imitating the signature.

  As a countermeasure therefor, the introduction of an IC card instead of a card having a magnetic stripe has been proposed. The IC card is difficult to duplicate the card as compared with the magnetic stripe card, and can secure the safety that the internal information is not easily stolen. In addition, paying attention to the fact that the amount of information that can be stored inside the card can be dramatically increased, there are Patent Documents 1 and 2 as biometric authentication techniques by holding biometric information such as fingerprints and vein patterns in the IC card .

JP 61-199162 A JP 10-312459 A

  According to the above-described background art, for example, when biometric information comes out from an authenticating device, it may be stolen and misused by a malicious third party. Personal authentication based on biometric information is more secure than authentication based on a personal identification number or signature, but has a negative aspect that it cannot be easily changed once it has been leaked. Therefore, a mechanism that prevents biometric information from leaking out in a form that can be easily used by a third party is particularly important.

  In addition, it is indispensable to ensure the security of a biometric authentication program for extracting and collating biometric features as biometric information. If analysis and modification by the third party inside the program are not prevented, the effect as a biometric authentication device may be lost. In this sense, if the biometric authentication program exists in a state where it can be analyzed on a control device to which the biometric authentication device is connected, for example, a personal computer, there is an increased possibility that a third party will analyze and steal the processing procedure. Even if there is a biometric authentication program in the biometric authentication device instead of a personal computer, the information could still be stolen by a malicious third party if it exists in a state that can be easily analyzed from the outside. There is.

  It is also necessary to prevent the biometric authentication result output from the biometric authentication device from leaking to a third party. If a third party forges the signal accepted by the biometric authentication device, the authentication acceptance signal may be transmitted to the control device to which the authentication device is connected even if the authentication is rejected by the device, and an unauthorized transaction may be performed.

  The present invention has been made to solve at least a part of the above problems. The first object of the present invention is to prevent personal biometric information from leaking out of the biometric authentication device in a form that can be easily used by a third party. The second object of the present invention is to prevent a third party from stealing or modifying a biometric authentication program for extracting or collating biometric features. The third object of the present invention is to prevent external leakage of biometric authentication results output from the biometric authentication device.

  The present invention is a biometric authentication device for performing identity verification using personal biometric information, a sensor that captures biometric information, and a feature that extracts biometric feature for performing authentication from the captured sensor information Extraction means; encryption means for encrypting the extracted biometric feature quantity; and means for outputting the encrypted biometric feature quantity to the outside of the biometric authentication device as authentication reference data for identity verification. It is a biometric authentication device characterized by comprising.

  In another preferred example, a biometric authentication apparatus for performing identity verification using personal biometric information, wherein a sensor that captures biometric information and a biometric feature value for performing authentication from the captured sensor information are provided. Feature extraction means for extracting, encryption means for encrypting the extracted biometric feature, and biometric feature encrypted as authentication reference data for identity verification are connected to the biometric authentication device. And a means for directly outputting to an IC card without using a control computer.

  In another preferred example, a biometric authentication apparatus for performing identity verification using personal biometric information, wherein a sensor that captures biometric information and a biometric feature value for performing authentication from the captured sensor information are provided. Extracting feature quantity extraction means; means for inputting biometric feature quantity as authentication reference data in encrypted form from outside the biometric authentication apparatus; and decrypting encrypted biometric feature quantity as authentication reference data The biometric feature quantity output from the feature quantity extraction means, the biometric feature quantity matching means for matching the biometric feature quantity as the decoded authentication reference data, and the output of the biometric feature quantity matching means And a means for outputting the output of the encrypted biometric feature amount matching means to the outside of the apparatus.

  In another preferred example, a biometric authentication apparatus for performing identity verification using personal biometric information, wherein a sensor that captures biometric information and a biometric feature value for performing authentication from the captured sensor information are provided. Extracting feature quantity extracting means and means for directly inputting an encrypted biometric feature quantity as authentication reference data stored in the IC card from the IC card without using a control computer connected to the biometric authentication apparatus A decryption unit that decrypts the encrypted biometric feature amount serving as the authentication reference data, a biometric feature amount output from the feature amount extraction unit, and a biometric feature amount that serves as the decrypted authentication reference data Biometric feature amount matching means for verifying, encryption means for encrypting the output of the biometric feature amount matching means, and means for outputting the output of the encrypted biometric feature amount matching means to the outside of the apparatus A biometric authentication apparatus characterized by comprising. In another preferred example, the feature amount extraction unit and the biometric feature amount collation unit are stored in the device in an encrypted form before starting the biometric authentication device, and decrypted after the device is started. This is a biometric authentication device.

  In another preferred example, before the biometric authentication device is activated, the feature value extraction unit and the biometric feature value verification unit are separately stored in a control computer and a biometric authentication device connected to the biometric authentication device. The biometric authentication apparatus is characterized in that after the biometric authentication apparatus is activated, it is combined and decoded to become operable.

  According to the present invention, it is possible to prevent a malicious third party from stealing biometric information or biometric features. In addition, analysis, falsification, acquisition, and the like of a program that performs biometric feature amount extraction processing and biometric feature amount verification processing related to biometric authentication can be prevented. Further, even if the device is disassembled and analyzed, tampering can be prevented.

  Hereinafter, embodiments of the present invention will be described with reference to FIGS.

  In the present embodiment, a biometric information registration process at an office counter terminal and a biometric information authentication process at an ATM (automated teller machine) in a financial sales store via an IC card will be described. Here, the biometric information is assumed to be a biometric feature that is effective for specifying an individual.

  In the biometric feature registration process at the sales office counter terminal, an encrypted biometric feature for personal authentication is registered in the IC card at the counter terminal. A biometric authentication device with an IC card device is connected to the window terminal, and a biometric feature for registration is encrypted and transferred directly from the biometric authentication apparatus to the IC card without going through the window terminal. On the other hand, in an ATM (automated teller machine), an encrypted biometric feature value is read from an IC card, transferred to a biometric authentication device connected to the ATM, and an authentication process is performed inside the device. Note that any medium may be used as long as it is a portable electronic medium such as an RFID tag as well as an IC card.

  FIG. 1 shows a configuration example of the entire system. A financial sales office 101 is connected to a data center 103 in which an accounting host computer 109 is installed via a wide area network 102. In the financial sales office 101, a sales office window terminal 105 and an ATM 107 are connected by a LAN 108 in the sales office. A biometric authentication device 104 with an IC card device is connected to the sales office window terminal 105. Similarly, the biometric authentication device 106 is connected to the ATM 107, and the IC card device is incorporated in the ATM.

  First, biometric feature amount registration processing in the sales office window terminal 105 will be described with reference to FIGS. 2, 3, and 4. FIG. 2 is a diagram illustrating a configuration example of the biometric authentication device 104 with the IC card device. A CPU 201 is a processor responsible for data processing of the apparatus, and controls various programs and data described later. The peripheral device I / O device 202 is an interface for connecting the biometric authentication device 104 and the sales office window terminal 105. Reference numeral 203 denotes an illumination LED for acquiring a biological image. For example, in the case of finger vein authentication, a near infrared LED suitable for acquiring a finger vein pattern is used. The image sensor 204 is a sensor for acquiring a biological image, and includes a device such as a CCD, and acquires a finger vein pattern irradiated by the LED 203. The IC card device 205 is a device for writing the encrypted biometric feature for registration into the IC card.

  The main storage device 207 is composed of a volatile memory (DRAM or the like), and the stored data disappears when the authentication device is powered off. Here, various programs and data areas for operating the apparatus are secured. A program and data stored in the main storage device 207 are a storage unit and a storage unit that read and store data from a flash memory 217 described later. The entire apparatus control program 208 is a program for controlling the entire authentication apparatus 104 including the control of the IC card apparatus 205. The peripheral device I / O control program 209 controls the peripheral device I / O device 202. The encryption / decryption program 210 performs two processes. One is to decrypt the encrypted authentication program 219 stored in the flash memory (hereinafter referred to as a non-volatile memory) 217 and store it in the area 211 as an authentication program. The other is to encrypt the biometric feature for registration generated by the authentication program 211 before writing it to the IC card. The IC card device control program 212 is a program for controlling the IC card device 205.

  Thus, the program has various functions, performs various processes, and is controlled by the hardware configuration of the CPU 201 as described above. In the present invention, the description will focus on programs, but various functions of these programs, such as control means, encryption means, authentication means, registration means, verification means, etc., needless to say, each means can be expressed as each part. Yes.

  The image buffer 213 is an area for storing biological image data (raw data) acquired by the image sensor 204. The biometric feature amount 214 is an area for storing a biometric feature amount generated by extracting only a vein pattern, for example, from the biometric image data stored in the image buffer 213 by the authentication program 211. The encrypted biometric feature quantity 215 is an area for storing data obtained by encrypting the data of the biometric feature quantity 214 by the encryption / decryption program 210. The data 215 (encrypted biometric feature) is stored as a biometric registration feature on the IC card via the IC card device 205. Even when the sales office window terminal 105 is connected and interposed between the IC card device 205 and the authentication apparatus, the biometric feature amount in the encrypted state acquired by the authentication apparatus is not stored in the window terminal 105 (not left). To the IC card by the IC card device 205. The encryption key 216 is key data required when the encryption / decryption program 210 encrypts or decrypts data. One of the characteristics of this key data is that the key data is acquired from the branch office counter terminal 105 or the ATM 107 to which the biometric authentication device is connected via the peripheral I / O device. A bus 206 connects the processor and each device in the authentication apparatus. Reference numeral 217 denotes a non-volatile memory whose contents are not erased even when the authentication apparatus is turned off, and an encrypted authentication program 218 is stored therein. When the authentication apparatus is activated, the encryption / decryption program 210 decrypts the encrypted authentication program 218 using the encryption key 216 and stores it in the area 211.

  FIG. 3 is a diagram illustrating a configuration example of the sales office window terminal 105. The window terminal 105 is a computer that is installed at a counter of a financial institution, and is a terminal device that performs processing operations such as deposit, withdrawal, exchange, etc., and also performs biometric authentication registration processing. The CPU 301 is a processor responsible for data processing of the terminal and various controls. The LAN device 302 is a device for connecting the LAN 108 in the sales office to the terminal, and is connected to the accounting host computer 109 via the LAN 108. The peripheral device I / O device 303 is an interface for connecting the biometric authentication device 104 with the IC card device. The display device 304 is an operator who operates the window terminal to display biometric feature registration results (success or failure status, not including biometric features), customer transaction information, items necessary for the transaction, and the like. The key input device 305 is an operator key input device. The cash processing device 306 is a device for performing cash processing at the terminal. The main storage device 308 stores various programs and data. Reference numeral 309 denotes an overall control program for controlling the entire window terminal, and 310 stores a business application program related to work performed at the window. The peripheral device I / O control program 311 controls the peripheral device I / O device 303. The biometric authentication device control program 312 is a program for controlling the biometric authentication device 104 with IC card device connected via the peripheral device I / O device 303. The encryption key 313 is used to activate the biometric authentication device 104 with the IC card device and encrypt the biometric feature amount registered in the IC card. A bus 307 connects each device in the terminal.

  The operations of the biometric authentication device 104 with the IC card device and the sales office window terminal 105 will be described with reference to FIG. Steps 401, 406, 407, and 408 are contents processed by the biometric authentication device 104 with the IC card device based on an instruction output from the sales office window terminal 105.

  When the biometric registration item to be displayed on the display device 304 of the window terminal 105 is selected by the input device 305, the overall control program 309 expands functions related to biometric authentication to the biometric authentication device 104. In step 401, the biometric authentication device control program 312 stored in the sales office window terminal 105 transmits the activation signal for the biometric feature registration processing and the encryption key 313 to the biometric authentication device 104 with IC card device. The biometric authentication device 104 is activated mainly by the CPU 201 by the received activation signal, and the entire device control program 208 stores the received encryption key 313 in the area 216. Thereafter, the overall apparatus control program 208 activates the encryption / decryption program 210, decrypts the encryption authentication program 218 in the nonvolatile memory 217 using the encryption key 216, stores it in 211, and activates the program. Therefore, it has the following tamper resistance.

  As described above, the authentication program 218 is stored in an encrypted state in the nonvolatile memory 217, and is expanded in 211 in the main storage device 207 at the time of activation. When the biometric authentication device is turned on and is operating normally, communication with the outside of the device is encrypted using the encryption key 216, and therefore, if the terminal is not a properly connected terminal, the inside of the biometric authentication device Can not refer to. Therefore, even if the authentication program 211 is stored in the main storage device 207 in an analyzable state, it is protected from unauthorized access from the outside. On the other hand, when the biometric authentication apparatus is not turned on, the encrypted authentication program 218 is stored only in the nonvolatile memory 217. In this way, by encrypting the program, there is an effect that it becomes difficult for a third party to disassemble the device and analyze the non-volatile memory 217 and forge or tamper with it.

  In the above-described example, the method 1 for storing and storing the encrypted authentication program in the nonvolatile memory 217 and the authentication program decrypted and expanded in the volatile memory 207 has been described. In addition, a method 2 for storing the encryption authentication program in the volatile memory 217 and a method 3 for developing the encryption authentication program 218 in the nonvolatile memory 217 and storing the authentication program can be considered. However, method 2 is not realistic because the encrypted authentication program is erased when the authentication apparatus is powered off. In the method 3, if the authentication apparatus is turned off before the authentication apparatus erases the decrypted authentication program in the nonvolatile memory 217, the authentication program that has been decrypted remains in the nonvolatile memory 217 as it is. . Therefore, it is not appropriate in terms of security.

  As described above, the method 1 is more realistic than the other methods 2 and 3 and is highly safe. In this embodiment, the encrypted authentication program in the nonvolatile memory 217 is decrypted in the main storage device 207 when the authentication device is activated, and the authentication program decrypted in the main storage device 207 until the authentication device is turned off thereafter. Continue to exist. As a more desirable example, there is an example in which each time a biometric feature is extracted / authenticated, the encrypted program is decrypted and expanded in the main storage device, and the authentication program on the main storage device is deleted when the processing is completed. . In this case, the time that the authentication program exists in the apparatus in an analyzable (executable) state becomes shorter, so that it can be expected that the safety can be further improved.

  Subsequently, when the authentication program 211 is correctly decrypted and activated in the main storage device 207, the sales office counter terminal 105 and the biometric authentication device 104 with IC card device establish mutual device authentication through the encryption key. Even if a third party steals the biometric authentication device and connects it to an unauthorized control computer, the authentication program is not activated, so that the authentication device cannot be operated. Since the authentication program is encrypted in the nonvolatile memory 217 as described above, it is extremely difficult to know the contents of the authentication program even if a third party disassembles and analyzes the authentication device. As described above, the activation has been described. At the end of the authentication device 104 based on the shutdown of the window terminal 105, the power failure, etc., the decrypted authentication program stored in the 211 is cleared (or inactivated). Can be difficult to analyze.

  The authentication program 211 controls the illumination LED 203 and the image sensor 204 to acquire the feature amount of the biological image and stores it in the image buffer 213 (402). Thereafter, the authentication program 211 reads the biometric image stored in the image buffer 213, extracts biometric feature quantities for registering in the IC card from the image, and characteristic data for selecting the registered feature quantities, and outputs the results to the biometric image. It is stored in the feature quantity 214 (403). The selection of the registered feature value means selection from data repeatedly registered in step 406 described later. Here, for example, in the case of finger vein authentication, the characteristic data is data serving as a reference for selecting a biometric feature amount suitable for registration, such as finger tilt. Note that the biometric feature amount is also simply referred to as biometric information, and the biometric authentication apparatus includes an acquisition unit and an acquisition unit that acquire biometric information.

  The overall apparatus control program 208 activates the encryption / decryption program 210 again. That is, in the above description, the authentication program is activated and decrypted (activated), but in the following description, it is restarted for use in the acquired biometric feature encryption function. By restarting the program 210, the biometric feature 214 is encrypted with the encryption key 216, and the result is stored in the encrypted biometric feature 215 (404). Thereafter, in order to prevent the data from leaking, the areas of the image buffer 213 and the biometric feature 214 are cleared (405).

  The sales office window terminal 105 causes the IC card device-equipped biometric authentication device 104 to repeatedly execute the processing of steps 402 to 405 until the specified number of times is reached, and stores the result in the encrypted biometric feature 215 (406). Then, in response to an instruction from the sales office window terminal 105, the authentication program 211 selects, from the data 215, the encrypted registration feature quantity to be registered in the IC card based on the characteristic data (reference data) extracted in step 403. (407).

  The overall apparatus control program 208 writes the selected encrypted registration feature quantity into the IC card apparatus 205 via the IC card apparatus control program 212 under the instruction from the window terminal 105 (408). Thereafter, in order to prevent the encrypted registered feature quantity from remaining in the apparatus, the area of the encrypted biometric feature quantity 215 is cleared (409). In the above description, an example in which various processes are performed according to instructions from the window terminal 105 has been described. However, these processes may be performed automatically only within the authentication apparatus. In addition, there is an example in which clearing of S405 is performed at the same time as clearing of S409. That is, the data size is increased by repeated execution, and the size of the image buffer 213 must be increased. Also, compared to clearing the encrypted data in S409, the data in S405 is unencrypted data, so it is better to clear it as soon as possible after use.

  Through the processes in steps 401 to 409 described above, the biometric feature amount is encrypted within the biometric authentication apparatus and stored in the IC card without being output to the sales office window terminal 105.

    Next, the authentication process in ATM is demonstrated using the biometric feature amount stored in IC card using FIG.5, FIG.6, FIG.7 and FIG. ATM is installed in a financial institution, and an end user automatically performs deposit, withdrawal, transfer processing, etc., and is also referred to as an automatic cash transaction apparatus. Although described in the example of ATM, it is applicable to the terminal and computer used for a user's personal authentication, and is also called an automatic transaction apparatus.

  FIG. 5 is a diagram showing a configuration example of the ATM 107. The CPU 501 is a processor that performs ATM data processing and performs various processes and controls such as control of various programs and generation of commands. A LAN device 502 is a device for connecting a terminal to the LAN 108 in the store, and is connected to the accounting host computer 109 via the LAN 108. The peripheral device I / O device 503 is an interface for connecting to the biometric authentication device 106. The IC card device 504 is incorporated in an ATM card insertion slot, and is separated from the biometric authentication device 106 used for identity verification in ATM. The display device 505 is a monitor that displays transaction information and biometric authentication results to the user, and the key input device 506 is a device for the user to key-in a transaction menu and a password. The cash processing apparatus 507 is an apparatus for performing cash processing in ATM. The main storage device 509 stores various programs and data.

  Reference numeral 510 denotes an overall control program for controlling the entire ATM, and 511 stores a business application program related to a business to be performed in an ATM transaction. The peripheral device I / O control program 512 controls the peripheral device I / O device 503. The biometric authentication device control program 513 is a program that controls the biometric authentication device 106 connected via the peripheral device I / O device 503. The encryption / decryption program 515 uses the encryption key 516 to decrypt the encrypted authentication result (not including the biometric feature amount) transmitted from the biometric authentication device 106. Reference numeral 517 denotes an area for storing an encrypted authentication result transmitted from the biometric authentication device 106, and reference numeral 518 denotes an area for storing a result obtained by decrypting the authentication result using the encryption key 516.

  A configuration example of the biometric authentication device 106 for authentication connected to the ATM is shown in FIG. 601 to 604 have the same functions as 201 to 204 in FIG. In the main storage device 605, various programs and data areas for operating the device are secured. The overall apparatus control program 607 is a program for controlling the entire biometric authentication apparatus. 608 to 612 are the same as 209 to 211 and 213 to 214 in FIG. Reference numeral 613 denotes an area in which the biometric authentication device receives the encrypted biometric registration feature amount registered in the IC card via the peripheral device I / O device 602 and stores it from the ATM. The biometric registration feature quantity 614 is an area in which the encryption / decryption program 609 decrypts and stores the encrypted feature quantity 613 using the encryption key 617. The collation result 615 is an area for storing the result of collation between the biometric feature quantity 612 and the biometric registration feature quantity 614 by the authentication program 610. The encrypted verification result 616 is an area where the encryption / decryption program 609 encrypts and stores the verification result 615 using the encryption key 617. The encryption key 617 is acquired from the ATM 107 to which the biometric authentication device is connected. A bus 606 connects a processor and each device. Reference numerals 618 and 619 are the same as 217 and 218 in FIG.

  Here, it is assumed that the biometric authentication device 106 is activated at the same time when the ATM is powered on or activated. Specifically, the authentication device 106 receives an encryption key from the ATM 107 at startup and stores it in 617. At the same time, it is assumed that the encryption authentication program 619 stored in the nonvolatile memory 618 is decrypted using the encryption key 617 and stored in the main storage device 605. Furthermore, the authentication device 106 is also terminated by shutting down or shutting down the power when the ATM is normally closed or abnormal, and the authentication program 610 is cleared at the same time. Regarding the establishment process of the ATM control unit and the biometric authentication device by decryption of these authentication programs, and the reason why the nonvolatile memory 618 and the main storage device (volatile memory) 605 are configured, examples of the above-mentioned store system Since it explained in, it is omitted.

  The operations of the ATM 107 and the biometric authentication device 106 will be described with reference to FIG. The ATM displays various items (menus) such as deposit, payment, and transfer as an initial screen on the display device 505 in accordance with instructions from the CPU (control means, unit) 501. The ATM user selects a transaction item from the transaction menu displayed on the display device 505 using the key input device 506 (701). Note that the display device 505 and the key input device 506 are touch panels, and are also simply referred to as display devices (means, units). For example, it is assumed here that a deposit payment transaction is selected. After that, the user inserts the IC card into the ATM card insertion slot according to the guidance “Please insert the card” displayed on the display device 505, and the inserted IC card is taken into the IC card device 504. The contents are read (702). Subsequently, a password input guidance is displayed on the display unit 505 together with the numeric keypad, and the user inputs the password using the key input device 506 according to the guidance (703). The input personal identification number is transmitted to the host 109, and the result (correct / correct) verified by the host is received. It is desirable to encrypt the data with the encryption key 516 when transmitting the personal identification number. If the collation result obtained by entering the password is incorrect, a guidance message “Please enter again” is displayed on the display device 505 to prompt the user to re-enter the password. On the other hand, if the collation result is correct, the biometric information registered in the IC card is read or guidance such as “Place your finger on the biometric device” is displayed on the display device 505. At the same time, the control and processing of the biometric authentication device control program 513 in the ATM are transferred to the overall device control program 607 of the biometric authentication device 106 to execute biometric authentication processing (704). In this way, the password authentication process is executed on the ATM side, and the biometric authentication process is executed on the biometric authentication apparatus side described below, which is one of the features of improving security.

  Details of the biometric authentication process in step 704 will be described with reference to FIG. 8 and FIG. First, the ATM 107 reads the encrypted biometric registration feature value stored in the IC card by the IC card device 504 (reading process), and directly transmits it to the biometric authentication device 106. That is, ATM (control part) performs the process which transmits to a biometrics authentication apparatus, maintaining the encryption state of the encrypted biometric information. As described above, the ATM 107 also has the encryption key 516, but does not decrypt the encrypted biometric registration feature value read from the IC card. The authentication device 106 receives the encrypted feature value and stores it in the encrypted biometric registration feature value 613 in FIG. 6 (801). Next, the overall apparatus control program 607 activates the encryption / decryption program 609, decrypts the encrypted data stored in 613 using the encryption key 617 (decryption processing, decryption unit), and then obtains the result as a biometric registration feature amount. It is stored in 614 (802).

  When the user places, for example, a finger on the biometric authentication device 106 according to the guidance displayed on the ATM display device 505, the authentication program 610 in the device 106 controls the illumination LED 603 and the image sensor 604 to control the biometric. An image is acquired and stored in the image buffer 611 (803). The authentication program 610 reads the biometric image stored in the image buffer 611, extracts a biometric feature for authentication from the image, and stores the result in the biometric feature 612 (804). As described above, the function of acquiring a user's biological image, information, and feature amount is also simply referred to as an acquisition process (means, unit).

  Next, the authentication program 610 reads out the biometric feature quantity 612 and the biometric registration feature quantity 614 and calculates a distance value between them (matching, collation processing, part). If it is above, the result is stored in 615 as verification rejection. Further, in 615, the status code is stored together with the collation result such as acceptance or rejection (805). For example, in the case of collation rejection, a code indicating whether the position where the living body is placed on the apparatus is bad or whether the living body information cannot be acquired due to the extremely strong force of pressing the living body is attached. The authentication device transmits this code to the ATM 107, and the ATM 107 uses this code, so that, for example, in the case of verification rejection, it is possible to display guidance on how to place a living body in accordance with the code to the ATM user. become. As a result, accurate guidance regarding the biometric authentication method can be provided, so that it is possible to reduce the troublesomeness of the user repeating biometric authentication more than necessary. The encryption / decryption program 609 encrypts the collation result stored in 615 using the encryption key 617 and stores the result in 616 (806). Thereafter, in order to eliminate the possibility of data leaking to the outside, the apparatus overall control program 607 clears the data stored in 611 to 617 (807). This eliminates the need for the ATM to delete the biometric feature remaining in the biometric authentication device 106 and prevents the biometric feature remaining in the device from leaking outside. Finally, the encrypted verification result stored in 220 is transmitted to the ATM (not including the biometric information itself), and the encrypted verification result existing in the apparatus is deleted (808). If the authentication result is rejection, the ATM repeats the processing of steps 801 to 808 until the specified number is reached. The biometric authentication process of step 704 is completed by the process of FIG. 7 described above. Here, the encrypted verification result is transmitted to the ATM in step 808. The reason is as follows.

  The authentication device basically only has to transmit data indicating acceptance or rejection of authentication to the ATM. However, if the data format is leaked to a third party, there is a possibility that a legitimate biometric authentication device is removed and an unauthorized device that always transmits authentication acceptance data is connected to the ATM. In this case, since the ATM receives the data for accepting the authentication without performing the biometric authentication, there is a risk that the anti-fraud effect of the biometric authentication device may be lost.

  If the result of biometric authentication in step 704 is OK in accepting authentication, the process proceeds to step 706, and if it is NG, the process proceeds to step 710 in which the transaction is stopped (705).

  The user inputs a refund amount to the ATM 107 using the key input device 506 (706), and the ATM 107 communicates with the account host computer 109 based on the input amount and performs account processing (707). Thereafter, the ATM ejects the IC card from the IC card insertion slot, and prints a description describing the transaction result (708). Finally, the ATM dispenses banknotes for the amount input from the cash processing apparatus 507, discharges the cash from the cash outlet, and ends the series of processes (709).

  Through the processes in steps 701 to 709 described above, the authentication process is completed without the biometric feature amount being output from the biometric authentication apparatus 106 to the outside. Although an example in which the IC card device 504 and the biometric authentication device 106 are configured separately has been described, the IC card device 504 and the biometric authentication device 106 may be integrally formed as shown in FIG. In this case, registered and encrypted biometric information read from the IC card does not pass through the ATM at all, and further security can be ensured.

  In the above embodiment, the biometric feature amount is registered in the IC card at the sales counter terminal and biometric authentication is performed by ATM. However, biometric feature registration may be performed by a biometric authentication device connected to the ATM. Alternatively, biometric authentication may be performed at the branch terminal, and the registered biometric information does not need to go through the branch terminal as described above. When registration and authentication are shared by a single biometric authentication device, it is possible to add data 613 to 616 in FIG. 6 to the main storage device 207 in FIG.

  In the above embodiment, only one type of encryption key for encryption is provided, but the encryption key for decrypting the authentication program and the encryption key for encrypting / decrypting the authentication result may be separated. Any method may be used as the encryption method.

  Furthermore, in the above-described embodiment, the authentication program in the biometric authentication device is stored in the non-volatile memory in an encrypted state when the device is not activated, and is decrypted when the device is activated. In addition to ensuring the security of the authentication program by encryption, it is also effective to divide the authentication program, store a part of the program outside the apparatus, and store the rest in the nonvolatile memory in the biometric authentication apparatus. That is, a part of the authentication program stored outside the apparatus when the authentication apparatus is activated and a part of the authentication program stored in the nonvolatile memory in the apparatus can be combined and restored to the original authentication program. Alternatively, encryption and division of the authentication program can be combined.

  Moreover, in the authentication in ATM, it demonstrated by the example which performs a biometrics authentication process after the authentication process by a PIN code. The following points can be cited as advantages of the method of inputting the password first. In transactions that do not use biometric authentication, processing proceeds in the form of “transaction menu selection”, “cash card insertion”, and “password input”. Therefore, ATM users are accustomed to such an order procedure, and if biometric authentication is performed later, the procedure does not change, so there is no confusion in operation. On the other hand, the example in which the password authentication process is performed after the biometric authentication process is advantageous in that there is no need to change the message timing with the host after the password input and the transition of the screen to be displayed. At this time, when the collation result transmitted from the biometric authentication apparatus is OK, the password input screen is displayed for the first time, and the security is doubled for the user by shifting to the password authentication process.

  In the above embodiment, an encryption key exists in the window terminal or ATM, and the biometric feature amount is encrypted using the key and registered in the IC card. The key for encrypting the biometric feature quantity does not necessarily exist in the window terminal or ATM, and may exist only in the biometric authentication apparatus. In this case, when reading / writing the biometric feature amount encrypted between the IC card biometric authentication device via the window terminal or ATM, the key does not exist in the window terminal or ATM, so that the encrypted biometric value is decrypted. However, it becomes difficult in principle, and security can be improved.

The figure which shows the example of whole structure of the financial sales office system using biometric authentication. The figure which shows the structural example of the biometrics authentication apparatus with an IC card apparatus connected to a branch office counter terminal. The figure which shows the structural example of a branch office window terminal. The figure which shows the processing flow which registers the feature-value for biometric authentication into an IC card using a shop counter window terminal and the biometric authentication apparatus with an IC card apparatus. The structural example of ATM (automatic cash dispenser) is shown. The figure which shows the structural example of the biometrics apparatus connected to ATM. The figure which shows the transaction business flow containing a biometrics authentication process in ATM. The figure which shows the processing flow of the biometrics apparatus connected to ATM.

Explanation of symbols

DESCRIPTION OF SYMBOLS 101 ... Financial sales shop, 102 ... Wide area network, 103 ... Data center, 104 ... Biometric authentication apparatus with IC card apparatus, 105 ... Sales office window terminal, 106 ... Biometric authentication apparatus, 107 ... ATM (automated teller machine), 108 ... LAN in the store, 109 ... Account host computer

Claims (2)

A biometric authentication device for performing identity verification using personal biometric information,
A sensor that captures biological information;
Means for inputting, from the outside of the biometric authentication device, a biometric feature value selected based on vein information acquired by the sensor and characteristic data including information related to finger inclination and encrypted as authentication reference data;
Before the biometric authentication device is activated, it is stored in an encrypted form in the device, and after the biometric authentication device is activated, it is decrypted and operable, and authentication is performed from the acquired sensor information. Feature amount extraction means for extracting a biometric feature amount for
Decryption means for decrypting the encrypted biometric feature amount serving as the authentication reference data;
Before the biometric authentication device is activated, it is stored in an encrypted form in the device, and after the biometric authentication device is activated, it is decrypted and operable, and is output from the feature quantity extraction means Biometric feature amount matching means for collating the biometric feature amount with the biometric feature amount as the decoded reference data for authentication ;
Encryption means for encrypting the output of the biometric feature amount matching means;
Means for outputting the output of the encrypted biometric feature collating means to the outside of the apparatus;
Means for erasing the biometric feature value stored in the apparatus and the output of the biometric feature value matching means each time the biometric authentication process is completed;
A biometric authentication device. A biometric authentication device for performing identity verification using personal biometric information,
A sensor that captures biological information;
The biometric features selected based on the vein information acquired by the sensor and the characteristic data including information on the finger tilt, encrypted as authentication reference data, and stored in the IC card are connected to the biometric authentication device. Means for direct input from an IC card without going through a control computer;
Before the biometric authentication device is activated, it is stored in an encrypted form in the device, and after the biometric authentication device is activated, it is decrypted and operable, and authentication is performed from the acquired sensor information. Feature amount extraction means for extracting a biometric feature amount for
Decryption means for decrypting the encrypted biometric feature amount serving as the authentication reference data;
Before the biometric authentication device is activated, it is stored in an encrypted form in the device, and after the biometric authentication device is activated, it is decrypted and operable, and is output from the feature quantity extraction means Biometric feature amount matching means for collating the biometric feature amount with the biometric feature amount as the decoded reference data for authentication ;
Encryption means for encrypting the output of the biometric feature amount matching means;
Means for outputting the output of the encrypted biometric feature collating means to the outside of the apparatus;
Means for erasing the biometric feature value stored in the apparatus and the output of the biometric feature value matching means each time the biometric authentication process is completed;
A biometric authentication device.

Images