JP2018136886A - Transportable apparatus and authentication method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce complexity of biometric authentication while securing high security.SOLUTION: A wearable device 100 includes: a communication unit 20 for short-range wireless communication; a storage unit 10 for storing authentication data 11 including data on users' vein patterns; and a control unit 40 that, when data for authentication of a user is requested from an authentication device 300 by communication via the communication unit 20, reads out the authentication data 11 from the storage unit 10 and transmits it to the authentication device 300 by communication via the communication unit 20 without obtaining the user's vein pattern from the user.SELECTED DRAWING: Figure 2

Description

  The present invention relates to a portable device and an authentication method.

  In recent years, biometric authentication has been used for identity verification in door security such as entry / exit, login to personal computers, POS (Point Of Sales) systems in commercial stores, credit card payment terminals, bank stores, ATMs (Automatic Teller Machines), etc. Biometric authentication systems are increasing. As an example of using such biometric authentication, for example, the biometric registration information of a user acquired by a biometric authentication device is recorded in advance on a SIM card (Subscriber Identity Module Card) of a mobile phone, When the biometric authentication information of the user read by the authentication device matches the biometric registration information of the user recorded on the SIM card, it is determined that the user is a valid user, and the acquired biometric authentication information is promptly There are authentication systems that provide various services after erasure.

JP 2014-174945 A

  In recent years, for example, in a security zone, biometric authentication devices are installed at the entrances and exits of a plurality of rooms (sections), and according to the security level set for each room, biometric authentication is performed for entering and exiting users. Management is done. Further, biometric authentication may be further performed for login to a personal computer arranged in a room where security is ensured. In the case of such a biometric authentication installation mode, although high security is ensured, the biometric information is stored in a personal computer that performs entry / exit management and login, and biometric information is stored every time biometric authentication is performed. There is a problem of complicated input.

  The disclosed technology has been made in view of the above, and an object of the present invention is to provide a portable device and an authentication method that reduce complexity of biometric authentication while ensuring high security, for example.

  In an example of the disclosed technology, for example, the portable device is collated with the registration data of the collation source, which has been quickly deleted in the wireless communication unit and the conventional authentication system, and is determined to be a valid user. A storage unit for storing authentication data including biometric information of the user, and when data for user authentication is requested from the authentication device by communication via the wireless communication unit, the biometric authentication device is used. And a control unit that reads the authentication data from the storage unit and transmits the authentication data to the authentication device through communication via the wireless communication unit.

  According to an example of the disclosed technology, for example, with high security, each time biometric authentication is performed, identity rejection that is not determined to be a legitimate user due to changes in biometric information to be acquired is reduced, and complexity of biometric authentication is reduced. can do.

FIG. 1 is a diagram illustrating an example of the authentication system according to the embodiment. FIG. 2 is a functional block diagram illustrating an example of a wearable device according to the embodiment. FIG. 3 is a diagram illustrating an example of authentication data including biometric authentication data stored in the wearable device according to the embodiment. FIG. 4 is a functional block diagram illustrating an example of a reception terminal according to the embodiment. FIG. 5 is a diagram illustrating an example of registration data including biometric registration data generated by the reception terminal according to the embodiment. FIG. 6 is a functional block diagram illustrating an example of the authentication apparatus according to the embodiment. FIG. 7 is a functional block diagram illustrating an example of an authentication server according to the embodiment. FIG. 8 is a diagram illustrating an example of a registration data table stored in the authentication server according to the embodiment. FIG. 9 is a diagram illustrating an example of a service permission table stored in the authentication server according to the embodiment. FIG. 10 is a sequence diagram illustrating registration data registration processing in the biometric authentication system according to the embodiment. FIG. 11 is a sequence diagram illustrating an authentication data registration process in the biometric authentication system according to the embodiment. FIG. 12 is a sequence diagram illustrating the authentication process in the biometric authentication system according to the embodiment. FIG. 13 is a sequence diagram illustrating data deletion processing in the biometric authentication system according to the embodiment. FIG. 14 is a flowchart illustrating data deletion processing in the wearable device according to the embodiment. FIG. 15 is a diagram illustrating an example of a registration data table stored in the authentication server according to the modification of the embodiment.

  Hereinafter, embodiments of the portable device and the authentication method disclosed in the present application will be described in detail with reference to the drawings. Note that the portable device and the authentication method disclosed in the present application are not limited by the following embodiments. Further, the following embodiments and modifications can be combined as appropriate. In addition, elements that are illustrated and described with reference numerals in the drawings are given the same reference numerals for the same elements, and description of the subsequent elements will be omitted as appropriate.

[Biometric authentication system according to the embodiment]
FIG. 1 is a diagram illustrating an example of the authentication system according to the embodiment. As illustrated in FIG. 1, the authentication system 1 according to the embodiment includes a wearable device 100, a reception terminal 200, an authentication device 300, and an authentication server 400. The wearable device 100 and the reception terminal 200 perform near field communication such as NFC (Near field radio Communication). Wearable device 100 and authentication device 300 perform near field communication such as NFC. The reception terminal 200 and the authentication server 400 perform wired or wireless communication. The authentication device 300 and the authentication server 400 perform wired or wireless communication.

[Wearable device according to embodiment]
FIG. 2 is a functional block diagram illustrating an example of a wearable device according to the embodiment. The wearable device 100 is a wristband type wearable device wound around the wrist of the user 2. A wearable device is an example of a portable device. The wearable device 100 includes a storage unit 10, a communication unit 20, a vital sensor 30, and a control unit 40. For example, the storage unit 10, the communication unit 20, and the control unit 40 may be mounted on a single chip. The vital sensor 30 is an example of a detection unit that detects a vital sign of a user.

  The storage unit 10 stores authentication data 11 and a serial number 12 that identifies an individual wearable device 100. The storage unit 10 includes a volatile semiconductor storage device such as a RAM (Random Access Memory) that stores the authentication data 11 and a nonvolatile semiconductor storage device such as a ROM (Read Only Memory) that stores the serial number 12. . The authentication data 11 is data that is collated with the registration data 421-1 (see FIG. 5) of the collation source when performing the authentication process.

[Authentication data including biometric authentication data stored in the wearable device according to the embodiment]
FIG. 3 is a diagram illustrating an example of authentication data including biometric authentication data stored in the wearable device according to the embodiment. As shown in FIG. 3, the authentication data 11 includes an ID 11a, a serial number 11b, biometric authentication data 11c, and an expiration date 11d.

  The ID 11 a is identification information for identifying the user 2 that is input to the reception terminal 200 and acquired via the reception terminal 200 when generating the authentication data 11. The serial number 11b is obtained by copying the serial number 12 of the wearable device 100 when the authentication data 11 is generated. The biometric authentication data 11 c is data of the vein pattern of the palm 3 of the user 2 that is input to the reception terminal 200 by the user 2 and acquired via the reception terminal 200 when generating the authentication data 11. . The expiration date 11d is a time limit given when the authentication data 11 is generated, and the validity of the authentication data 11 continues.

  The authentication data 11 only needs to include at least the association between the ID 11a and the biometric authentication data 11c. The serial number 11b reads the serial number 12 and adds it to the authentication data 11 each time the authentication data 11 is read. It is good. Further, the expiration date 11d may be omitted.

  Returning to the description of FIG. The communication unit 20 is a communication module that performs near field communication with the reception terminal 200 and the authentication device 300. The vital sensor 30 is a sensor that detects the pulse of the user 2.

  The control unit 40 includes an authentication data processing unit 41 and an authentication data erasing unit 42. When generating the registration data 421-1 (see FIG. 5) including the biometric registration data to be registered in the authentication server 400, the authentication data processing unit 41 generates the authentication data 11 and stores it in the storage unit 10. When deleting the authentication data 11 from 10, a status inquiry is received from the reception terminal 200, and as a response, the authentication data 11 is transmitted to the reception terminal 200 when the authentication data 11 is registered or not.

  Further, the authentication data processing unit 41 stores the authentication data 11 received from the receiving terminal 200 in the storage unit 10. Further, the authentication data processing unit 41 reads the authentication data 11 stored in the storage unit 10 when receiving an authentication request from the authentication device 300 by short-range wireless communication via the communication unit 20, and transmits the authentication data 11 via the communication unit 20. Authentication data 11 is transmitted to the authentication device 300.

  The authentication data erasure unit 42 erases the authentication data 11 stored in the storage unit 10 when receiving an authentication data erasure request from the reception terminal 200 through short-range wireless communication via the communication unit 20. Further, the authentication data erasure unit 42 erases the authentication data 11 stored in the storage unit 10 when the vital sign 30 has not been detected for a predetermined time. Further, the authentication data erasure unit 42 compares the expiration date 11d of the authentication data 11 with the current date and time, and if the current date and time exceeds the expiration date 11d of the authentication data 11, it is stored in the storage unit 10. The authentication data 11 is deleted.

[Reception terminal according to the embodiment]
FIG. 4 is a functional block diagram illustrating an example of a reception terminal according to the embodiment. An imaging device 210, an input device 220, and a communication device 230 are connected to the reception terminal 200 according to the embodiment. The imaging device 210 captures the palm 3 of the user 2 and outputs the captured image to the reception terminal 200. The input device 220 is a device for inputting character information such as an ID. The communication device 230 performs near field communication with the wearable device 100.

  The reception terminal 200 includes a control unit 240 and a communication interface unit 250 that communicates with the authentication server 400 by wire or wireless. The control unit 240 includes a wearable device information acquisition unit 241, a biometric information acquisition unit 242, a registration data processing unit 243, and an authentication data processing unit 244.

  The wearable device information acquisition unit 241 generates the authentication data 11 when registering the registration data 421-1 (see FIG. 5) in the authentication server 400 and stores the authentication data 11 in the wearable device 100. When deleting, a status inquiry is transmitted to the wearable device 100 and, as a response, the presence / absence of registration of the authentication data 11 and the authentication data 11 (when the authentication data 11 is registered) are received from the wearable device 100.

  The biometric information acquisition unit 242 controls the imaging device 210 to acquire the vein image of the palm 3 of the user 2 and generates data of the vein pattern of the palm 3 of the user 2 from the acquired vein image.

  The registration data processing unit 243 receives the ID of the user 2 input via the input device 220 by an operator or the like when registering the registration data 421-1 (see FIG. 5) in the authentication server 400. The registration data processing unit 243 is generated by the input user 2 ID (ID 421-1a), the serial number 12 (serial number 421-1b) received from the wearable device 100, and the biometric information acquisition unit 242. Registration data 421-1 (see FIG. 5) including biometric registration data 421-1c which is the data of the vein pattern is generated. FIG. 5 is a diagram illustrating an example of registration data including biometric registration data generated by the reception terminal according to the embodiment. The registration data processing unit 243 transmits the generated registration data 421-1 to the authentication server 400 via the communication interface unit 250. The registration data 421-1 is data that serves as a verification source of the authentication data 11 when performing the authentication process.

  In addition, the registration data processing unit 243 designates the combination of ID and serial number, and in response to an instruction to delete registration data from an operator or the like, the registration data processing unit 243 stores the corresponding registration data 421-1 in the registration data table 421 (see FIG. 7), the authentication server 400 is instructed to be deleted.

  The authentication data processing unit 244 receives the ID of the user 2 input via the input device 220 by an operator or the like when generating the authentication data 11 and storing it in the wearable device 100. In addition, when the registration data processing unit 243 generates the authentication data 11 and stores it in the wearable device 100, the registration data processing unit 243 calculates an expiration date 11d obtained by adding a predetermined date and time to the current time. Then, the authentication data processing unit 244 receives the input user 2 ID (ID 11 a), the serial number 12 (serial number 11 b) received from the wearable device 100, and the vein pattern generated by the biometric information acquisition unit 242. Authentication data 11 (see FIG. 3) including biometric authentication data 11c, which is data, and an expiration date 11d is generated. The authentication data processing unit 244 transmits the generated authentication data 11 to the wearable device 100 via the communication device 230.

  Further, the authentication data processing unit 244 transmits the authentication data 11 to the wearable device 100 and then transmits the authentication data 11 to the authentication server 400 in order to confirm the validity of the authentication data 11. Then, the authentication data processing unit 244 receives a response indicating whether authentication is possible or not possible from the authentication server 400. When the authentication data processing unit 244 receives an authentication-acceptable response from the authentication server 400, the authentication data processing unit 244 determines that the authentication data 11 stored in the wearable device 100 is valid. On the other hand, when the authentication data processing unit 244 receives a response indicating that authentication is not possible from the authentication server 400, the authentication data processing unit 244 determines that the authentication data 11 stored in the wearable device 100 is not valid, and notifies the operator that the authentication data 11 cannot be stored. Then, it may be prompted to save the authentication data 11 in the wearable device 100 again.

  Further, the authentication data processing unit 244 instructs the corresponding wearable device 100 to delete the authentication data 11 from the storage unit 10 in accordance with an instruction from an operator or the like that has designated a combination of ID and serial number. To do.

[Authentication apparatus according to the embodiment]
FIG. 6 is a functional block diagram illustrating an example of the authentication apparatus according to the embodiment. The authentication device 300 according to the embodiment is connected to a communication device 310 that performs near field communication with the wearable device 100. The authentication device 300 includes a control unit 320 and a communication interface unit 330.

  The control unit 320 transmits an authentication data request to the wearable device 100 via the communication device 310 by passive communication. Then, when receiving the authentication data 11 from the wearable device 100 via the communication device 310 by the passive communication, the control unit 320 transmits the received authentication data 11 to the authentication server 400. Then, the control unit 320 receives a notification indicating whether authentication is possible or not based on the received authentication data 11 from the authentication server 400. When notified from the authentication server 400 that the authentication is possible based on the authentication data 11, the control unit 320 permits the user 2 to provide a service such as unlocking the door. On the other hand, when notified from the authentication server 400 that authentication based on the authentication data 11 is not possible, the control unit 320 does not permit the user 2 to provide services such as unlocking the door.

[Authentication server according to the embodiment]
FIG. 7 is a functional block diagram illustrating an example of an authentication server according to the embodiment. The authentication server 400 according to the embodiment includes a control unit 410, a storage unit 420, and a communication interface unit 430. The storage unit 420 is a nonvolatile semiconductor storage device. The storage unit 420 includes a registration data table 421 and a service permission table 422.

[Registration data table stored in the authentication server according to the embodiment]
FIG. 8 is a diagram illustrating an example of a registration data table stored in the authentication server according to the embodiment. The registration data table 421 has columns of ID 421a, serial number 421b, and biometric registration data 421c. Here, the registration data table 421 is a table storing registration data 421-1 (see FIG. 5) as each record. Accordingly, the ID 421a, serial number 421b, and biometric registration data 421c in the registration data table 421 correspond to the ID 421-1a, serial number 421-1b, and biometric registration data 421-1c in the registration data 421-1, respectively.

[Service permission table stored in the authentication server according to the embodiment]
FIG. 9 is a diagram illustrating an example of a service permission table stored in the authentication server according to the embodiment. The service permission table 422 is a registration corresponding to the user 2 who is permitted to provide a service such as door unlocking by the authentication process based on the authentication data 11 among the registration data 421-1 registered in the registration data table 421. A combination of the ID 421a and the serial number 421b of the data table 421 is stored. The columns of ID 422a and serial number 422b in the service permission table 422 correspond to the columns of ID 421a and serial number 421b in the registration data table 421, respectively.

  Returning to the description of FIG. When the control unit 410 receives the authentication data 11 from the authentication device 300 via the communication interface unit 430, the control unit 410 refers to the registration data table 421 based on the ID 11a and the serial number 11b included in the authentication data 11, and stores the corresponding record. The biometric registration data 421c and the biometric authentication data 11c included in the authentication data 11 are collated. Then, when the biometric registration data 421c of the corresponding record matches the biometric authentication data 11c included in the authentication data 11, the control unit 410 notifies the authentication apparatus 300 via the communication interface unit 430 that authentication is possible. Send. On the other hand, when the biometric registration data 421c of the corresponding record and the biometric authentication data 11c included in the authentication data 11 do not match, the control unit 410 notifies the authentication apparatus 300 via the communication interface unit 430 that authentication is impossible. Send.

[Registration Data Registration Process in Biometric Authentication System According to Embodiment]
FIG. 10 is a sequence diagram illustrating registration data registration processing in the biometric authentication system according to the embodiment. First, the reception terminal 200 makes a status inquiry to the wearable device 100 (step S11). The status inquiry is to inquire about the serial number of the wearable device 100 together with whether or not the authentication data 11 is registered in the wearable device 100. Here, it is assumed that the wearable device 100 has not registered the authentication data 11. The wearable device 100 transmits to the reception terminal 200 that the authentication data 11 has not been registered and the serial number of the wearable device 100 in response to the state inquiry (step S12).

  Next, the user 2 inputs ID to the reception terminal 200 (step S13). Subsequently, the reception terminal 200 acquires the biometric information (an image of palm veins) of the user 2 (Step S14). Next, the reception terminal 200 generates registration data 421-1 including the serial number acquired in Step S12, the ID input in Step S13, and the biometric information acquired in Step S14 as biometric registration data 421-1c (Step S12). S15). Next, the reception terminal 200 transmits the registration data 421-1 generated in Step S15 to the authentication server 400 (Step S16). Next, the authentication server 400 adds the received registration data 421-1 to the registration data table 421 of the storage unit 420 (step S17).

[Authentication Data Registration Process in Biometric Authentication System According to Embodiment]
FIG. 11 is a sequence diagram illustrating an authentication data registration process in the biometric authentication system according to the embodiment. First, the reception terminal 200 makes a status inquiry to the wearable device 100 (step S21). Here, it is assumed that the wearable device 100 has not registered the authentication data 11. The wearable device 100 transmits to the reception terminal 200 that the authentication data 11 has not been registered and the serial number of the wearable device 100 in response to the state inquiry (step S22).

  Next, the user 2 inputs an ID to the reception terminal 200 (step S23). Subsequently, the reception terminal 200 acquires the biometric information (an image of palm veins) of the user 2 (Step S24). Next, the reception terminal 200 generates authentication data 11 including the serial number acquired in step S22, the ID input in step S23, and the biometric data acquired in step S24 (step S25). Next, the reception terminal 200 transmits the authentication data 11 generated in step S25 to the wearable device 100 (step S26). The wearable device 100 stores the authentication data 11 received in step S26 in the storage unit 10.

  Next, the reception terminal 200 requests the wearable device 100 to transmit the authentication data 11 (step S27). The wearable device 100 reads the authentication data 11 stored in the storage unit 10 in response to the request and transmits it to the receiving terminal 200 (step S28). Next, the reception terminal 200 transmits the authentication data 11 to the authentication server 400 (step S29). Next, the authentication server 400 performs biometric authentication based on the received authentication data 11 (step S30).

  Next, the authentication server 400 transmits the result of the authentication process in step S30 (authentication OK / NG) to the reception terminal 200 (step S31). When receiving the authentication OK from the authentication server 400, the receiving terminal 200 transmits a message to that effect to the wearable device 100, and the record of the authentication data 11 in the wearable device 100 is confirmed (step S32). On the other hand, upon receiving the authentication NG from the authentication server 400, the reception terminal 200 transmits a message to that effect to the wearable device 100. In this case, the reception terminal 200 and the wearable device 100 may execute the registration process of the authentication data 11 again.

[Authentication processing in the biometric authentication system according to the embodiment]
FIG. 12 is a sequence diagram illustrating the authentication process in the biometric authentication system according to the embodiment. First, the authentication device 300 requests the wearable device 100 to transmit the authentication data 11 (step S41). The wearable device 100 reads the authentication data 11 stored in the storage unit 10 in response to the request and transmits it to the authentication device 300 (step S42). Next, the authentication device 300 transmits the authentication data 11 to the authentication server 400 (step S43). Next, the authentication server 400 performs biometric authentication based on the received authentication data 11 (step S44).

  Next, the authentication server 400 transmits the result of the authentication process in step S34 (authentication OK / NG) to the authentication device 300 (step S45). Upon receiving the authentication OK from the authentication server 400, the authentication device 300 permits service provision to the user 2 wearing the wearable device 100 (step S46). On the other hand, when receiving authentication NG from the authentication server 400, the authentication device 300 does not permit the user 2 wearing the wearable device 100 to provide the service but notifies the user 2 that the service is not permitted.

[Data Deletion Processing in Biometric Authentication System According to Embodiment]
FIG. 13 is a sequence diagram illustrating data deletion processing in the biometric authentication system according to the embodiment. First, the reception terminal 200 makes a status inquiry to the wearable device 100 (step S51). Next, in response to the request, wearable device 100 reads ID 11a and serial number 11b included in authentication data 11 stored in storage unit 10 and transmits them to reception terminal 200 (step S52). Next, the reception terminal 200 requests the wearable device 100 to delete the corresponding authentication data 11 by specifying the ID 11a and the serial number 11b received in step S52 (step S53). When the wearable device 100 receives a request for deleting the registration data 421-1 along with the ID 11a and the serial number 11b from the reception terminal 200, the wearable device 100 stores the corresponding data stored in the storage unit 100 based on the received ID 11a and the serial number 11b. The authentication data 11 is deleted. In the case where the authentication data 11 is not stored in the storage unit 10, the wearable device 100 transmits that fact to the reception terminal 200.

  Next, the reception terminal 200 transmits the ID 11a and the serial number 11b acquired in step S52 to the authentication server 400, and requests deletion of the corresponding registration data 421-1 (step S54). When the authentication server 400 receives a request to delete the registration data 421-1 together with the ID 11a and the serial number 11b from the reception terminal 200, the authentication server 400 stores the registration data 421-1 in the registration data table 421 of the storage unit 420 based on the received ID 11a and serial number 11b. The corresponding registration data 421-1 stored is deleted.

[Data Deletion Processing in Wearable Device According to Embodiment]
FIG. 14 is a flowchart illustrating data deletion processing in the wearable device according to the embodiment. The data deletion process in the wearable device according to the embodiment is executed when the pulse of the user 2 wearing the wearable device 100 is not detected for a predetermined time by the vital sensor 30 of the wearable device 100.

  First, the wearable device 100 detects non-wearing of the wearable device 100 because the pulse of the user 2 wearing the wearable device 100 is not detected by the vital sensor 30 for a predetermined time (step S61). Next, the wearable device 100 deletes the authentication data 11 stored in the storage unit 10 (step S62).

  If the authentication data 11 stored in the storage unit 10 is deleted by the data deletion process in the wearable device 100, the authentication server 400 is notified of the deletion via the reception terminal 200, and the authentication server 400 The corresponding ID and serial number registration data 421-1 may be deleted.

  According to the above embodiment, by repeatedly using the authentication data 11 stored in the wearable device 100, the complexity of inputting biometric information is suppressed every time biometric authentication is required, and the convenience of biometric authentication is improved. Can be made. Further, when it is determined that the wearable device 100 has been released from the body of the user 2, the authentication data 11 stored in the wearable device 100 is automatically deleted, thereby preventing the leakage and unauthorized use of biometric information. Can maintain high security.

  In addition, the authentication device 300 includes an authentication device 300 that transmits an ID mounted on an ID card or an IC (Integrated Circuit) tag to the authentication device 300 by short-range wireless communication, and authenticates the authentication server 400 based on the ID. By using a wearable device 100 that stores biometric information that has been converted to data instead of an ID card or IC tag using a system, a biometric sensor is not provided for each service providing location (authentication device 300). Using the system, a biometric authentication system can be easily constructed at low cost.

  The embodiment can be applied to identity verification, door security, station ticket gates, payment at a real store or the Internet at a convenience store, patient authentication at a hospital, and single sign-on to a device such as a personal computer.

  Also, for example, in a theme park or the like, for example, biometric authentication is used for confirmation of entrance / exit, biometric authentication is performed using ATM installed in the venue, and shopping or restaurants at multiple stores in the venue Thus, the present invention can be applied to a situation where biometric authentication is required for each of a plurality of services, such as payment by biometric authentication at a POS terminal or a credit payment terminal.

[Modification of the embodiment]
In the embodiment, the authentication server 400 refers to the registration data table 421 shown in FIG. 8, authenticates the user 2 wearing the wearable device 100 based on the received authentication data 11, and uniformly grants service provision. I do. However, the authentication server 400 refers to the registration data table 421A illustrated in FIG. 15 and authenticates the user 2 wearing the wearable device 100 based on the received authentication data 11, and the user 2 Each service provision may be permitted or not permitted in accordance with the permission and non-permission information for each service provision determined for each.

  FIG. 15 is a diagram illustrating an example of a registration data table stored in the authentication server according to the modification of the embodiment. The registration data table 421A has columns of ID 421Aa, serial number 421Ab, biometric registration data 421Ac, service 1_421Ad, and service 2_421Ae. The registration data table 421A receives registration data including “registration / non-permission information of service 1” and “permission / non-permission information of service 2” in the registration data 421-1 from the reception terminal 200 and stores them as records. It is a table. “Service 1 permission / non-permission information” and “Service 2 permission / non-permission information” are set and input by the operator of the receiving terminal 200 when registration data is generated at the receiving terminal 200. And

  For example, “service 1” is permission to enter the security area 1 (unlocking), and “service 2” is permission to enter the security area 2 (unlocking). Further, the service is not limited to 2 of “service 1” and “service 2”, and permission or non-permission may be set for each of three or more types of services. In addition, the “service” is not limited to entry into the security area (unlocking), but may be other services such as terminal login and payment permission, or a plurality of types of services may be mixed. For example, “service 1” may be permission (unlocking) to enter the security area 1, and “service 2” may be permission to log in to a computer installed in the security area 1.

  For example, the authentication server 400 that has received an authentication request including “ID” “ID1”, “serial number” “serial number 1”, and “designation of service 1” or “designation of service 2” from the authentication device 300. Recognizes that entries corresponding to “ID” “ID1” and “serial number” “serial number 1” are registered in the registration data table 421A. Furthermore, since “service 1” and “service 2” included in the entries corresponding to “ID” “ID1” and “serial number” “serial number 1” are both “permitted”, the authentication server 400 makes this entry If the result of the authentication processing based on the authentication is OK, the authentication OK authentication result is returned to the authentication apparatus 300 regardless of whether the authentication request includes either “designation of service 1” or “designation of service 2”. become. In response to this, the authentication apparatus 300 permits service provision for both “service 1” and “service 2”.

  Also, the authentication server 400 that has received an authentication request including “ID” “ID2”, “serial number” “serial number 2”, and “designation of service 1” or “designation of service 2” from the authentication device 300. Recognizes that entries corresponding to “ID” “ID2” and “serial number” “serial number 2” are registered in the registration data table 421A. Furthermore, since “service 1” included in the entries corresponding to “ID” “ID2” and “serial number” “serial number 2” is “not permitted” and “service 2” is “permitted”, the authentication server If the result of the authentication processing based on this entry is authentication OK, the authentication result of the authentication NG is received for an authentication request including “designation of service 1”, and authentication including “designation of service 2” is performed. In response to the request, an authentication OK authentication result is returned to the authentication device 300. In response to this, the authentication apparatus 300 disallows the service provision of “service 1” and permits the service provision of “service 2”.

  Further, the authentication server 400 that has received an authentication request including “ID” “ID3”, “serial number” “serial number 3”, and “designation of service 1” or “designation of service 2” from the authentication device 300. Recognizes that entries corresponding to “ID” “ID3” and “serial number” “serial number 3” are registered in the registration data table 421A. Furthermore, since “service 1” included in the entries corresponding to “ID” “ID3” and “serial number” “serial number 3” is “permitted” and “service 2” is “not permitted”, the authentication server If the result of the authentication processing based on this entry indicates that the authentication is OK, 400 indicates an authentication OK authentication result for an authentication request including “service 1 specification”, and authentication including “service 2 specification”. In response to the request, the authentication result of the authentication NG is returned to the authentication device 300. In response to this, the authentication apparatus 300 permits the service provision of “service 1” and does not permit the service provision of “service 2”.

[Other variations]
(1) In the embodiment, biometric authentication is performed by reusing the authentication data 11 stored in the wearable device 100 as biometric information used for each service use. However, the present invention is not limited to this, and the authentication system 1 using the wearable device 100 includes a built-in sensor that acquires biological information such as a vein sensor, a fingerprint sensor, and an iris sensor, and authentication data is required when a higher security level is required. 11 and the authentication level may be set stepwise so that the biometric information acquired from the built-in sensor is combined or used properly.

(2) In the embodiment, the data including biometric information stored in the wearable device 100 is verification data that is a verification target of the authentication process, and the data including biometric information stored in the authentication server 400 is the authentication process. It is the registration data that is the object to be verified. However, the present invention is not limited to this, and data including biometric information stored in the wearable device 100 may be registered data to be verified, and data including biometric information stored in the authentication server 400 may be used as authentication data to be verified. Good.

(3) Biometric information In the embodiment, it is assumed that the biometric information is a palm vein pattern. However, it is not limited to the palm vein pattern, and may be other biological information such as fingerprints and irises.

(4) About vital sensing In an example, vital sensor 30 is a sensor which acquires pulse of user 2 from user's 2 wrist. However, the sensor is not limited to the pulse, and may be a sensor that acquires other vital signs such as the body temperature of the user 2.

(5) Short-range wireless communication In the embodiment, short-range wireless communication is NFC, but is not limited to this, and other short-range wireless communication standards such as Bluetooth (registered trademark) and IrDA (registered trademark). May be used.

(6) Wearable Device In the embodiment, it is assumed that the device that stores biometric authentication data is a wristwatch type wearable device 100. However, the wearable device 100 is not limited to the wristwatch type, and may be various wearable devices such as a headset, a mobile phone, a smartphone, a portable personal computer, or the like.

(7) Generation of Registration Data and Authentication Data In the embodiment, the registration data 421-1 and the authentication data 11 are generated by the reception terminal 200, and the authentication server 400 stores the registration data 421-1 received from the reception terminal 200. The wearable device 100 stores the authentication data 11 received from the reception terminal 200. However, the present invention is not limited to this, and the reception terminal 200 only generates the biometric registration data 421-c included in the registration data 421-1, and the generated biometric registration data 421-c is set to the ID 421-1a and the serial number 421-1b. The registration data 421-1 may be generated and stored on the authentication server 400 side. Similarly, the reception terminal 200 only generates the biometric authentication data 11c included in the authentication data 11, transmits the generated biometric authentication data 11c together with the ID 11a and the serial number 11b to the wearable device 100, and authenticates on the wearable device 100 side. Data 11 may be generated and saved.

(8) Integration of Wearable Device and Reception Terminal In the embodiment, wearable device 100 and reception terminal 200 are separate devices. However, the present invention is not limited to this, and the wearable device 100 and the reception terminal 200 may be an integrated wearable device.

  The configuration of each unit illustrated in the above embodiments can be changed or omitted without departing from the technical scope of the portable device and the authentication method according to the disclosed technology. In addition, the embodiments are merely examples, and other modes in which various modifications and improvements are made based on the knowledge of those skilled in the art including the modes described in the disclosure section of the invention are also included in the disclosed technology.

DESCRIPTION OF SYMBOLS 1 Authentication system 2 User 3 Palm 100 Wearable apparatus 10 Memory | storage part 11 Authentication data 11a ID
11b Serial number 11c Biometric authentication data 11d Expiration date 12 Serial number 20 Communication unit 30 Vital sensor 40 Control unit 41 Authentication data processing unit 42 Authentication data deletion unit 200 Reception terminal 210 Imaging device 220 Input device 230 Communication device 240 Control unit 241 Wearable device Information acquisition unit 242 Biometric information acquisition unit 243 Registration data processing unit 244 Authentication data processing unit 250 Communication interface unit 300 Authentication device 310 Communication device 320 Control unit 330 Communication interface unit 400 Authentication server 410 Control unit 420 Storage unit 421 Registration data table 421a ID
421b Serial number 421c Biometric registration data 421A Registration data table 421Aa ID
421Ab Serial number 421Ac Biometric registration data 421Ad Service 1
421Ae Service 2
421-1 Registration data 421-1a ID
421-1b Serial number 421-1c Biometric registration data 422 Service permission table 422a ID
422b Serial number 430 Communication interface part

Claims (4)

A wireless communication unit;
A storage unit for storing authentication data including the biometric information of the user that has been verified with the registered data of the verification source and determined to be a valid user;
When data for authentication of the user is requested from an authentication device through communication via the wireless communication unit, the authentication data is read from the storage unit and communicated via the wireless communication unit to the authentication device. A portable device comprising a control unit for transmitting. A device to be worn on the user's body;
A detection unit for detecting the vital sign of the user;
The portable device according to claim 1, wherein the control unit deletes the authentication data from the storage unit when the detection unit does not detect a vital sign of the user. The authentication data includes an expiration date,
The portable device according to claim 1 or 2, wherein the control unit deletes the authentication data from the storage unit when the expiration date is exceeded. A portable device having an authentication data storage unit that stores authentication data including biometric information of the user that has been verified with the registered data of the verification source and is determined to be a valid user is transmitted from the authentication device to the user by wireless communication. When data for authentication is requested, the authentication data is read from the authentication data storage unit and transmitted to the authentication device by wireless communication.
The authentication device transmits the authentication data received from the portable device to an authentication server;
The authentication server collates the authentication data received from the authentication device with registration data including biometric information stored in advance, and transmits a collation result to the authentication device.
The authentication method includes controlling whether or not to provide a service to the user according to a verification result received from the authentication server.

Images