JP7467735B1 - Authentication system and authentication method - Google Patents

Abstract

[Problem] Reduces the workload of a user and increases the confidentiality of biometric information that is the correct answer for biometric authentication. [Solution] An authentication system comprising a terminal device carried by a user and a biometric authentication device that performs biometric authentication, the terminal device comprises a terminal storage unit that stores reference information for the biometric authentication of the user, a terminal authentication unit that authenticates the user, a terminal communication unit that wirelessly communicates with the biometric authentication device, and an external authentication control unit that, in a state in which the user has been normally authenticated by the terminal authentication unit, transmits the reference information stored in the terminal storage unit or first authentication reference information that is information based on the reference information to the biometric authentication device via the terminal communication unit in response to receiving a first request signal from the biometric authentication device via the terminal communication unit. [Selected Figure] Figure 1

Description

The present disclosure relates to an authentication system and method .

When making a payment, the user's biometric authentication is sometimes performed using a biometric authentication device.
For example, in a service providing system described in Patent Literature 1, a communication device transmits an authentication file including a user's biometric information and device identification information for identifying the communication device, and the device identification information. An authentication device inputs the user's biometric information, compares the received device identification information with the device identification information contained in the received authentication file, and compares the input biometric information with the biometric information contained in the received authentication file. Only when both comparison results match, does the authentication device provide a service to the user and delete the received authentication file (see Patent Literature 1).

JP 2004-318598 A

However, conventional technology still leaves something to be desired in terms of reducing the workload on users and increasing the confidentiality of the biometric information that is the correct answer for biometric authentication.

In consideration of the above circumstances, an embodiment of the present disclosure provides an authentication system and an authentication method that can reduce the workload of a user of a terminal device when the user is biometrically authenticated by a biometric authentication device , and can increase the confidentiality of biometric information that is the correct answer for the biometric authentication.

In one aspect, an authentication system includes a terminal device carried by a user and a biometric authentication device that performs biometric authentication, the terminal device includes a terminal storage unit that stores reference information that is information that serves as a basis for obtaining correct answer information in the biometric authentication of the user, a terminal authentication unit that authenticates the user, a terminal communication unit that performs encrypted communication with the biometric authentication device by wireless, and an external authentication control unit that transmits to the biometric authentication device by the terminal communication unit first authentication reference information that is the reference information stored in the terminal storage unit or information based on the reference information and serves as a basis for obtaining correct answer information in the biometric authentication in response to receiving a first request signal from the biometric authentication device by the terminal communication unit when the user is normally authenticated by the terminal authentication unit. The biometric authentication device includes a biometric information acquisition unit that acquires biometric information of the user, a communication unit that performs the encrypted communication with the terminal device by wireless, and an external authentication control unit that transmits to the biometric authentication device by the terminal communication unit first authentication reference information that is the reference information stored in the terminal storage unit or information based on the reference information and serves as a basis for obtaining correct answer information in the biometric authentication. and a biometric authentication control unit that generates correct answer information for the biometric authentication by processing the first authentication reference information based on the first authentication reference information received from the terminal device by the communication unit and the biometric information acquired by the biometric information acquisition unit, and performs the biometric authentication of the user , wherein a process of obtaining the first authentication reference information based on the reference information by the external authentication control unit and a process of generating the correct answer information based on the first authentication reference information and the biometric information by the biometric authentication control unit are processes other than encryption, the terminal authentication unit of the terminal device authenticates the user by using at least a part of the reference information stored in the terminal memory unit, and an authentication algorithm performed by the terminal authentication unit of the terminal device and an algorithm for the biometric authentication performed by the biometric authentication control unit of the biometric authentication device are different.

One aspect is an authentication method in an authentication system including a terminal device carried by a user and a biometric authentication device that performs biometric authentication, wherein in the terminal device, a terminal storage unit stores reference information that is information that is a basis for obtaining correct answer information in the biometric authentication of the user, a terminal authentication unit authenticates the user, and a terminal communication unit performs encrypted communication with the biometric authentication device by wireless communication, and in a state in which the user is normally authenticated by the terminal authentication unit, an external authentication control unit transmits, to the biometric authentication device by the terminal communication unit, first authentication reference information that is the reference information stored in the terminal storage unit or information based on the reference information and is information that is a basis for obtaining correct answer information in the biometric authentication, in response to receiving a first request signal from the biometric authentication device by the terminal communication unit, and in the biometric authentication device, a biometric information acquisition unit acquires biometric information of the user, and a communication unit performs the encrypted communication with the terminal device by wireless communication, and transmits a request control signal to the biometric authentication device by the terminal communication unit. and a biometric authentication control unit transmits the first request signal to the terminal device via the communication unit, and the biometric authentication control unit processes the first authentication reference information based on the first authentication reference information received from the terminal device via the communication unit and the biometric information acquired by the biometric information acquisition unit to generate correct answer information for the biometric authentication, thereby performing the biometric authentication of the user, a process of obtaining the first authentication reference information based on the reference information by the external authentication control unit, and a process of generating the correct answer information based on the first authentication reference information and the biometric information by the biometric authentication control unit are processes other than encryption, and the terminal authentication unit of the terminal device authenticates the user by using at least a part of the reference information stored in the terminal storage unit, and an algorithm for the authentication performed by the terminal authentication unit of the terminal device is different from an algorithm for the biometric authentication performed by the biometric authentication control unit of the biometric authentication device .

In one aspect, the terminal device in an authentication system includes a terminal device carried by a user and a biometric authentication device that performs biometric authentication, the terminal device including a terminal storage unit that stores reference information for the biometric authentication of the user, a terminal authentication unit that authenticates the user, a terminal communication unit that wirelessly communicates with the biometric authentication device, and an external authentication control unit that transmits the reference information stored in the terminal storage unit or first authentication reference information based on the reference information to the biometric authentication device via the terminal communication unit in response to receiving a first request signal from the biometric authentication device via the terminal communication unit when the user has been normally authenticated by the terminal authentication unit.

One aspect is a program for implementing, in a computer constituting a terminal device in an authentication system including a terminal device carried by a user and a biometric authentication device that performs biometric authentication, a terminal storage function that stores reference information for the biometric authentication of the user, a terminal authentication function that authenticates the user, a terminal communication function that wirelessly communicates with the biometric authentication device, and an external authentication control function that, in a state in which the user has been normally authenticated by the terminal authentication function, transmits the reference information stored in the terminal storage function or first authentication reference information that is information based on the reference information to the biometric authentication device via the terminal communication function in response to receiving a first request signal from the biometric authentication device via the terminal communication function.

In one aspect, the biometric authentication device in an authentication system includes a terminal device carried by a user and a biometric authentication device that performs biometric authentication, the biometric authentication device including a biometric information acquisition unit that acquires biometric information of the user, a communication unit that wirelessly communicates with the terminal device, a request control unit that transmits a first request signal to the terminal device by the communication unit, and a biometric authentication control unit that performs the biometric authentication of the user based on first authentication reference information received from the terminal device by the communication unit and the biometric information acquired by the biometric information acquisition unit, the first authentication reference information being transmitted in response to receiving the first request signal in a state in which the user has been normally authenticated by the terminal device, and the first authentication reference information being reference information for the biometric authentication of the user stored in the terminal device or information based on the reference information.

One aspect is a program for causing a computer constituting a biometric authentication device in an authentication system including a terminal device carried by a user and a biometric authentication device that performs biometric authentication to realize a biometric information acquisition function that acquires biometric information of the user, a communication function that wirelessly communicates with the terminal device, a request control function that transmits a first request signal to the terminal device by the communication function, and a biometric authentication control function that performs the biometric authentication of the user based on first authentication reference information received from the terminal device by the communication function and the biometric information acquired by the biometric information acquisition function, in which the first authentication reference information is transmitted in response to receiving the first request signal in a state in which the user has been normally authenticated by the terminal device, and the first authentication reference information is reference information for the biometric authentication of the user stored in the terminal device or information based on the reference information.

According to the above-described authentication system and authentication method , when biometric authentication of a user of a terminal device is performed by a biometric authentication device, it is possible to reduce the workload of the user and to increase the confidentiality of the biometric information that is the correct answer for the biometric authentication.

FIG. 1 is a diagram showing a schematic configuration example of an authentication system according to an embodiment (first embodiment). FIG. 2 is a diagram illustrating a schematic configuration example of a terminal device according to an embodiment (first embodiment). 1 is a diagram illustrating a schematic configuration example of a biometric authentication device according to an embodiment (first embodiment). FIG. 2 is a diagram illustrating an example of a hardware configuration of an information processing unit according to the embodiment. FIG. 2 is a diagram showing an example of a flow of processing performed in an authentication system according to an embodiment (first embodiment). 11 is a diagram for explaining an example of processing in a case where a plurality of terminal devices are present near the biometric authentication device according to an embodiment (first embodiment). FIG. FIG. 11 is a diagram illustrating a schematic configuration example of a terminal device according to an embodiment (second embodiment). FIG. 11 is a diagram illustrating a schematic configuration example of a biometric authentication device according to an embodiment (second embodiment). FIG. 11 is a diagram showing an example of a flow of processing performed in an authentication system according to an embodiment (second embodiment). FIG. 13 is a diagram showing an example of a flow of processing performed in an authentication system according to an embodiment (third embodiment).

Embodiments of the present disclosure will be described in detail with reference to the drawings.

First Embodiment
A first embodiment will be described.

[Authentication System]
FIG. 1 is a diagram showing a schematic configuration example of an authentication system 1 according to an embodiment (first embodiment).
The authentication system 1 includes a terminal device 11 and a biometric authentication device 12 .
1 also shows a user 21 carrying the terminal device 11. In this embodiment, the user 21 is a human being.

Also shown in FIG.
Here, in this embodiment, the payment system 31 is an external system to the authentication system 1 , but the payment system 31 may be considered to be included in the authentication system 1 .
The payment system 31 may be any system that performs payment, for example, a general-purpose system, or may be configured exclusively for the authentication system 1 according to the present embodiment. As an example, the payment system 31 may be configured to include a POS (Point Of Sales).
In this embodiment, the details of the payment system 31 will not be described in detail.

In this embodiment, dedicated applications are installed in the terminal device 11 and the biometric authentication device 12 .
Specifically, a dedicated application A1 is installed in the terminal device 11, and a dedicated application A2 is installed in the biometric authentication device 12.
Then, the application A1 of the terminal device 11 and the application A2 of the biometric authentication device 12 cooperate with each other to perform processing related to biometric authentication.

In this embodiment, the terminal device 11 and the biometric authentication device 12 are capable of communicating with each other, and the terminal device 11 and the payment system 31 are capable of communicating with each other. Furthermore, a configuration in which the biometric authentication device 12 and the payment system 31 are capable of communicating with each other may be used.
Two or more devices capable of communicating with each other (which may be called systems instead of devices) communicate with each other using, for example, the same communication method.

<Terminal Device>
FIG. 2 is a diagram showing a schematic configuration example of the terminal device 11 according to the embodiment (first embodiment).
The terminal device 11 is configured using, for example, a computer, and a specific example is a smartphone or other portable computer. As the other portable computer, for example, a watch type, a ring type, a card type (e.g., an IC card), etc. may be used.
The terminal device 11 includes an input unit 111 , an output unit 112 , a memory unit 113 , a communication unit 114 , an authentication unit 115 , an external authentication control unit 116 , and a payment control unit 117 .

The input unit 111 inputs information from the outside. The input unit 111 has, for example, an operation unit that accepts an operation performed by the user 21, and inputs information corresponding to the operation accepted by the operation unit.
The operation unit may have a function of accepting operations from a touch panel, or may have a function of accepting operations from physical keys. The operation unit may also have a function of accepting operations by voice (e.g., the voice of the user 21).
Furthermore, the input unit 111 may be connected to an external device and receive information output from the external device.
The external device may be, for example, a portable recording medium.

The output unit 112 outputs information. The output unit 112 has, for example, a display unit, and displays (outputs) information on a screen of the display unit. The screen may have a touch panel function.
Furthermore, the output unit 112 may be connected to an external device and output information to the external device.
The external device may be, for example, a portable recording medium.
The output unit 112 may output information in a form other than a display, such as audio output.
Here, in this embodiment, the input unit 111 and the output unit 112 are shown as separate functional units, but the input unit 111 and the output unit 112 may be configured as a common functional unit (input/output unit).

The storage unit 113 stores information.
In this embodiment, the storage unit 113 stores reference information B1.
The storage unit 113 may also store any other information.

The communication unit 114 has a function of communicating information.
In this embodiment, the communication unit 114 has a function of communicating with the biometric authentication device 12. In addition, when the terminal device 11 is a smartphone or the like, the communication unit 114 has a function of performing wireless communication in a mobile phone system (e.g., wireless communication such as 4G or 5G). In this embodiment, the communication unit 114 has a function of communicating with the biometric authentication device 12 and a function of communicating in the mobile phone system as separate functions, but as another example, a configuration in which communication with the biometric authentication device 12 is performed by utilizing a function of communicating in the mobile phone system may be used.
In this embodiment, the communication unit 114 has a function of performing wireless communication, but may also have a function of performing wired communication, for example.

In this embodiment, the communication unit 114 is shown as a separate functional unit from the input unit 111 and the output unit 112, but the receiving function of the communication unit 114 may be considered to be included in the functions of the input unit 111, and the transmitting function of the communication unit 114 may be considered to be included in the functions of the output unit 112.

The authentication unit 115 authenticates the user 21 in the terminal device 11. That is, the authentication unit 115 authenticates the user 21 to control whether or not to permit use of a predetermined function of the terminal device 11, and permits use by the user 21 if authentication is successful, and restricts (for example, restricts partial or complete use by) the user 21 if authentication is not successful (that is, authentication fails).
In addition, the specified function may be any function in the terminal device 11, for example, all functions other than the functions authenticated by the authentication unit 115, or some of the functions.

Here, the authentication unit 115 may use any method for authentication.
Furthermore, in the authentication by the authentication unit 115, for example, a part or all of the reference information B1 stored in the storage unit 113 may be used, or a part or all of the reference information B1 stored in the storage unit 113 and additional information may be used, or additional information may be used without using the reference information B1 stored in the storage unit 113. Such additional information may be stored, for example, in the same storage unit (the storage unit 113 in this embodiment) as the reference information B1, or may be stored in a different storage unit.

The authentication unit 115 may, for example, perform continuous authentication after the initial authentication.
In this embodiment, the authentication unit 115 initially authenticates the user 21 (initial authentication) and then performs continuous authentication (continuous authentication) to check whether the user 21 continues to use the system.
For the initial authentication, for example, biometric information such as a face or a fingerprint may be used, or non-biometric information such as a number may be used, or both may be used.
For the continuous authentication, for example, biometric information such as face or fingerprint may be used, or information such as the characteristics of the user 21's movements (behavior) may be used, or both may be used. Such continuous authentication is performed, for example, constantly or periodically or irregularly in the background of the terminal device 11, and is not explicitly recognized by the user 21, and it appears to the user 21 that the terminal device 11 is being used normally. By performing such continuous authentication, for example, even if the user 21 leaves the terminal device 11 behind, it is possible to suppress (for example, prevent) the terminal device 11 from being used by others (people other than the user 21). In other words, if the authentication fails when performing continuous authentication, the authentication unit 115 cancels the state in which the terminal device 11 can be used by the user 21, and transitions to a state in which the use by the user 21 is restricted (for example, partially restricted or completely restricted), and then a state in which authentication of the user 21 (for example, initial authentication) is required again.
As a technique for performing such continuous authentication, for example, a personal authentication technique that continuously authenticates a plurality of pieces of biometric information and behavior information in the background while the terminal device 11 is being used may be used.

The external authentication control unit 116 controls authentication in an external device (in this embodiment, the biometric authentication device 12).
In this embodiment, the external authentication control unit 116 controls authentication in the external device on the condition that the user 21 has been successfully authenticated by the authentication unit 115 .
In this embodiment, the external authentication control unit 116 performs control related to biometric authentication of the user 21 in the biometric authentication device 12 .

The external authentication control unit 116 sets the reference information B1 stored in the storage unit 113 or information based on the reference information B1 as reference information for biometric authentication in the biometric authentication device 12 (in this embodiment, for convenience of explanation, this is referred to as first authentication reference information). Then, in response to a predetermined request from the biometric authentication device 12 (in this embodiment, a first request signal), the external authentication control unit 116 transmits the first authentication reference information to the biometric authentication device 12 via the communication unit 114.
Here, the manner in which the external authentication control unit 116 determines what information to use as the first authentication standard information may, for example, be set in advance, or may be set (or updated) by the user 21 or an external device at any timing.

The reference information B1 is any information that serves as a reference for biometric authentication, such as correct answer information in biometric authentication or information that is the basis for obtaining correct answer information in biometric authentication.
In this embodiment, the reference information B1 may be the biometric information of the user 21 (itself), or may be information regarding the biometric information of the user 21 that is capable of deriving correct information in the biometric authentication of the user 21.

In this embodiment, the first authentication reference information is information transmitted from the terminal device 11 to the biometric authentication device 12. For example, the reference information B1 may be transmitted as is as the first authentication reference information, or the reference information B1 may be transmitted after being processed by the terminal device 11.

As an example, the first authentication reference information may be image information that satisfies the required level of authentication. As a specific example, when information on the appearance of a face or the like is used as biometric information, photo (image) information of the face or the like may be used as the first authentication reference information. As a specific example, highly accurate biometric information (e.g., photo information with high-precision pixels) may be stored as reference information B1, and information that satisfies the required level of authentication in the biometric authentication device 12 but is less accurate than the biometric information (e.g., photo information with lower pixel accuracy than reference information B1) may be used as the first authentication reference information.

Here, in this embodiment, if the user 21 is not in a state where the user 21 has been normally authenticated by the authentication unit 115 (in this embodiment, a state where the user 21 has been continuously normally authenticated), the external authentication control unit 116 is prohibited from transmitting the first authentication reference information to the biometric authentication device 12. In other words, in this embodiment, the condition for transmitting the first authentication reference information to the biometric authentication device 12 includes the condition that the user 21 has been normally authenticated by the authentication unit 115 (in this embodiment, the user 21 has been continuously normally authenticated).

The external authentication control unit 116 may detect (determine) by any method whether or not the user 21 is in a state where the user 21 has been successfully authenticated by the authentication unit 115 (in this embodiment, a state where the user 21 has been successfully authenticated continuously).
As an example, the external authentication control unit 116 may inquire of the authentication unit 115 and obtain a response (message) from the authentication unit 115, and based on the response, detect whether the user 21 is in a state where the user 21 has been successfully authenticated by the authentication unit 115 (in this embodiment, a state where the user 21 has been successfully authenticated continuously).
As another example, information such as a flag indicating the result of authentication by the authentication unit 115 (whether or not authentication has been performed successfully) may be stored in a specified memory area (e.g., a memory area such as the memory unit 113), and the external authentication control unit 116 may refer to the information to detect, based on the information, whether or not the user 21 is in a state in which the user 21 has been successfully authenticated by the authentication unit 115 (in this embodiment, a state in which the user 21 has been continuously authenticated successfully).

In this embodiment, the authentication unit 115 performs continuous authentication. However, as another configuration example, the authentication unit 115 may not perform continuous authentication.
In addition, in this embodiment, the authentication unit 115 and the external authentication control unit 116 are described as separate components, but it may be understood that the external authentication control unit 116 includes the functions of the authentication unit 115, for example.
For example, the functions of the external authentication control unit 116 (e.g., one or both of software such as a program and hardware) and the functions of the authentication unit 115 (e.g., one or both of software such as a program and hardware) may be entirely common, or may be entirely separate, or may be partially common.

The payment control unit 117 controls payment.
In this embodiment, the payment control unit 117 performs control related to payments by the payment system 31 (for example, control in the terminal device 11).
In this embodiment, for example, in response to the user 21 operating the operation unit of the terminal device 11 to give a predetermined instruction, control by the payment control unit 117 is started.
As another example, the control by the payment control unit 117 may be started in response to the terminal device 11 receiving predetermined information from another device via the communication unit 114. The other device may be, for example, the payment system 31 or the biometric authentication device 12.

<Biometric authentication device>
FIG. 3 is a diagram showing a schematic configuration example of the biometric authentication device 12 according to an embodiment (first embodiment).
The biometric authentication device 12 is configured using, for example, a computer. The biometric authentication device 12 may be installed in, for example, a predetermined position.
The biometric authentication device 12 includes a biometric information acquisition unit 211 , an operation reception unit 212 , a communication unit 213 , a request control unit 214 , and a biometric authentication control unit 215 .

The biometric information acquisition unit 211 acquires biometric information.
Here, as the biometric information, any biometric information may be used, for example, information on a person's face, a person's iris, a person's veins, a person's fingerprint, etc. In this embodiment, for example, as the biometric information, information including one or more of information on the face of the user 21, information on the iris of the user 21, information on the veins of the user 21, or information on the fingerprint of the user 21 may be used.

Furthermore, the biometric information acquisition unit 211 has, for example, a sensor that detects the biometric information to be acquired, and detects and acquires the biometric information using the sensor.
As a specific example, the biometric information acquisition unit 211 may have one or more of a face sensor that detects facial information, an iris sensor that detects iris information, a vein sensor that detects vein information, or a fingerprint sensor that detects fingerprint information.
The sensor for capturing an image of the object may be configured using, for example, a camera.
Furthermore, two or more types of biological information may be detected by the same sensor.

The sensor of the biometric information acquisition unit 211 is arranged, for example, at a predetermined position, but as another example, the position may be variable.
The specified location may be any location, such as the entrance (e.g., reception), exit, inside, or outside (e.g., parking lot) of a store where the goods or services to be paid for are provided.

The biometric information acquisition unit 211 may be configured to acquire biometric information of only one person at a time, for example.
As a specific example, when the biometric information acquisition unit 211 is configured using a camera, the angle of view of the camera may be large enough to capture the face of a single person when the person is present at a specified position of the biometric authentication device 12.
As a specific example, when the biometric information acquisition unit 211 is configured using a sensor that acquires biometric information such as a finger (e.g., a fingerprint) or a palm, the sensing part of the sensor may be approximately the same size as a human finger or palm.

The operation reception unit 212 has a sensor (operation unit) that receives a predetermined operation.
In this embodiment, the operation unit has a function of accepting operations performed by the user 21 .
The operation unit may be any operation unit, for example, a mechanical or touch panel button.
The operation unit may be, for example, a sensor such as a camera for detecting the action of the user 21, and may receive the content of the operation according to the action of the user 21.

The communication unit 213 has a function of communicating information.
In this embodiment, the communication unit 213 has a function of communicating with the terminal device 11 .
In this embodiment, the communication unit 213 has a function of performing wireless communication, but may also have a function of performing wired communication, for example.

The request control unit 214 controls requests for information for biometric authentication to the terminal device 11 .
The request control unit 214 makes a request for information for biometric authentication in response to, for example, a predetermined operation (in this embodiment, an operation of the operation reception unit 212) being performed manually by the user 21 or in response to a predetermined condition being satisfied. In other words, the request control unit 214 makes the request manually or automatically.

Here, any condition may be used as the condition (predetermined condition), and for example, a condition that the user 21 approaches the vicinity of the biometric authentication device 12 may be used. As a specific example, a sensor that detects the user 21 may be disposed at a predetermined position near the biometric authentication device 12, and when the user 21 is detected by the sensor, it may be determined that the user 21 approaches the vicinity of the biometric authentication device 12.
The sensor may be, for example, a camera or an infrared sensor.

In this embodiment, the request control unit 214 wirelessly transmits a signal requesting information for biometric authentication (for convenience of explanation, in this embodiment, referred to as a first request signal) from the communication unit 213.
As the first request signal, any signal may be used.
The first request signal may be, for example, a signal that can be received by unspecified terminal devices. The signal may be, for example, a signal called a beacon signal or a broadcast signal.

Here, in this embodiment, a case is shown in which the request control unit 214 requests information for biometric authentication from the terminal device 11 in response to the operation receiving unit 212 receiving a specified operation, but as another example, the request control unit 214 may request information for biometric authentication from the terminal device 11 in response to a different trigger.
The other trigger may be, for example, a trigger that predetermined biometric information is acquired by the biometric information acquisition unit 211. The predetermined biometric information may be, for example, information on a person's face. As a specific example, the biometric information acquisition unit 211 may be configured using a camera, and the trigger may be the biometric information acquisition unit 211 detecting that a person's face is captured within the angle of view of the camera.

Note that if there are two or more sensors among the sensor constituting the biometric information acquisition unit 211, the sensor constituting the operation reception unit 212, and the sensor constituting the request control unit 214, any two or more of the sensors may be shared.

The biometric authentication control unit 215 controls the biometric authentication in the biometric authentication device 12 .
In this embodiment, the biometric authentication control unit 215 uses the first authentication reference information received from the terminal device 11, or information based on the first authentication reference information (information processed from the first authentication reference information) as reference information (correct answer information) for biometric authentication in the biometric authentication device 12.

In this embodiment, the authentication algorithm performed by the authentication unit 115 of the terminal device 11 and the authentication (biometric authentication) algorithm performed by the biometric authentication control unit 215 of the biometric authentication device 12 are different, but as another example, these algorithms may be the same.

The biometric authentication control unit 215 also has a function of deleting the first authentication reference information used for the biometric authentication or information based on the first authentication reference information. This information deletion is performed, for example, in a manner such that the corresponding information does not remain in the biometric authentication device 12.
In addition, in the biometric authentication device 12, after receiving the first authentication standard information from the terminal device 11, the first authentication standard information may be stored in one or more memory units (not shown), and information based on the first authentication standard information may be stored in one or more memory units (not shown).

As an example, when the first authentication reference information is used as is for biometric authentication in the biometric authentication device 12, the biometric authentication control unit 215 may erase the first authentication reference information after the biometric authentication so that the first authentication reference information does not remain in the memory unit of the biometric authentication device 12.
As another example, when information based on the first authentication reference information is used for biometric authentication in the biometric authentication device 12, the biometric authentication control unit 215 may erase both the first authentication reference information and the information based on the first authentication reference information after the biometric authentication so that these information do not remain in the memory unit of the biometric authentication device 12.
As another example, when information based on the first authentication reference information is used for biometric authentication in the biometric authentication device 12, the biometric authentication control unit 215 may erase only one of the first authentication reference information or the information based on the first authentication reference information after the biometric authentication.

The biometric authentication control unit 215 has a function of outputting (e.g., notifying by communication) information regarding the result of biometric authentication (normal, failure (abnormal), or both) from the biometric authentication device 12 to an external device. The external device may be, for example, the terminal device 11 of the user 21, or a payment system 31, etc. When the external device is the terminal device 11 of the user 21, the terminal device 11 may request the next process from the external payment system 31, etc. (or prohibit such a request, etc.) based on the result of biometric authentication notified from the biometric authentication device 12.

In this embodiment, the first authentication reference information sent from the terminal device 11 to the biometric authentication device 12, or information based on the first authentication reference information, is not transmitted from the biometric authentication device 12 to any other device (e.g., a server not shown in this embodiment). This enhances the confidentiality of this information.

<Communication between terminal device and biometric authentication device>
The communication method between the terminal device 11 and the biometric authentication device 12 may be any communication method, for example, short-range wireless communication.
Examples of short-distance wireless communication that may be used include a wireless LAN (Local Area Network) such as Wi-Fi, Bluetooth (registered trademark), and Near Field Communication (NFC).
In the communication between the terminal device 11 and the biometric authentication device 12, for example, any encryption may be performed.
The communication between the terminal device 11 and the biometric authentication device 12 may be controlled by, for example, dedicated applications (in this embodiment, application A1 and application A2) installed in the terminal device 11 and the biometric authentication device 12, respectively.

Here, the biometric authentication device 12 may be configured to be capable of wireless communication with devices other than the terminal device 11, for example, or may be configured not to perform wireless communication with devices other than the terminal device 11.

<Hardware configuration of the information processing section>
FIG. 4 is a diagram illustrating an example of a hardware configuration of the information processing unit P1 according to the embodiment.
All or part of the hardware configuration of the information processing unit P1 may be applied to, for example, one or both of the hardware configuration of the terminal device 11 and the hardware configuration of the biometric authentication device 12.

In the example of FIG. 4, the information processing unit P1 includes a processor 2011, an operation unit 2012, a display unit 2013, a storage device 2014, a memory 2015, an input/output interface 2016, a network interface 2017, and a bus 2021 connecting these.
It should be noted that the information processing section P1 does not necessarily have to include all the processing sections shown in FIG. 4, and any processing section not shown in FIG. 4 may be added.

The processor 2011 is composed of a CPU (Central Processing Unit) and the like, and executes a program to perform processing defined by the program.
The operation unit 2012 includes one or more input devices such as a keyboard and a mouse, and receives operations performed by a person or the like.
The display unit 2013 has a screen and displays information on the screen.

The storage device 2014 is a non-volatile storage unit, and is configured, for example, by a hard disk, and stores information.
The memory 2015 is a volatile storage unit, and is configured with a RAM (Random Access Memory) or the like, and temporarily stores information. As the RAM, for example, a DRAM (Dynamic Random Access Memory) may be used.
The storage device 2014 or the memory 2015 may store, for example, information about the programs executed by the processor 2011 and information about various parameters.

The input/output interface 2016 is an interface for connecting to an external recording medium or the like.
The network interface 2017 is an interface for connecting to an external network.

Here, the information processing unit P1 may include one processor as the processor 2011, or may include two or more processors. As an example, the information processing unit P1 may include multiple CPUs, each of which executes a different process, and the multiple CPUs may work together to realize the overall process.

<Example of processing in the authentication system>
FIG. 5 is a diagram showing an example of a flow of processing performed in the authentication system 1 according to the embodiment (first embodiment).
FIG. 5 shows a terminal device 11, a biometric authentication device 12, a user 21, and a payment system 31.

(Process T1)
In the terminal device 11 , the authentication unit 115 starts authenticating the user 21 .
In this example, the authentication unit 115 thereafter continues to authenticate the user 21 .

(Process T21)
In this example, it is assumed that the user 21 moves around carrying the terminal device 11 and that the biometric information of the user 21 is now in a state where it is possible to obtain the biometric information of the user 21 using the biometric authentication device 12 .
In the biometric authentication device 12 , the biometric information acquisition unit 211 acquires the biometric information of the user 21 .

(Process T41)
In this example, it is assumed that the user 21 performs a predetermined operation on the operation unit of the biometric authentication device 12 .

In this example, for ease of explanation, the case where process T41 is performed after process T21 is shown, but as another example, process T21 may be performed after process T41, or process T21 and process T41 may be performed simultaneously (or nearly simultaneously).
Furthermore, the timing relationship (including simultaneous timing) between the process T21 and the process T41 may be configured to be variable depending on the situation at each time (for example, the behavior of the user 21, etc.).

(Process T22)
In the biometric authentication device 12 , the operation receiving unit 212 receives an operation performed by the user 21 .

(Process T23)
In the biometric authentication device 12, in response to a predetermined operation being performed by the user 21, the request control unit 214 wirelessly transmits a first request signal via the communication unit 213.

(Process T2)
The terminal device 11 receives the first request signal via the communication unit 114. Then, in response to receiving the first request signal, the external authentication control unit 116 of the terminal device 11 wirelessly transmits the first authentication reference information to the biometric authentication device 12 via the communication unit 114.

(Process T24)
The biometric authentication device 12 receives the first authentication reference information from the terminal device 11 via the communication unit 213 .
Then, in the biometric authentication device 12, the biometric authentication control unit 215 performs biometric authentication of the user 21 based on the biometric information acquired by the biometric information acquisition unit 211 and the first authentication reference information received from the terminal device 11. As a result, the biometric authentication control unit 215 acquires the result of the biometric authentication (successful or failed).

(Process T25)
In the biometric authentication device 12 , the biometric authentication control unit 215 transmits information on the result of the biometric authentication to the terminal device 11 via the communication unit 213 .

(Process T26)
In the biometric authentication device 12, the biometric authentication control unit 215 erases a part or all of the information used for biometric authentication (in this embodiment, the first authentication reference information or information based thereon).
Incidentally, any timing may be set as the timing for erasing such information.

(Process T3)
In the terminal device 11, the external authentication control unit 116 receives the information transmitted from the biometric authentication device 12 (information relating to the result of the biometric authentication).
If the result of the biometric authentication is normal, the payment control unit 117 of the terminal device 11 wirelessly transmits information related to the payment to the payment system 31 via the communication unit 114.
In addition, if the result of the biometric authentication is a failure (abnormality), the payment control unit 117 may, for example, not perform any processing on the payment system 31, or may send any information to the payment system 31.

In this manner, in this embodiment, when biometric authentication of the user 21 is performed normally by the biometric authentication device 12 (i.e., when the biometric authentication is successful), the payment control unit 117 accesses the payment system 31 to perform payment and controls the payment.

(Process T61)
The payment system 31 performs processing related to payment based on the information received from the terminal device 11 .
In addition, the processing in the payment system 31 may be any processing.

<Example of processing up to biometric authentication in a biometric authentication device>
Here, as an example of the process up to biometric authentication in the biometric authentication device 12, an example of the process related to the part corresponding to (process T21, process T41, process T22, process T23, process T2) shown in FIG. 5 will be described.

As an example, the process of acquiring biometric information of the user 21 by the biometric authentication device 12 (the process corresponding to process T21) and the process of accepting an operation of the user 21 by the biometric authentication device 12 (the process corresponding to process T41 and process T22) may be independent processes. In this case, the order of these processes (e.g., before and after, or simultaneously) may be arbitrary.
Furthermore, in the biometric authentication device 12, the order in which these processes should be performed (here, the relationship between processes before and after) may or may not be determined. In the biometric authentication device 12, when the order in which these processes should be performed (here, the relationship between processes before and after) is determined, these processes are performed in that order. As a specific example, a configuration may be used in which an operation of the user 21 is not accepted until the biometric information of the user 21 has been acquired, or a configuration may be used in which the biometric information of the user 21 is not acquired until the operation of the user 21 has been accepted.

Also, for example, the biometric authentication device 12 may be configured to acquire biometric information of the user 21 by the biometric information acquisition unit 211 when the operation acceptance unit 212 accepts that the user 21 has performed a predetermined operation (for example, operations corresponding to processes T41 and T22).
As a specific example, when the sensor of the biometric information acquisition unit 211 is a camera, when the user 21 comes to a position where it is captured in the angle of view of the camera and performs a predetermined operation (e.g., pressing a button, etc.), the biometric information acquisition unit 211 may acquire information on an image of the user 21. In this case, the image of the user 21 may be, for example, an image of the face of the user 21, an image of the eyes of the user 21, or an image of the fingers of the user 21, or an image of any part of the body of the user 21.
As a specific example, if the sensor of the biometric information acquisition unit 211 is a fingerprint sensor or the like, a configuration may be used in which, when the user 21 places (or holds) a predetermined part of the body (e.g., a finger) over the sensor and performs a predetermined operation (e.g., pressing a button), the biometric information acquisition unit 211 acquires information such as the fingerprint of the user 21.

In addition, as a process for accepting an operation of the user 21 by the biometric authentication device 12 (a process corresponding to process T41 and process T22), for example, a process for determining that a specific operation has been accepted when a specific movement of the body of the user 21 is detected by a camera or the like may be used. In other words, instead of a hardware operation in which the user 21 presses a button with his/her finger, a configuration may be used in which the movement of the user 21 (for example, specific information obtained from an image) is accepted as the content of the operation in a software manner.

As another example, the process of acquiring biometric information of the user 21 by the biometric authentication device 12 (processing corresponding to process T21) and the process of accepting an operation of the user 21 by the biometric authentication device 12 (processing corresponding to process T41 and process T22) may be a common process. In other words, the acquisition of the biometric information of the user 21 by the biometric authentication device 12 may be regarded as acceptance of an operation of the user 21, and it may be determined that the operation has been accepted. In such a configuration, for example, the function of the biometric information acquisition unit 211 and the function of the operation acceptance unit 212 may be integrated.

As a specific example, if the sensor of the biometric information acquisition unit 211 is a camera, in the biometric authentication device 12, when the user 21 comes to a position where it is captured in the angle of view of the camera and an image of a specific part of the user 21's body (e.g., the face) is detected, the biometric information acquisition unit 211 acquires biometric information of the specific part (biometric information based on the image), and the operation receiving unit 212 accepts that a specific operation has been performed.
As a specific example, if the sensor of the biometric information acquisition unit 211 is a fingerprint sensor or the like, when the biometric authentication device 12 detects that the user 21 has placed (or held) a specific part of the body (e.g., a finger) over the sensor, the biometric information acquisition unit 211 may acquire the biometric information of the specific part, and the operation receiving unit 212 may accept that a specific operation has been performed.

In the biometric authentication device 12, the request control unit 214 may, for example, transmit the first request signal only once when a predetermined trigger occurs (in this embodiment, when a predetermined operation is received), or may transmit the first request signal a predetermined number of times, such as two or more times, at a predetermined timing such as a fixed time interval, or may transmit the first request signal at a predetermined timing such as a fixed time interval for a predetermined period of time. The predetermined period may, for example, be a period determined in advance as a certain period of time, or may be a period during which a state in which the biometric information of the user 21 can be acquired by the sensor of the biometric information acquisition unit 211 (for example, a state in which a predetermined part of the body of the user 21 is present in a position where the biometric information of the user 21 can be detected by the sensor) continues.

In the terminal device 11, any aspect may be used as the timing of receiving the first request signal from the biometric authentication device 12 by the external authentication control unit 116 and the timing of checking by the external authentication control unit 116 whether the authentication result by the authentication unit 115 (in this embodiment, the result of continuous authentication) is normal.
As an example, in the terminal device 11, after receiving a first request signal from the biometric authentication device 12, the external authentication control unit 116 may check (determine) whether the authentication result by the authentication unit 115 (in this embodiment, the result of continuous authentication) is normal or not.
As another example, in the terminal device 11, the external authentication control unit 116 constantly (here, for example, at a predetermined regular timing) checks (determines) whether the authentication result by the authentication unit 115 (in this embodiment, the result of continuous authentication) is normal, and when a first request signal is received from the biometric authentication device 12, it may decide whether or not to allow the first authentication standard information to be transmitted to the biometric authentication device 12 based on the result of the most recent check (determination) of whether the authentication result by the authentication unit 115 (in this embodiment, the result of continuous authentication) is normal.

Here, in this embodiment, a configuration example is shown in which the first request signal from the biometric authentication device 12 is received by the communication unit 114 and notified to the external authentication control unit 116 in the terminal device 11, regardless of whether the authentication result by the authentication unit 115 (in this embodiment, the result of continuous authentication) is normal or not. However, as another configuration example, when the authentication result by the authentication unit 115 (in this embodiment, the result of continuous authentication) is abnormal (not normal), a configuration in which the first request signal from the biometric authentication device 12 is not received by the communication unit 114 (i.e., a configuration in which the corresponding communication function of the communication unit 114 is turned off) may be used, or when the authentication result by the authentication unit 115 (in this embodiment, the result of continuous authentication) is abnormal (not normal), a configuration in which the first request signal from the biometric authentication device 12 is received by the communication unit 114 but is not notified to the external authentication control unit 116 may be used.

<Example of a case where multiple terminal devices are present near a biometric authentication device>
FIG. 6 is a diagram for explaining an example of processing when a plurality of terminal devices are present near the biometric authentication device 12 according to an embodiment (first embodiment).
FIG. 6 shows a terminal device 11, a biometric authentication device 12, and a user 21, as well as n terminal devices 311-1 to 311-n (n is an integer equal to or greater than 1) and n users 321-1 to 321-n.

Here, each of users 321-1 to 321-n carries a respective terminal device 311-1 to 311-n.
In the example of Figure 6, n is shown to be 2 or more, but n may also be 1, in which case n terminal devices 311-1 to 311-n and n users 321-1 to 321-n correspond to one terminal device 311-1 and one user 321-1.

6, a case where a plurality of terminal devices 11, 311-1 to 311-n are present near the biometric authentication device 12 is shown.
In this example, a first request signal wirelessly transmitted from the biometric authentication device 12 is received by each of the multiple terminal devices 11, 311-1 to 311-n.
For this reason, each of the multiple terminal devices 11, 311-1 to 311-n wirelessly transmits its own first authentication reference information to the biometric authentication device 12. The biometric authentication device 12 receives the multiple pieces of first authentication reference information.

Here, for example, the terminal devices 11, 311-1 to 311-n present within the range of a first request signal (wireless signal) from the biometric authentication device 12 receive the first request signal and transmit first authentication reference information.
For example, the first request signal may be a signal common to the multiple terminal devices 11, 311-1 to 311-n, and may be a beacon signal in any wireless system, as a specific example. In this case, the multiple terminal devices 11, 311-1 to 311-n transmit authentication reference information (in this embodiment, first authentication reference information) to the biometric authentication device 12. In the biometric authentication device 12, the biometric authentication control unit 215, for example, attempts biometric authentication for each of the multiple pieces of authentication reference information (in this embodiment, first authentication reference information), and when authentication is successful for one of the pieces of authentication reference information, determines that the biometric authentication is successful (i.e., the biometric authentication is successful).

In this example, it is assumed that the biometric authentication device 12 has acquired biometric information of one user 21 and performs biometric authentication on the biometric information.
In this case, in the biometric authentication device 12, the biometric authentication control unit 215 authenticates each of the multiple first authentication standard information received from the multiple terminal devices 11, 311-1 to 311-n to determine whether it matches the biometric information (biometric information of one user 21).

When authenticating whether each of the multiple pieces of first authentication reference information received from the multiple terminal devices 11, 311-1 to 311-n matches the biometric information, the order in which the multiple pieces of first authentication reference information are processed (the order in which authentication is performed) is not particularly limited, and any order may be used. As an example, in the biometric authentication device 12, the biometric authentication control unit 215 may process the multiple pieces of first authentication reference information (the authentication process) in the order in which they were received.

In this example, when the first authentication reference information received from the terminal device 11 of the user 21 is used for the biometric information of the user 21, authentication is successful, whereas when the first authentication reference information received from the other terminal devices 311-1 to 311-n is used, authentication fails.
In addition, in the biometric authentication device 12, if a normal authentication result is obtained during the authentication process for each of the multiple first authentication reference information received from the multiple terminal devices 11, 311-1 to 311-n, the biometric authentication control unit 215 does not need to perform authentication processing for the subsequent first authentication reference information.

Here, in this embodiment, when the biometric authentication control unit 215 in the biometric authentication device 12 receives first authentication reference information from two or more terminal devices (in this example, two or more of the multiple terminal devices 11, 311-1 to 311-n), authentication is performed for each of them. However, as another configuration example, when the biometric authentication control unit 215 in the biometric authentication device 12 receives first authentication reference information from two or more terminal devices (in this example, two or more of the multiple terminal devices 11, 311-1 to 311-n), authentication is not performed for any of the terminal devices. In other words, in this configuration, the biometric authentication control unit 215 performs authentication only when it receives first authentication reference information from only one terminal device (in this example, one of the multiple terminal devices 11, 311-1 to 311-n). In this configuration, when the biometric authentication control unit 215 receives first authentication reference information from a corresponding terminal device (terminal device 11 in this embodiment), a normal authentication result is obtained, but when the biometric authentication control unit 215 receives first authentication reference information from an inapplicable terminal device (terminal devices 311-1 to 311-n in this embodiment), authentication fails.

As another example of the configuration, the biometric authentication control unit 215 in the biometric authentication device 12 may be configured not to authenticate any of the terminal devices when it receives the first authentication reference information from a number of terminal devices that exceeds a predetermined value, which is two or more. In this configuration, when the biometric authentication control unit 215 receives the first authentication reference information from a number of terminal devices that is equal to or less than the predetermined value, it performs authentication for the first authentication reference information.

As described above, in the authentication system 1 according to this embodiment, when biometric authentication of the user 21 of the terminal device 11 is performed by the biometric authentication device 12, it is possible to reduce the workload of the user 21 and to increase the confidentiality of the biometric information that is the correct answer for the biometric authentication.
In this embodiment, it is possible to provide a mechanism that enables multi-factor, multi-step authentication using biometric authentication to be more smoothly realized.

In the authentication system 1 according to this embodiment, for example, even when the user 21 has the terminal device 11 stored in a bag or pocket, biometric authentication can be performed using the biometric authentication device 12, thereby reducing the effort required of the user 21 (ideally eliminating the effort).
In the authentication system 1 according to this embodiment, for example, biometric information that is the correct answer for biometric authentication by the biometric authentication device 12 (in this embodiment, reference information B1 or information based on the reference information B1) is stored in the terminal device 11, and the biometric information can be temporarily stored in the biometric authentication device 12 during biometric authentication but is not stored in the biometric authentication device 12 at other times, thereby further increasing the confidentiality of the biometric information.

[Description of the Background Art and Examples of Effects of the Embodiments on the Background Art]
As background technology, two-factor authentication and multimodal authentication using biometric authentication will be described. Then, in consideration of the background technology, examples of effects of the embodiment will be described.
In this embodiment, for convenience of explanation, the names terminal device and biometric authentication device are used, but for example, a biometric authentication device may also be considered as a type of terminal (that is, a terminal that performs biometric authentication).
Furthermore, the biometric authentication device may be called, for example, a biometric authentication machine or a biometric authentication device.

Biometric authentication uses biometric information to identify an individual, so it requires matching with a database of biometric information.
In order to clarify the difference between the background art and this embodiment, biometric authentication is classified as follows into <Classification 1a>, <Classification 1b>, <Classification 2>, and <Classification 3> depending on the storage location of the database used for matching.

<Class 1a> An example of authentication on a terminal shared by multiple users (a case where a database is stored on the terminal)
Authentication is performed against a database stored in a dedicated device (biometric authentication machine) for biometric authentication.
When a user passes their biometric information to the biometric authentication device, 1:multiple (N) authentication is performed with the database stored in the biometric authentication device.
Two-factor authentication can be achieved by providing information known only to the individual (eg, a passcode) along with the biometric information, or multi-modal authentication can be achieved by using multiple pieces of biometric information.

<Advantages of Classification 1a>
In this classification, for example, authentication is performed within the biometric authentication device, so the authentication speed is fast.
In this classification, for example, a dedicated authentication device is used, so authentication accuracy is high.
In this classification, for example, if the biometric authentication device can be physically managed, the biometric information can be managed.
This classification has high fault tolerance, for example, because authentication can be performed without going through a network.
<Notes for Classification 1a>
In this classification, for example, there is an upper limit to the capacity of the database that can be stored in the biometric authentication device. In this classification, for example, it cannot be used by an unspecified number of people.
In this classification, for example, sensitive biometric information of the user needs to be entrusted to an external party. In this classification, for example, biometric information needs to be registered for each service used.
In this classification, for example, in order to realize two-factor authentication, it may be necessary to input non-biometric information, which may reduce the convenience of biometric authentication.
In this classification, for example, to realize multimodal authentication, multiple authentication devices are required and the user needs to provide multiple pieces of biometric information.

<Category 1b> Other examples of authentication on a terminal shared by multiple users (cases where the database is not stored on the terminal)
Facial feature points extracted from a facial photograph are written into a two-dimensional code (e.g., a QR code (registered trademark)).
The two-dimensional code is held up to a biometric authentication device, and one-to-one authentication is performed with the person who holds the code.
Two-factor authentication is achieved by possessing the issued two-dimensional code and biometric information.

<Advantages of Classification 1b>
In this classification, for example, the user's biometric information is not stored externally.
<Notes for Classification 1b>
In this classification, for example, in order to generate a two-dimensional code, it is necessary to transmit the user's biometric information to an external device once.
In this classification, for example, a device that can read a two-dimensional code is required for authentication.
In this classification, for example, authentication may take time because the code held up during authentication is read and feature points are extracted.

<Category 2> Authentication on a device used by a specific individual A device such as a smartphone that is capable of biometric authentication using fingerprints or face is used.
The user's biometric information is stored on the device, and one-to-one authentication is performed with the biometric information when making payments and other transactions using a designated app.
Two-factor authentication will be realized by possessing a device such as a smartphone and biometric information.

<Advantages of Category 2>
In this classification, for example, authentication is performed within the terminal, so authentication speed is fast.
In this classification, for example, the user's biometric information is not stored externally.
This classification has high fault tolerance, for example, because authentication can be performed without going through a network.
<Notes for Classification 2>
In this classification, for example, since the terminal is not dedicated to biometric authentication and security is taken into consideration, erroneous authentication due to refusal by the person in question is likely to occur.
In this classification, for example, there may be cases where the user needs to keep the target app running when making payments or other such use.

<Category 3> Authentication on the server The database is managed on a server to which devices, including biometric authentication machines, can be connected.
Information (user's biometric information), such as facial images captured using a biometric authentication device or smartphone, is sent to a server, and 1:multiple (N) authentication is performed with a database.
Two-factor authentication can be achieved by providing information known only to the individual (eg, a passcode) along with the biometric information, or multi-modal authentication can be achieved by using multiple pieces of biometric information.

<Advantages of Category 3>
This classification, for example, does not require a dedicated biometric authentication machine, so it is easy to use if a server is already in place.
<Notes for Category 3>
In this classification, for example, sensitive biometric information of users needs to be entrusted to an external party.
In this classification, for example, if the stored database is huge, the matching process requires a considerable number of servers with a high level of performance.
In this classification, for example, biometric information needs to be registered for each service used.
In this classification, for example, to realize two-factor authentication, it is necessary to input non-biometric information, which reduces the convenience of biometric authentication.
In this classification, for example, to realize multimodal authentication, multiple authentication devices are required and the user needs to provide multiple pieces of biometric information.

<Examples of Effects of the Present Invention Compared to the Background Art>
Due to the nature of biometric authentication, 100% authentication accuracy cannot be expected.
For this reason, when using biometric authentication in important situations such as payments, two-factor authentication or multimodal authentication is required.
Two-factor authentication, for example, uses a combination of what you know, what you have, and your biometrics.
Multimodal authentication uses a combination of multiple biometric features, such as facial and fingerprint information.
However, when two-factor authentication is used, the convenience of biometric authentication can be lost, and when multimodal authentication is used, psychological hurdles can arise due to the need to provide multiple pieces of biometric information.
In response to the problems of the background art, the present embodiment can provide a mechanism that enables multi-factor, multi-step authentication using biometric authentication to be more smoothly realized.

The authentication system 1 according to this embodiment includes, for example, the following <constituent element A> to <constituent element D>.
<Component A> The program of this embodiment downloaded to a device carried by an individual (terminal device 11 such as a smartphone) performs individual-specific authentication (e.g., multi-modal), and then continues to maintain the state in which authentication has been performed in the background while retaining the information to be handed over to the outside (in this embodiment, while retaining the reference information B1 that is the basis of the first authentication reference information).
<Component B> When a connection is established in cooperation with a mobile device (in this embodiment, the terminal device 11) based on a request from an external authentication device (in this embodiment, the biometric authentication device 12), the image or binary data including the data for external authentication (biometric information) held by the above program is transferred to the external authentication device in an encrypted or unencrypted state.
<Component C> By performing authentication (for example, one-to-one authentication or one-to-many authentication) using different authentication algorithms possessed by external authentication devices, the whole authentication is completed with at least two or more factors.
<Component D> After the entire authentication is completed, permission is given for the next action.

The configuration according to one example of this embodiment is, for example, a combination of configurations that have the advantages of the above-mentioned <Class 1a> and <Class 2>, and while enjoying the advantages of both, it solves the problems that each of them has.
For example, the above <Component A> can eliminate the need for a user according to <Category 1a> to entrust sensitive biometric information to an external party, and can eliminate the need for multiple authentication machines and the need for a user to provide multiple pieces of biometric information in order to realize multimodal authentication according to <Category 1a>.
For example, the above-mentioned <Component B> can eliminate the need to keep the target app running when making payments related to <Category 2>.
For example, the above <Component C> can resolve the problem that the biometric authentication device according to <Category 1a> has an upper limit on the capacity of the database that can be stored therein and cannot be used by an unspecified number of people; it can resolve the problem that the sensitive biometric information of the user according to <Category 1a> needs to be entrusted to an external device (outside the terminal device 11 in this embodiment); it can resolve the problem that the input of information other than biometric information is required to realize the two-factor authentication according to <Category 1a>, which reduces the convenience of the biometric authentication; it can resolve the problem that the multi-modal authentication according to <Category 1a> requires multiple authentication devices and the user needs to provide multiple pieces of biometric information; and it can resolve the problem that erroneous authentication is likely to occur due to refusal by the person in question, since the terminal is not dedicated to biometric authentication and safety is taken into consideration, according to <Category 2>.
For example, the above-mentioned <Component D> can eliminate the need to register biometric information for each service related to <Category 1a> that is used, and can eliminate the need to keep the relevant app running when using a payment service related to <Category 2>.

In addition, in the configuration according to this embodiment, for example, with regard to the advantages of category 1a, it is possible to enjoy the advantages of fast authentication speed since authentication is performed within the biometric authentication machine, high authentication accuracy since a dedicated authentication machine is used, and the advantage of being able to manage biometric information if the biometric authentication machine can be physically managed.
In addition, in the configuration according to this embodiment, for example, in relation to the merits of category 2, since authentication is performed within the terminal, it is possible to enjoy the merits of fast authentication speed and the merits that the user's biometric information is not stored externally (outside the terminal device 11 in this embodiment).

For example, in the background art, a user needs to take out a terminal device such as a smartphone, operate the terminal device to perform identity authentication (unlock the terminal device), operate the terminal device to search for a payment app, hold the terminal device over a reader (e.g., a code reader), operate the terminal device to make a payment with the payment app, and put away the terminal device. Therefore, one or both hands of the user are occupied until the entire payment process is completed. Also, there are cases where a third party can make a payment if they have a terminal device such as a smartphone and a passcode.
In contrast to this, in the present embodiment, for example, it is possible to reduce the effort required by the user until the completion of the entire payment process, and it is possible to improve security.

The effects of the embodiments with respect to the background art described above are merely examples, and all of the effects do not necessarily have to be realized in the authentication system 1 according to the embodiment.
In other words, the configuration of the authentication system 1 according to the present embodiment is not necessarily limited to the effects according to the examples described above, and may have various configurations.

Second Embodiment
A second embodiment will be described.

The authentication system of this embodiment differs from the authentication system 1 of the first embodiment in that a biometric authentication device, rather than a terminal device, communicates with the payment system, but is otherwise similar.
Therefore, in this embodiment, the differences from the first embodiment will be described in detail, and a detailed description of the similarities will be omitted.
In addition, in this embodiment, for convenience of explanation, components similar to those in the first embodiment will be described by using the same reference numerals.

[Authentication System]
The authentication system according to this embodiment generally includes a terminal device 511 shown in FIG. 7 and a biometric authentication device 512 shown in FIG.
In this embodiment, for the sake of convenience, the user 21 who operates the terminal device 511 and the payment system 31 are denoted by the same reference numerals as in the first embodiment.

In this embodiment, the terminal device 511 and the biometric authentication device 512 are capable of communicating with each other, and the biometric authentication device 512 and the payment system 31 are capable of communicating with each other. Furthermore, a configuration in which the terminal device 511 and the payment system 31 are capable of communicating with each other may be used.
Two or more devices capable of communicating with each other (which may be called systems instead of devices) communicate with each other using, for example, the same communication method.

<Terminal Device>
FIG. 7 is a diagram showing a schematic configuration example of a terminal device 511 according to the embodiment (second embodiment).
The terminal device 511 includes an input unit 611 , an output unit 612 , a storage unit 613 , a communication unit 614 , an authentication unit 615 , and an external authentication control unit 616 .
The storage unit 613 stores the reference information B11.

Here, the configuration of terminal device 511 is roughly different from the configuration of terminal device 11 shown in FIG. 2 of the first embodiment in that it does not have the functions of a payment control unit (payment control unit 117 shown in FIG. 2), but is similar in other respects.
Therefore, in the following, only the points that are different from the first embodiment will be described in detail, and a detailed description of the similar points will be omitted.

In the terminal device 511, the functions of the input unit 611, the output unit 612, the memory unit 613, the communication unit 614, the authentication unit 615, and the external authentication control unit 616 are similar to the functions of the input unit 111, the output unit 112, the memory unit 113, the communication unit 114, the authentication unit 115, and the external authentication control unit 116 in the terminal device 11 according to the first embodiment, respectively.
Moreover, the reference information B11 stored in the terminal device 511 is similar to the reference information B1 stored in the storage unit 113 in the terminal device 11 according to the first embodiment.

<Biometric authentication device>
FIG. 8 is a diagram illustrating an example of a schematic configuration of a biometric authentication device according to an embodiment (second embodiment).
The biometric authentication device 512 includes a biometric information acquisition unit 711 , an operation reception unit 712 , a communication unit 713 , a request control unit 714 , a biometric authentication control unit 715 , and a payment control unit 716 .

Here, the configuration of the biometric authentication device 512 is roughly different from the configuration of the biometric authentication device 12 shown in FIG. 3 of the first embodiment in that it has the functions of a payment control unit (payment control unit 716 shown in FIG. 8 ), but is similar in other respects.
Therefore, in the following, only the points that are different from the first embodiment will be described in detail, and a detailed description of the similar points will be omitted.

In the biometric authentication device 512, the functions of the biometric information acquisition unit 711, the operation acceptance unit 712, the communication unit 713, the request control unit 714, and the biometric authentication control unit 715 are similar to the functions of the biometric information acquisition unit 211, the operation acceptance unit 212, the communication unit 213, the request control unit 214, and the biometric authentication control unit 215 in the biometric authentication device 12 according to the first embodiment, respectively.

The payment control unit 716 in the biometric authentication device 512 controls payment.
In this embodiment, the payment control unit 716 performs control related to payments by the payment system 31 (for example, control of the biometric authentication device 512).

<Example of processing in the authentication system>
FIG. 9 is a diagram showing an example of a flow of processing performed in an authentication system according to an embodiment (second embodiment).
FIG. 9 shows a terminal device 511, a biometric authentication device 512, a user 21, and a payment system 31.

Here, the process flow shown in FIG. 9 is roughly different from the process flow shown in FIG. 5 relating to the first embodiment in that the biometric authentication device 512 (rather than the terminal device 511) controls payment, but is otherwise similar.
Processes T101 to T102, processes T121 to T125, process T141, and process T161 shown in FIG. 9 are similar to processes T1 to T2, processes T21 to T25, process T41, and process T61 shown in FIG. 5 according to the first embodiment, respectively.

(Process T126)
In the biometric authentication device 512, if the result of the biometric authentication is normal, the payment control unit 716 wirelessly transmits information regarding the payment to the payment system 31 via the communication unit 713.
In addition, if the result of the biometric authentication is unsuccessful (abnormal), the payment control unit 716 may, for example, not perform any processing on the payment system 31, or may send any information to the payment system 31.
Thus, in this embodiment, when biometric authentication of the user 21 is performed successfully by the biometric authentication device 512 (i.e., when the biometric authentication is successful), the payment control unit 716 accesses the payment system 31 and controls the payment.

(Process T127)
In the biometric authentication device 12, the biometric authentication control unit 215 erases a part or all of the information used for biometric authentication (in this embodiment, the first authentication reference information or information based thereon).
Incidentally, any timing may be set as the timing for erasing such information.

(Process T161)
The payment system 31 performs processing related to payment based on the information received from the biometric authentication device 512 .
In addition, the processing in the payment system 31 may be any processing.

As described above, in the authentication system according to this embodiment, when biometric authentication of the user 21 of the terminal device 511 is performed by the biometric authentication device 512, it is possible to reduce the workload of the user 21 and to increase the confidentiality of the biometric information that is the correct answer for the biometric authentication.
In this embodiment, for example, except for the difference from the first embodiment (the device that accesses the payment system 31 is different), it is possible to obtain the same effects as in the first embodiment.

As another example, a configuration in which a function such as a payment control unit is provided in both the terminal device 511 and the biometric authentication device 512 may be used.
As an example, a configuration may be used in which functions such as a payment control unit are distributed to both the terminal device 511 and the biometric authentication device 512.

Third Embodiment
A third embodiment will be described.
In this embodiment, a specific example in which the authentication system 1 according to the first embodiment is used will be described.

[Authentication System]
FIG. 10 is a diagram showing an example of a flow of processing performed in an authentication system 1001 according to an embodiment (third embodiment).
The authentication system 1001 includes a terminal device 1011 and a biometric authentication device 1012 .
Also shown in FIG. 10 is a user 1021 of the terminal device 1011 .
FIG. 10 also shows a code reader-equivalent device 1211, a cash register 1212, and a code settlement device 1213.

Here, broadly speaking, the terminal device 1011 has functions similar to those of the terminal device 11 according to the first embodiment, and the biometric authentication device 1012 has functions similar to those of the biometric authentication device 12 according to the first embodiment.
10, the payment system includes a code reader-equivalent device 1211, a cash register 1212, and a code payment device 1213. Note that, for example, one or both of the code reader-equivalent device 1211 and the cash register 1212 may be considered to be external devices to the payment system.

The terminal device 1011 generally has an authentication application function unit 1111 which is a functional unit realized by an authentication application, and a payment application function unit 1112 which is a functional unit realized by a payment application.
In this embodiment, the authentication app is a dedicated application installed in the terminal device 1011, and in this embodiment, performs various processes in cooperation with a dedicated application (not shown in Figure 10) installed in the biometric authentication device 1012.
Furthermore, the payment application may be any application related to payment, for example, a general-purpose application.

In this embodiment, the code reader-equivalent device 1211 is, for example, a device having functions similar to those of a conventional code reader, but may be any device as long as it can work in cooperation with the payment application function unit 1112 of the terminal device 1011 to realize payment-related processing.
For example, a device that reads information other than the code may be used at the place of the code reader-equivalent device 1211. In this case, predetermined information other than the code may be sent from the payment application function unit 1112 of the terminal device 1011 to the device (the device at the place of the code reader-equivalent device 1211), and the information may be read by the device. The device may be called by any name.

Referring to FIG. 10, an example of the flow of processing performed in the authentication system 1001 is shown.
This example shows an example of the processing flow for biometric authentication payment using code payment.
In this example, the code for payment is a predetermined one-dimensional or two-dimensional code, but any code may be used.

(Step S1)
When the user 1021 purchases an item, the price code of the purchased item is read at the cash register 1212 and the total amount is determined.
Here, user 1021 selects "code payment" as the payment method.
In this example, the price code is a code that indicates the price of each product, and is different from the code used for payment.

(Step S2)
The user 1021 instructs the biometric authentication device 1012 to start authentication by tapping a predetermined portion of the biometric authentication device 1012 (for example, a mechanical or touch panel button).
In this example, it is assumed that the location where the biometric authentication device 1012 is installed is close to the location where the cash register 1212 is installed. For example, the biometric authentication device 1012 and the cash register 1212 may be integrated together.

(Step S3)
The biometric authentication device 1012 wirelessly transmits a first request signal to the terminal device 1011 using a dedicated application installed in the biometric authentication device 1012 .

(Step S4)
When the terminal device 1011 recognizes the first request signal received from the biometric authentication device 1012 using the authentication application function unit 1111, the terminal device 1011 wirelessly transmits biometric information of the user 1021 to the biometric authentication device 1012 using the authentication application function unit 1111.
It is assumed here that the user 1021 continues to be properly authenticated at the terminal device 1011.

In this example, the biometric information is, for example, face information of the user 1021 .
The biometric authentication device 1012 uses a dedicated app installed on the biometric authentication device 1012 to perform biometric authentication on the facial information of the user 1021, for example, by comparing the facial information of the user 1021 acquired by a camera with the facial information received from the terminal device 1011.
In this example, it is assumed that the biometric authentication is successful as a result of the biometric authentication. In this case, the biometric authentication device 1012 uses a dedicated app installed in the biometric authentication device 1012 to wirelessly notify the terminal device 1011 that the biometric authentication is successful.

(Step S5)
When the terminal device 1011 receives from the biometric authentication device 1012 that the biometric authentication was normal, the authentication application function unit 1111 gives an instruction regarding payment to the payment application function unit 1112.

(Step S6)
The terminal device 1011 wirelessly transmits information equivalent to the settlement code information (settlement code information) to the code reader equivalent device 1211 via the payment application function unit 1112 (note that it is also possible to hold up an image of the code equivalent to the information).

(Step S7)
The code reader equivalent device 1211 reads the settlement code information received from the terminal device 1011 and transmits the read result information to the cash register 1212 .

(Step S8)
The cash register 1212 transmits the settlement code information received from the code reader equivalent device 1211, information about the store in which the cash register 1212 is installed (store information), and information about the amount of the purchased items to the code settlement device 1213.

(Step S9)
The payment application function unit 1112 notifies the code payment device 1213 about the payment.
Note that the notification may be made at another timing, for example, at any timing after the processing of step S5.

(Step S10)
The code payment device 1213 executes a predetermined code payment process and notifies the cash register 1212 of the payment.

In addition, the function of payment application function unit 1112 in terminal device 1011 may be set arbitrarily depending on, for example, the payment system to be applied.
In addition, in the example of Fig. 10, the case where the authentication system 1 according to the first embodiment is applied to the configuration example of Fig. 10 is shown, but as another example, the authentication system 501 according to the second embodiment may be applied to the configuration example as shown in Fig. 10. In this case, a functional unit that performs payment, such as the payment application functional unit 1112, is provided in the biometric authentication device 1012 instead of the terminal device 1011.
As another example, an authentication system in which both the terminal device 1011 and the biometric authentication device 1012 are provided with a function for performing processing related to payment may be applied to the configuration example shown in FIG.

As described above, in the authentication system 1001 according to this embodiment, when biometric authentication of a user 1021 of a terminal device 1011 is performed by the biometric authentication device 1012, it is possible to reduce the workload of the user 21 and to increase the confidentiality of the biometric information that is the correct answer for the biometric authentication.
In this embodiment, for example, the same effects as those in the first embodiment can be obtained.
As a modified example of this embodiment, it is also possible to configure the biometric authentication device 1012 to access the code reader-equivalent device 1211 instead of the terminal device 1011, as in the second embodiment. In this case, for example, the same effect as in the second embodiment can be obtained.
As another configuration example, a configuration in which both the terminal device 1011 and the biometric authentication device 1012 can access the payment system may be used.

(Regarding the above embodiment)
A program for implementing the functions of any component in any device may be recorded in a computer-readable recording medium, and the program may be read and executed by a computer system. The term "computer system" as used herein includes an operating system (OS) or hardware such as peripheral devices. The term "computer-readable recording medium" refers to portable media such as flexible disks, optical magnetic disks, ROMs, and compact disc (CD)-ROMs, and storage devices such as hard disks built into computer systems. The term "computer-readable recording medium" also refers to storage devices that hold a program for a certain period of time, such as volatile memory (RAM) inside a computer system that becomes a server or client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. The recording medium may be, for example, a non-transitory recording medium.

The above program may be transmitted from a computer system in which the program is stored in a storage device or the like to another computer system via a transmission medium, or by transmission waves in the transmission medium. Here, the "transmission medium" that transmits the program refers to a medium that has a function of transmitting information, such as a network such as the Internet or a communication line such as a telephone line.
The above program may be for implementing some of the above functions. Furthermore, the above program may be a so-called differential file that can implement the above functions in combination with a program already recorded in the computer system. The differential file may be called a differential program.

In addition, the function of any component in any device may be realized by a processor. For example, each process in this embodiment may be realized by a processor that operates based on information such as a program and a computer-readable recording medium that stores information such as a program. Here, the functions of each part of the processor may be realized by individual hardware, or the functions of each part may be realized by integrated hardware. For example, the processor may include hardware, and the hardware may include at least one of a circuit that processes digital signals and a circuit that processes analog signals. For example, the processor may be configured using one or more circuit devices mounted on a circuit board, or one or both of one or more circuit elements. An IC (Integrated Circuit) or the like may be used as the circuit device, and a resistor or a capacitor may be used as the circuit element.

Here, the processor may be, for example, a CPU. However, the processor is not limited to a CPU, and various processors such as a GPU (Graphics Processing Unit) or a DSP (Digital Signal Processor) may be used. The processor may be, for example, a hardware circuit using an ASIC (Application Specific Integrated Circuit). The processor may be, for example, a plurality of CPUs, or a hardware circuit using a plurality of ASICs. The processor may be, for example, a combination of a plurality of CPUs and a hardware circuit using a plurality of ASICs. The processor may include, for example, one or more of an amplifier circuit or a filter circuit that processes an analog signal.

Note that although the present disclosure has been described using embodiments, the technical scope of the present disclosure is not limited to the above-described embodiments. It will be apparent to those skilled in the art that various modifications and alternative embodiments can be made without departing from the spirit and scope of the present disclosure.

[Additional Notes]
[Configuration Example 1] to [Configuration Example 15] are shown.

[Configuration Example 1]
An authentication system including a terminal device carried by a user and a biometric authentication device that performs biometric authentication,
The terminal device
a terminal storage unit that stores reference information for the biometric authentication of the user;
A terminal authentication unit that authenticates the user;
a terminal communication unit that wirelessly communicates with the biometric authentication device;
an external authentication control unit that, in response to receiving a first request signal from the biometric authentication device via the terminal communication unit while the user has been normally authenticated by the terminal authentication unit, transmits to the biometric authentication device, via the terminal communication unit, the reference information stored in the terminal storage unit or first authentication reference information that is information based on the reference information;
Equipped with
The biometric authentication device includes:
a biometric information acquisition unit for acquiring biometric information of the user;
A communication unit that wirelessly communicates with the terminal device;
a request control unit that transmits the first request signal to the terminal device via the communication unit;
a biometric authentication control unit that performs the biometric authentication of the user based on the first authentication reference information received from the terminal device by the communication unit and the biometric information acquired by the biometric information acquisition unit;
Equipped with
Authentication system.

[Configuration Example 2]
the request control unit of the biometric authentication device transmits the first request signal to the terminal device when a predetermined operation is received from the user;
The authentication system according to [Configuration Example 1].

[Configuration Example 3]
the request control unit of the biometric authentication device transmits the first request signal to the terminal device when it is detected that the user is present at a predetermined position;
The authentication system according to [Configuration Example 1] or [Configuration Example 2].

[Configuration Example 4]
the biometric information acquisition unit of the biometric authentication device acquires the biometric information from one of the users present at a predetermined location;
The authentication system according to any one of [Configuration Example 1] to [Configuration Example 3].

[Configuration Example 5]
the biometric authentication control unit of the biometric authentication device erases at least one of the first authentication reference information used for the biometric authentication or information based on the first authentication reference information;
The authentication system according to any one of [Configuration Example 1] to [Configuration Example 4].

[Configuration Example 6]
the first request signal is a signal for notifying a request commonly to unspecified devices including the terminal device,
the biometric authentication control unit of the biometric authentication device, when receiving authentication reference information from a plurality of devices including the first authentication reference information from the terminal device, performs the biometric authentication for each of the received plurality of pieces of authentication reference information;
The authentication system according to any one of [Configuration Example 1] to [Configuration Example 5].

[Configuration Example 7]
The biometric authentication control unit of the biometric authentication device outputs information regarding a result of the biometric authentication to an external device.
An authentication system according to any one of [Configuration Example 1] to [Configuration Example 6].

[Configuration Example 8]
The terminal authentication unit of the terminal device continuously performs authentication of the user.
The authentication system according to any one of [Configuration Example 1] to [Configuration Example 7].

[Configuration Example 9]
the terminal authentication unit and the external authentication control unit of the terminal device, and the biometric authentication control unit of the biometric authentication device are configured with dedicated applications corresponding to each other;
An authentication system according to any one of [Configuration Example 1] to [Configuration Example 8].

[Configuration Example 10]
The biometric information includes one or more of information on the user's face, information on the user's iris, information on the user's veins, or information on the user's fingerprint.
The authentication system according to any one of [Configuration Example 1] to [Configuration Example 9].

It is also possible to provide a method for authentication to be performed in an authentication system.
[Configuration Example 11]
An authentication method in an authentication system including a terminal device carried by a user and a biometric authentication device that performs biometric authentication, comprising:
In the terminal device,
A terminal storage unit stores reference information for the biometric authentication of the user,
A terminal authentication unit authenticates the user,
A terminal communication unit wirelessly communicates with the biometric authentication device,
an external authentication control unit, in response to receiving a first request signal from the biometric authentication device via the terminal communication unit while the user has been normally authenticated by the terminal authentication unit, transmits, via the terminal communication unit, to the biometric authentication device, the reference information stored in the terminal storage unit or first authentication reference information based on the reference information;
In the biometric authentication device,
a biometric information acquisition unit acquires biometric information of the user;
A communication unit wirelessly communicates with the terminal device;
a request control unit that transmits the first request signal to the terminal device via the communication unit;
a biometric authentication control unit performing the biometric authentication of the user based on the first authentication reference information received from the terminal device by the communication unit and the biometric information acquired by the biometric information acquisition unit;
Authentication method.

It is also possible to provide a terminal device in an authentication system.
[Configuration Example 12]
A terminal device in an authentication system including a terminal device carried by a user and a biometric authentication device that performs biometric authentication,
a terminal storage unit that stores reference information for the biometric authentication of the user;
A terminal authentication unit that authenticates the user;
a terminal communication unit that wirelessly communicates with the biometric authentication device;
an external authentication control unit that, in response to receiving a first request signal from the biometric authentication device via the terminal communication unit while the user has been normally authenticated by the terminal authentication unit, transmits to the biometric authentication device, via the terminal communication unit, the reference information stored in the terminal storage unit or first authentication reference information that is information based on the reference information;
Equipped with
Terminal device.

It is also possible to provide a program for the terminal device in the authentication system.
[Configuration Example 13]
In an authentication system including a terminal device carried by a user and a biometric authentication device for performing biometric authentication, a computer constituting the terminal device is provided,
a terminal storage function for storing reference information for the biometric authentication of the user;
A terminal authentication function for authenticating the user;
A terminal communication function for wirelessly communicating with the biometric authentication device;
an external authentication control function that, in response to receiving a first request signal from the biometric authentication device via the terminal communication function while the user has been normally authenticated by the terminal authentication function, transmits to the biometric authentication device, via the terminal communication function, the reference information stored in the terminal storage function or first authentication reference information that is information based on the reference information;
A program to achieve this.

It is also possible to provide a biometric authentication device in an authentication system.
[Configuration Example 14]
A biometric authentication device in an authentication system including a terminal device carried by a user and a biometric authentication device that performs biometric authentication,
a biometric information acquisition unit for acquiring biometric information of the user;
A communication unit that wirelessly communicates with the terminal device;
a request control unit that transmits a first request signal to the terminal device via the communication unit;
a biometric authentication control unit that performs the biometric authentication of the user based on first authentication reference information received from the terminal device by the communication unit and the biometric information acquired by the biometric information acquisition unit;
Equipped with
the first authentication reference information is transmitted in response to receiving the first request signal in a state in which the user has been normally authenticated by the terminal device;
The first authentication reference information is reference information for the biometric authentication of the user stored in the terminal device or information based on the reference information.
Biometric authentication device.

It is also possible to provide a program for the biometric authentication device in the authentication system.
[Configuration Example 15]
In an authentication system including a terminal device carried by a user and a biometric authentication device that performs biometric authentication, a computer that constitutes the biometric authentication device is provided,
A biometric information acquisition function for acquiring biometric information of the user;
A communication function for wirelessly communicating with the terminal device;
a request control function that transmits a first request signal to the terminal device by the communication function;
a biometric authentication control function that performs the biometric authentication of the user based on first authentication reference information received from the terminal device by the communication function and the biometric information acquired by the biometric information acquisition function;
A program for achieving the above,
the first authentication reference information is transmitted in response to receiving the first request signal in a state in which the user has been normally authenticated by the terminal device;
The first authentication reference information is reference information for the biometric authentication of the user stored in the terminal device or information based on the reference information.
program.

1, 1001...authentication system, 11, 311-1 to 311-n, 511, 1011...terminal device, 12, 512, 1012...biometric authentication device, 21, 321-1 to 321-n...user, 31...payment system, 111, 611...input unit, 112, 612...output unit, 113, 613...memory unit, 114, 213, 614, 713...communication unit, 115, 615...authentication unit, 116, 616...external authentication control unit, 117, 716...payment control unit, 211, 711...biometric information acquisition unit, 212, 712...operation reception unit, 2 14, 714...Request control unit, 215, 715...Biometric authentication control unit, 1111...Authentication application function unit, 1112...Payment application function unit, 1211...Code reader equivalent device, 1212...Cash register, 1213...Code payment device, 2011...Processor, 2012...Operation unit, 2013...Display unit, 2014...Storage device, 2015...Memory, 2016...Input/output interface, 2017...Network interface, 2021...Bus, A1, A2...Application, B1, B11...Reference information, P1...Information processing unit

Claims (14)

An authentication system including a terminal device carried by a user and a biometric authentication device that performs biometric authentication,
The terminal device
a terminal storage unit that stores reference information that is information that serves as a basis for obtaining correct information in the biometric authentication of the user;
A terminal authentication unit that authenticates the user;
a terminal communication unit that performs encrypted communication with the biometric authentication device by wireless;
an external authentication control unit that, in response to receiving a first request signal from the biometric authentication device via the terminal communication unit while the user has been normally authenticated by the terminal authentication unit, transmits to the biometric authentication device, via the terminal communication unit, first authentication reference information, which is the reference information stored in the terminal storage unit or information based on the reference information and serves as a basis for obtaining correct information in the biometric authentication;
Equipped with
The biometric authentication device includes:
a biometric information acquisition unit for acquiring biometric information of the user;
a communication unit that performs the encrypted communication with the terminal device wirelessly;
a request control unit that transmits the first request signal to the terminal device via the communication unit;
a biometric authentication control unit that processes the first authentication reference information based on the first authentication reference information received from the terminal device by the communication unit and the biometric information acquired by the biometric information acquisition unit to generate information on a correct answer for the biometric authentication, and performs the biometric authentication of the user; and
Equipped with
a process of obtaining the first authentication reference information based on the reference information by the external authentication control unit, and a process of generating the correct answer information based on the first authentication reference information and the biometric information by the biometric authentication control unit are processes other than encryption,
the terminal authentication unit of the terminal device authenticates the user by using at least a part of the reference information stored in the terminal storage unit;
an algorithm of the authentication performed by the terminal authentication unit of the terminal device and an algorithm of the biometric authentication performed by the biometric authentication control unit of the biometric authentication device are different from each other;
Authentication system. the request control unit of the biometric authentication device transmits the first request signal to the terminal device when a predetermined manual operation is received from the user.
The authentication system according to claim 1 . the biometric information acquisition unit of the biometric authentication device does not acquire the biometric information of the user until after the operation from the user is received.
The authentication system according to claim 2 . the request control unit of the biometric authentication device transmits the first request signal to the terminal device when a predetermined operation is received from the user;
the request control unit of the biometric authentication device, when receiving the operation from the user, transmits the first request signal to the terminal device only once via the communication unit;
The authentication system according to claim 1 . the request control unit of the biometric authentication device transmits the first request signal to the terminal device when a predetermined operation is received from the user;
the request control unit of the biometric authentication device, when receiving the operation from the user, transmits the first request signal to the terminal device via the communication unit at a predetermined timing and for a predetermined period of time;
The authentication system according to claim 1 . the request control unit of the biometric authentication device transmits the first request signal to the terminal device when it is detected that the user is present at a predetermined position;
The authentication system according to claim 1 . the biometric information acquisition unit of the biometric authentication device acquires the biometric information from one of the users present at a predetermined location;
The authentication system according to claim 1 . the biometric authentication control unit of the biometric authentication device erases at least one of the first authentication reference information used for the biometric authentication or information based on the first authentication reference information;
3. The authentication system according to claim 1 or 2. the first request signal is a signal for notifying a request commonly to unspecified devices including the terminal device,
the biometric authentication control unit of the biometric authentication device, when receiving authentication reference information from a plurality of devices including the first authentication reference information from the terminal device, performs the biometric authentication for each of the received plurality of pieces of authentication reference information;
3. The authentication system according to claim 1 or 2. The biometric authentication control unit of the biometric authentication device outputs information regarding a result of the biometric authentication to an external device.
3. The authentication system according to claim 1 or 2. The terminal authentication unit of the terminal device continuously performs authentication of the user.
3. The authentication system according to claim 1 or 2. the terminal authentication unit and the external authentication control unit of the terminal device, and the biometric authentication control unit of the biometric authentication device are configured with dedicated applications corresponding to each other;
3. The authentication system according to claim 1 or 2. The biometric information includes one or more of information on the user's face, information on the user's iris, information on the user's veins, or information on the user's fingerprint.
3. The authentication system according to claim 1 or 2. An authentication method in an authentication system including a terminal device carried by a user and a biometric authentication device that performs biometric authentication, comprising:
In the terminal device,
a terminal storage unit stores reference information which is information that is a basis for obtaining correct information in the biometric authentication of the user;
A terminal authentication unit authenticates the user,
A terminal communication unit performs encrypted communication with the biometric authentication device by wireless communication;
an external authentication control unit, in response to receiving a first request signal from the biometric authentication device via the terminal communication unit while the user has been normally authenticated by the terminal authentication unit, transmits, to the biometric authentication device via the terminal communication unit, first authentication reference information, which is the reference information stored in the terminal storage unit or information based on the reference information and is information serving as a basis for obtaining correct information in the biometric authentication;
In the biometric authentication device,
a biometric information acquisition unit acquires biometric information of the user;
a communication unit that wirelessly performs the encrypted communication with the terminal device;
a request control unit that transmits the first request signal to the terminal device via the communication unit;
a biometric authentication control unit processes the first authentication reference information based on the first authentication reference information received from the terminal device by the communication unit and the biometric information acquired by the biometric information acquisition unit to generate correct answer information for the biometric authentication, and performs the biometric authentication of the user;
a process of obtaining the first authentication reference information based on the reference information by the external authentication control unit, and a process of generating the correct answer information based on the first authentication reference information and the biometric information by the biometric authentication control unit are processes other than encryption,
the terminal authentication unit of the terminal device authenticates the user by using at least a part of the reference information stored in the terminal storage unit;
an algorithm of the authentication performed by the terminal authentication unit of the terminal device and an algorithm of the biometric authentication performed by the biometric authentication control unit of the biometric authentication device are different from each other;
Authentication method.

Images