JP5075675B2 - Biometric authentication system and biometric authentication device - Google Patents

Description

  The present invention relates to a biometric authentication system and a biometric authentication apparatus for identifying a person using, for example, biometric information, for example, a living body such as a fingerprint or a vein pattern, and in particular, biometric authentication using a server connected to an IC card and a network. IC card renewal, biometric information registration and fraud prevention.

  In recent years, with the rapid development of an information-oriented society, management consciousness for confidentially managing confidential information such as personal information and technical information is increasing in companies and local governments. In addition, in financial institutions, fraudulent transactions such as counterfeit cash cards are a major problem. Along with this, biometric authentication using “individual features” is recognized as a highly reliable personal authentication means with less risk of forgery, theft, loss and unauthorized transfer.

  When performing biometric authentication, the biometric authentication system first acquires the user's biometric information (for example, fingerprints or vein characteristic data) and registers it in the database together with the user's ID. When performing personal authentication, the biometric authentication system reads using the biometric information of the user, and authenticates the read biometric information together with the biometric information registered with the user's ID.

  As such a biometric authentication system, biometric information is held in an IC card owned by the user, and the read biometric information read from the user by the biometric authentication device and the biometric information in the IC card are stored in the IC card. A method of performing personal authentication by collating has been proposed (see Patent Document 1). In addition, a method has been proposed in which user identification and personal authentication are simultaneously performed using only biometric information without using user ID information such as an IC card (see Patent Document 2).

In this way, the method for confirming the identity of the user by biometric authentication using an IC card and the method for identifying and confirming the identity of the user without using ID information provide various services such as withdrawal of deposits. It can be applied to automatic transaction equipment.
JP 10-312459 A JP 2004-258963 A

  Here, when considering a biometric authentication system that has both a personal identification means using an IC card with a biometric authentication function and a personal identification means that performs cardless biometric authentication without using ID information, the IC card is already owned. When a user who is using the cardless biometric authentication system newly uses it, it is necessary to newly register biometric information used for the cardless biometric authentication.

  At the time of this registration, in order to prevent the biometric information of the user from being leaked or illegally registered, the identity of the user is again confirmed by confirmation by the operator at the counter, and the biometric information used for cardless biometric authentication is stored in the database of the server It becomes necessary to register with.

  Also, if both an IC card and a cardless biometric transaction are provided, a user who uses both needs to update the IC card according to the expiration date of the IC card. At that time, it is necessary to re-register biometric information.

  At the time of this update, in order to prevent the biometric information of the user from being leaked or illegally registered, it is necessary to confirm the identity of the user again by confirmation by an operator at the counter and register the biometric information in a new IC card.

If the identity verification and registration are performed by the window service in this way, there is a problem that convenience for the user is lowered.
It is an object of the present invention to provide a biometric authentication system and a biometric authentication device that do not reduce user convenience when registering or updating biometric information, and to improve user satisfaction.

The present invention communicates a biometric authentication device having a biometric information reading unit that reads biometric information of a user and a card reader unit that reads an IC card of the user, a server having a database, the biometric authentication device, and the server. capable and a telecommunications line to be connected, to execute said biometric information reading unit with read reading biometric information, the server biometric authentication processing for authenticating by the server registered biometric information registered in the database of the server biometric An authentication system or a biometric authentication device, wherein the biometric authentication device performs authentication based on the read biometric information read by the biometric information reading unit and card registered biometric information stored in the IC card. If the authentication process and the authentication result by the card biometric authentication process are good, the read biometric information from which the authentication result is good It generates over server registered biometric information, and executes the biometric information server registration process for registering allowable database of the server.

  According to the present invention, when biometric information is registered or updated, the user's convenience can be improved without deteriorating the user's convenience.

An embodiment of the present invention will be described below with reference to the drawings.
This embodiment relates to an automatic transaction apparatus such as an ATM (Automated Teller Machine) employed in a financial institution system such as a bank system.

  FIG. 1 is a block diagram showing an automatic financial transaction system 1 (biometric authentication system) having an ATM terminal 100 (biometric authentication device) that performs identity verification by biometric authentication as an example of an embodiment of the present invention. In this automatic financial transaction system 1, an ATM terminal 100 capable of reading an IC card 110 and a host computer 130 of a computer center are connected via a network 120 (electric communication line).

  The ATM terminal 100 includes a biometric information reading unit 101, a card reader unit 102, an ATM control unit 103 (communication unit), a display unit 104, and an input unit 105.

  The biological information reading unit 101 has a function of reading biological information from a biological body (for example, a finger) set by a user and generating biological information to be collated (read biological information) and biometric information for registration. As biometric information for registration, card registered biometric information registered in the biometric information storage memory 112 in the IC card 110 and server registered biometric information registered in the biometric information database 131 (database) in the host computer 130 are used. Generate.

  The card reader unit 102 inserts or ejects the IC card 110 of the user, reads or writes the magnetic stripe (not shown) of the IC card 110 or the IC chip 111, and image reading function of the card embossed part (not shown). Etc.

  The ATM control unit 103 includes a display unit 104 and an input unit 105, performs input / output control of information used for user identity verification and information related to user transactions, and an external device such as a host computer 130 via the network 120. Also controls the information communication process.

  The IC card 110 includes an IC chip 111 having a memory 112 that stores card registration biometric information, a biometric authentication program, and a CPU. The card registration biometric information stored in the memory 112 is generated by the biometric information reading unit 101 of the ATM terminal 100. The IC card 110 has a function of collating the input read biometric information with the registered card registered biometric information and outputting a biometric authentication result.

  The host computer 130 includes a biometric information database 131, a biometric information search unit 132, a biometric authentication verification unit 133, a biometric authentication server 134 (server), and an IC card authentication unit 135.

  The biometric authentication server 134 in the host computer 130 is connected to the ATM terminal 100 via the network 120, and the biometric information search unit 132 reads the user's read biometric information received from the ATM terminal 100 and the biometric information database 131. The biometric authentication verification unit 133 collates the registered server registered biometric information that has been searched, and transmits a biometric authentication result to the ATM terminal 100.

  The IC card authentication unit 135 in the host computer 130 has a function of determining whether or not the IC card 110 can be traded from the user's IC card information received from the ATM terminal 100.

  FIG. 2 shows a data configuration example in the IC chip 111 of the IC card 110. As data stored in the memory 112 of the IC chip 111, account information 210 storing an account number and the like, user information 211 storing a user's sex, date of birth, address, etc., There is card registration biometric information 212 used for biometric authentication. The programs stored in the IC chip 111 include a biometric authentication verification unit 220 that performs biometric authentication and an authentication count counter 221 that counts the number of biometric authentication failures. As a result, when the biometric authentication fails continuously and the authentication counter 221 reaches a specified value, a blocking function with the IC card 110 alone can be realized so that biometric authentication cannot be used thereafter.

  The biometric authentication server 134 connected to the network 120 holds data and programs similar to those in FIG. 2, that is, account information, user information, biometric information, a biometric verification unit, and an authentication counter. Thereby, the biometric authentication by the biometric authentication server 134 is realizable.

  FIG. 3 is a flowchart showing a cardless transaction registration process as a biometric information server registration process executed mainly by the ATM terminal 100. Using this flowchart, when a user who uses biometric authentication by the IC card 110 in the automatic financial transaction system 1 uses biometric authentication in the biometric authentication server 134 newly connected to the network 120 without a card. Next, a cardless transaction registration process for registering necessary server registration biometric information and the like in the biometric information database 131 will be described.

  Note that the cardless transaction here does not require the ID used in the conventional IC card 110, and performs the transaction by performing identification and biometric authentication with only the user's biometric information without using such an ID. It is preferable.

  The ATM control unit 103 of the ATM terminal 100 displays a transaction selection screen on the display unit 104 when starting a transaction. When cardless transaction registration is selected by the user from this transaction selection screen, cardless transaction registration processing is started (step S301).

  When the user-owned IC card 110 is inserted into the card reader unit 102, the ATM control unit 103 reads data from the IC card 110 and authenticates the IC card 110 (step S302). This authentication is not biometric authentication of the user but authentication of the IC card 110 itself.

When the user's living body (for example, a finger) is set in the living body information reading unit 101, the ATM control unit 103 acquires the reading biological information of the user by the living body information reading unit 101 (step S303) .

  The ATM control unit 103 transmits the obtained read biometric information to the IC card 110, and performs a card biometric authentication process for verifying the card biometric information 212 registered in the IC card 110 and the read biometric information. 220 (step S304).

  When the identity cannot be confirmed by the biometric authentication in the IC card 110 (step S305: No), the ATM control unit 103 that has received this authentication NG information displays the identity confirmation impossible message on the display unit 104 (step S320). The IC card 110 is returned and the transaction ends.

  When the identity can be confirmed by biometric authentication in the IC card 110 (step S305: Yes), the ATM control unit 103 that has received this authentication OK information obtains the server registered biometric information used in the cardless transaction in step S303. Generated from the read biometric information collected at the time of biometric authentication (step S306).

  The ATM control unit 103 transmits the generated server registration biometric information to the biometric authentication server 134 via the network 120 (step S307) and registers it in the biometric information database 131.

  When the registration completion response to the biometric information database 131 is received from the biometric authentication server 134 (step S308), the ATM control unit 103 performs biometric authentication for confirming that the registration has been correctly performed as described below.

  The ATM control unit 103 causes the user to set a biometric (for example, a finger) on the biometric information reading unit 101 again to acquire the read biometric information of the user (step S309), and transmits the read biometric information to the biometric authentication server 134. (Step S310).

  The biometric authentication server 134 performs a server biometric authentication process in which the biometric authentication collating unit 133 collates the received read biometric information with the server registered biometric information registered in the biometric information database 131 (step S311). Is transmitted to the ATM terminal 100.

  When the ATM control unit 103 receives the verification NG information that could not be confirmed by the biometric authentication (step S312: No), the ATM control unit 103 displays an unidentified message on the display unit 104 (step S330).

  The ATM control unit 103 causes the biometric authentication server 134 to delete the server registered biometric information registered in steps S307 to S308 from the biometric information database 131 (step S331), and returns the IC card 110 from the card reader unit 102 for transaction. End.

  If the identity can be confirmed by biometric authentication (step S312: Yes), the ATM control unit 103 transmits registration completion to the biometric authentication server 134 (step S313), confirms the registration data (server registration biometric information), and then determines the IC. The card 110 is returned to end the transaction.

  With this cardless transaction registration process, when a user newly uses a cardless biometric transaction, the ATM terminal 100 can securely and reliably store the server registered biometric information without performing identity verification by a window operator. Can be registered in the biological information database 131. Therefore, convenience for the user is improved.

  FIG. 4 is a flowchart showing an IC card update process as a card registration biometric information update process executed mainly by the ATM terminal 100. Here, a user who uses both the biometric authentication transaction using the IC card 110 and the cardless biometric authentication transaction in the automatic financial transaction system 1 has used it until then due to the expiration date of the IC card 110. The biometric information registration process required when the old IC card 110 is updated to the new IC card 110 acquired by mail or the like will also be described.

  The ATM control unit 103 of the ATM terminal 100 displays a transaction selection screen on the display unit 104 when starting a transaction. When an IC card update transaction is selected by the user from this transaction selection screen, an IC card update process is executed (step S401).

  When a user-owned IC card 110 (old IC card) is inserted into the card reader unit 102, the ATM control unit 103 reads data from the old IC card 110 and authenticates the old IC card 110 (step S402). . In the authentication of the old IC card 110, communication with the host computer 130 is performed to determine whether or not the old IC card 110 is a card to be closed.

  If the old IC card 110 is a card to be blocked (step S403: Yes), the ATM control unit 103 causes the old IC card 110 to execute a blocking process so that the old IC card 110 does not operate (step S420). ).

  The ATM control unit 103 collects the blocked old IC card 110 and ends the process. It is also possible to return the old IC card 110 that has been closed.

  When the old IC card 110 is not a card to be closed (step S403: No), the ATM control unit 103 sets the user's living body (for example, a finger) in the living body information reading unit 101, and the living body information reading unit 101 Thus, the read biometric information of the user is acquired (step S404).

  The ATM control unit 103 transmits the acquired biometric information to the old IC card 110 by the card reader unit 102, and the card biometric verification unit 220 collates with the card registered biometric information 212 registered in the old IC card 110. An authentication process is executed (step S405). At the same time, the acquired read biometric information is transmitted to the biometric authentication server 134 via the network 120, and the biometric authentication collating unit 133 collates with the server registered biometric information registered in the biometric information database 131. A biometric authentication process is executed (step S405). In this step S405, biometric authentication is performed by both the old IC card 110 and the biometric authentication server 134, but biometric authentication may be performed only by the biometric authentication server 134.

  When the identity cannot be confirmed by the biometric authentication in step S405 (step S406: No), the ATM control unit 103 displays an identity confirmation impossible message on the display unit 104 (step S425), returns the old IC card 110, and ends the transaction. And

  When the identity can be confirmed by the biometric authentication in step S405 (step S406: Yes), the ATM control unit 103 stores the card registration biometric information for registration in the new IC card 110 in the biometric information database 131 of the host computer 130. It is generated from the registered server biometric information (step S407). The card registration biometric information may be generated from the read biometric information collected at the time of biometric authentication with the old IC card 110 (step S404).

  When the user inserts the new IC card 110 into the card reader unit 102, the ATM control unit 103 uses the card reader unit 102 to read data from the new IC card 110 and authenticate the new IC card 110 (step). S408).

  The ATM control unit 103 registers the card registration biometric information generated in step S407 in the new IC card 110 (step S409). When the registration is completed, the ATM control unit 103 performs biometric authentication to confirm that the registration is correctly performed on the new IC card 110 as described below.

  The ATM control unit 103 sets the user's living body (for example, a finger) in the living body information reading unit 101 again, and acquires the reading biometric information of the user by the living body information reading unit 101 (step S410).

  The ATM control unit 103 transmits the acquired read biometric information to the new IC card 110 and the biometric authentication server 134, and matches the biometric information (card registered biometric information and server registered biometric information) registered in the card biometric authentication. Processing and server biometric authentication processing are executed (step S411).

  When the identity cannot be confirmed by the biometric authentication between the new IC card 110 and the biometric authentication server 134 (step S412: No), the ATM control unit 103 displays the identity confirmation impossible message on the display unit 104 (step S430). The ATM control unit 103 deletes the card registered biometric information registered in the new IC card 110 (step S431), returns the old and new IC card 110, and ends the transaction.

  When the identity can be confirmed by biometric authentication between the new IC card 110 and the biometric authentication server 134 (step S412: Yes), the ATM control unit 103 transmits registration completion to the new IC card 110 (step S413), and the new IC After confirming the registration data (card registration biometric information etc.) in the card 110, the registration data (card registration biometric information etc.) in the old IC card 110 is deleted, the biometric authentication function is blocked (step S414), and the old and new The IC card 110 is returned and the transaction ends. Only the new IC card 110 may be returned and the old IC card 110 may be collected.

  Thus, when the user updates the IC card 110 for reasons such as the expiration date of the IC card 110, the ATM terminal 100 updates the registered data in the IC card 110 without performing identity verification by the operator at the window. It is possible to perform it safely and reliably, and the convenience for the user is improved.

  FIG. 5 is a flowchart showing an IC card transaction closing process as a card transaction stop process executed mainly by the ATM terminal 100. Here, when a user who uses the IC card 110 and the cardless biometric transaction in the automatic financial transaction system 1 is lost or stolen, the IC card 110 is misused. A means for preventing fraudulent transactions will be described.

  The ATM control unit 103 of the ATM terminal 100 displays a transaction selection screen on the display unit 104 when starting a transaction. When the IC card transaction blockage transaction is selected by the user from the transaction selection screen (step S501), the ATM control unit 103 sets the biometric information reading unit 101 of the user's biological body (for example, a finger), and the biometric information. The reading biometric information of the user is acquired by the reading unit 101 (step S502).

  The ATM control unit 103 transmits the acquired read biometric information to the biometric authentication server 134 via the network 120 (step S503), and the biometric authentication collating unit 133 uses the server registered biometric information registered in the biometric information database 131. A server biometric authentication process to be verified is executed (step S504).

  If the biometric authentication fails to confirm the identity (step S505: No), the ATM control unit 103 displays a non-identification confirmation message on the display unit 104 (step S510) and ends the transaction.

  When the identity is confirmed by the biometric authentication (step S505: Yes), the ATM control unit 103 transmits a request for closing the transaction by the IC card 110 to the biometric authentication server 134 for the user account (step S506). .

  When the ATM control unit 103 receives the closure completion from the biometric authentication server 134 (step S507), the transaction ends. After this blockage, even if an attempt is made to make a transaction with the IC card 110, the IC card authentication unit 135 of the biometric authentication server 134 is authenticated NG and the transaction is impossible.

  As a result, when the user loses or steals the IC card 110, unauthorized transactions can be prevented by quickly and surely closing the transaction with the IC card 110. In addition, since the ATM terminal 100 can be closed without performing a procedure at the window, convenience for the user is also improved.

FIG. 6 is a flowchart showing an IC card closing process executed by the IC chip 111 of the IC card 110.
If the received signal is not a blocking process (step S601: No), the IC chip 111 executes a normal process (step S603) and ends the process. This normal process is an appropriate process such as sending account information registered in the memory 112 as a response, or receiving the read biometric information, biometrically authenticating with the card registered biometric information in the memory 112, and transmitting an authentication result. Consists of.

If the received signal is a block command (step S601: Yes), the IC chip 111 erases the card registered biometric information in the memory 112 and stops the authentication function (step S602). In addition, it is not limited to deleting card registration biometric information, the setting is changed so as not to execute the biometric authentication process, the setting is changed so as not to respond even when a signal is received, or a plurality of these processes are executed, etc. It is good to close by an appropriate method.
Thereby, it is possible to reliably prevent the biometric information stored in the memory 112 of the IC card 110 from being acquired or analyzed by a third party.

  With the above configuration and operation, when registering biometric information in the biometric information database 131, updating the IC card 110, and updating biometric information, it can be performed without a window service, thereby reducing user convenience. Therefore, user satisfaction can be improved.

  Further, by simultaneously implementing biometric authentication using the IC card 110 and cardless biometric authentication using the biometric authentication server 134 and using both biometric authentications in combination, it is possible to prevent unauthorized transactions due to forgery of biometric information and the like. It is possible to provide high convenience to the user.

  Also, since the read biometric information that has succeeded in biometric authentication is used during registration, biometric information that can be reliably authenticated can be registered in the IC card 110 or the biometric information database 131 from the ATM terminal 100 (registered without an attendant). As a result, the conflicting issues of maintaining a high security level and simplifying operations can be achieved.

  More specifically, the server registered biometric information newly registered in the biometric information database 131 and the card registered biometric information newly registered in the new IC card 110 for update are read biometrics that have been authenticated by biometric authentication using the IC card 110. It is generated from information (read biometric information acquired in steps S303 and S404). For this reason, appropriate server registration biometric information and card registration biometric information can be generated. Therefore, for example, when biometric information is acquired again without using the read biometric information at the time of authentication, and this is used for new registration, the biometric information becomes different from that at the time of authentication and at the time of registration and is inappropriate or biometric information of another person. May be registered, but this can be prevented.

  Further, conventionally, since the biometric information of the user is stored in the IC card 110, when the user using the biometric authentication transaction by the IC card 110 is lost or stolen. There was a possibility that biometric information was leaked and illegal transactions were made. On the other hand, since the automatic financial transaction system 1 enables the biometric authentication server 134 and the IC card 110 to be closed, even if the user loses or steals the IC card 110, the biometric information is leaked or counterfeited. A high level of security can be secured to prevent unauthorized transactions.

  In addition, since the biometric authentication server 134 can be blocked by operating the ATM terminal 100, the user can easily disable the IC card 110 when the IC card 110 is lost.

  In particular, since the user can disable the IC card 110 without going to the window, the IC card 110 can be disabled even when the window is closed. Thereby, safety in an emergency can be improved.

  Further, the automatic financial transaction system 1 temporarily registers (temporarily registers) the server registered biometric information or the card registered biometric information in the biometric information database 131 or the IC card 110 during the cardless transaction registration process and the IC card update process. Then, using this registered server biometric information or card biometric information, biometric authentication is performed again on the read biometric information read from the user's biometric data, registration is confirmed in the case of authentication OK, and registration is performed in the case of authentication NG. Delete information. Accordingly, server registered biometric information or card registered biometric information that can authenticate the user reliably can be registered in the biometric information database 131 or the IC card 110, and it is possible to prevent the user who is the user from being correctly authenticated after registration.

  In the above embodiment, the biometric authentication by the IC card 110 and the biometric authentication by the biometric authentication server 134 can be used to improve convenience for the user by changing each authentication level and combining the biometric authentication results. . Thereby, a user's satisfaction can further be raised.

  The present invention is not limited only to the configuration of the above-described embodiment, and many embodiments can be obtained.

The block diagram of an automatic financial transaction system. The data block diagram in the IC chip of an IC card. The flowchart of a cardless transaction registration process. The flowchart of an IC card update process. The flowchart of an IC card transaction closing process. 6 is a flowchart of IC card closing processing.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Automatic financial transaction system, 100 ... ATM terminal, 101 ... Biometric information reading part, 102 ... Card reader part, 110 ... IC card, 120 ... Network network, 131 ... Biometric information database, 134 ... Biometric authentication server

Claims (10)

A biometric authentication device having a biometric information reading unit for reading the biometric information of the user and a card reader unit for reading the IC card of the user;
A server having a database;
An electrical communication line that connects the biometric authentication device and the server in a communicable manner;
Wherein the biometric information reading unit with read reading biometric information, a biometric authentication system that performs a server biometric authentication processing for authenticating by the server registered biometric information registered in the database of the server,
The biometric authentication device is:
A card biometric authentication process for authenticating based on the read biometric information read by the biometric information reading unit and card registered biometric information stored in the IC card;
If the authentication result by the card biometric authentication process is good, a biometric information server registration process for generating the server registered biometric information from the read biometric information with a good authentication result and allowing registration in the database of the server; Perform biometric authentication system. The biometric authentication device is:
Before biometric authentication by hear over de biometric authentication process is satisfactory, and when biometric authentication by the server biometric authentication process is satisfactory, the card registered biometric to update permit card registered biometric information stored in the IC card The biometric authentication system of Claim 1 which performs an information update process. The biometric authentication device is:
The biometric authentication system according to claim 1 or 2, wherein the server biometric authentication process is executed, and if the authentication result is good, a card transaction stop process for allowing the card biometric authentication process to be stopped is executed. When the IC card is inserted into a card reader unit of a biometric authentication device after executing the card transaction stop processing, an IC card closing process is executed to stop and block the card biometric authentication processing of the IC card. Item 4. The biometric authentication system according to item 3. Claim that the authentication by the card biometric authentication process and the authentication by the server biometric authentication process are both performed on the read biometric information, and authentication is performed when both authentication results are good. Item 5. The biometric authentication system according to any one of Items 1 to 4. A biometric information reading unit that reads the biometric information of the user;
A card reader for reading the user's IC card;
A communication unit that communicates with a server having a database through a telecommunication line;
Wherein the biometric information reading unit with read reading biometric information, the a biometric authentication device to perform server biometric authentication processing for authenticating by the server registered biometric information registered in the database of the server,
A card biometric authentication process for authenticating based on the read biometric information read by the biometric information reading unit and card registered biometric information stored in the IC card;
If the authentication result by the card biometric authentication process is good, a biometric information server registration process for generating the server registered biometric information from the read biometric information with a good authentication result and allowing registration in the database of the server; A biometric authentication device configured to be executed . Before biometric authentication by hear over de biometric authentication process is satisfactory, and when biometric authentication by the server biometric authentication process is satisfactory, the card registered biometric to update permit card registered biometric information stored in the IC card The biometric authentication device according to claim 6, wherein the biometric authentication device is configured to execute information update processing. The biometric authentication device according to claim 6 or 7, wherein the server biometric authentication process is executed, and if the authentication result is good, a card transaction stop process is executed that permits the card biometric authentication process to be stopped. 9. The configuration according to claim 8, wherein when the IC card is inserted into a card reader unit of a biometric authentication device after executing the card transaction stop processing, the card biometric authentication processing of the IC card is stopped and blocked. Biometric authentication device. Claim that the authentication by the card biometric authentication process and the authentication by the server biometric authentication process are both performed on the read biometric information, and authentication is performed when both authentication results are good. Item 10. The biometric authentication device according to any one of Items 6 to 9.

Images