Authentication system, authentication method, and program

Abstract

To provide an authentication system that enables a wearer of a head mounted display to easily perform an authentication operation when using an application.SOLUTION: A head mounted display includes a processor, a camera that images a wearer's iris, a gaze direction detection unit that detects the wearer's gaze direction, and a communication unit that connects to an authentication server. The processor transmits an iris image, an input pattern, and the gaze direction to the authentication server. The authentication server compares the iris image transmitted from the head mounted display with a registered iris image, which is registered in advance, to perform first authentication to authenticate the wearer as a registered person, and then performs second authentication based on the input pattern and gaze direction to be transmitted and a pre-registered correct answer information. When the authentication server authenticates the wearer as a registered person, an application server provides the head mounted display with an application for a simulated experience.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an authentication system, an authentication method, and a program. [Background technology]

[0002] Virtual reality (VR) is often used with a personal computer (PC), smartphone, tablet, or head mounted display (hereinafter sometimes referred to as "HMD") (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent Publication No. 2021-174253 Summary of the Invention [Problem to be solved by the invention]

[0004] To use applications or services, users must log in each time, just like with PCs and smartphones, but unlike PCs and smartphones, head-mounted displays use a dedicated controller as an input device, which is not as easy to use as a keyboard. In addition, wearing a head-mounted display limits freedom of movement, making it inconvenient, and making user authentication operations very difficult.

[0005] The present invention has been made in consideration of the above-mentioned problems, and provides an authentication system that enables a wearer of a head-mounted display equipped with a display for simulated experiences to easily perform authentication operations when using an application. [Means for solving the problem]

[0006] An authentication system according to one aspect of the present invention is an authentication system in which a head mounted display equipped with a display for a simulated experience, an authentication server for authenticating whether a wearer wearing the head mounted display is a pre-registered person, and an application server for providing an application for the simulated experience to the display of the head mounted display are connected to each other via a network, the head mounted display comprising a processor, a camera for capturing an image of the iris of the wearer, a memory for storing the iris image captured by the camera, a gaze direction detection unit for detecting the gaze direction of the wearer, and a communication unit for connecting to the authentication server, and the processor is configured to recognize the iris image stored in the memory and the image displayed on the display. the input pattern and the gaze direction detected by the gaze direction detection unit are transmitted to the authentication server via the communication unit, and the authentication server compares the iris image transmitted from the head mounted display with a pre-registered iris image to perform a first authentication to authenticate that the wearer is the registered person, and then performs a second authentication to authenticate whether the wearer is the registered person based on the input pattern and gaze direction transmitted from the head mounted display and pre-registered correct answer information, and after the second authentication is performed, when the authentication server authenticates that the wearer is the registered person, the application server provides the application for the simulated experience to the display of the head mounted display. Effect of the Invention

[0007] According to the present invention, a wearer of a head mounted display equipped with a display for virtual experience can easily perform authentication operations when using an application. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram for explaining an overall outline of an embodiment. [Diagram 2] FIG. 2 is a block diagram showing a functional configuration of the head mounted display. [Diagram 3] FIG. 2 is a block diagram showing a functional configuration of a PF authentication server. [Figure 4] FIG. 2 is a block diagram showing a functional configuration of an application server. [Diagram 5] FIG. 11 is a diagram showing an example of the contents of a user information database managed by the head mounted display. [Figure 6] 11 is a diagram showing an example of the contents of a user information database managed by the PF authentication server. FIG. [Figure 7] FIG. 11 is a diagram showing an example of the contents of a user information database managed by the application server. [Figure 8] 13 is a flowchart illustrating an example of an account registration process in the head mounted display. [Figure 9] 13 is a flowchart illustrating an example of an account registration process in the head mounted display. [Figure 10] 13 is a flowchart showing an example of an account registration process in the PF authentication server. [Figure 11] 13 is a flowchart showing an example of an account registration process in the PF authentication server. [Figure 12] 11 is a flowchart illustrating an example of a user authentication process in the head mounted display. [Figure 13] 11 is a flowchart illustrating an example of a user authentication process in the head mounted display. [Figure 14] 13 is a flowchart showing an example of a biometric authentication process in the PF authentication server. [Figure 15] 13 is a flowchart illustrating an example of two-factor authentication processing in the PF authentication server. [Figure 16] 11 is a flowchart showing an example of an application / service startup process in the head mounted display. [Figure 17] 13 is a flowchart illustrating an example of a user authentication process in an application server. [Figure 18]13 is a flowchart showing an example of a user authentication process in the PF authentication server. [Figure 19] 13 is a flowchart illustrating an example of an account registration process. [Figure 20] 13 is a flowchart illustrating an example of a user authentication process. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. Fig. 1 is a diagram for explaining an overall outline of the present embodiment. As shown in Fig. 1, an authentication system 1 includes a head mounted display 2, a PF (platform) authentication server 3, and an application server 4, and all of the devices are connected to a communication network CN.

[0010] 2 is a block diagram showing a functional configuration of a head mounted display 2. The head mounted display 2 is a head mounted display device that is worn on the head, and is, for example, a glasses-type or goggles-type wearable terminal.

[0011] The head mounted display 2 has a camera 10 (imaging means), a display 11, an input device 12, a memory 13, a processor 14, a sensor 15 (gaze direction detection means), a control device 16, and a storage device 17.

[0012] The head mounted display 2 displays an image for the right eye and an image for the left eye on the display 11, respectively, and allows the user to view a three-dimensional image that is stereoscopically perceived by the user based on the parallax between the user's eyes. This provides a virtual space to the user. Since the display 11 is disposed in front of the user's eyes, the user can be immersed in the virtual space through the image displayed on the display 11. This allows the user to experience virtual reality. The virtual space may include a background, as well as various UI objects and menu images that the user can operate.

[0013] The camera 10 is disposed in a mounting portion (not shown) of the head mounted display 2, and captures, for example, an image of the iris of a user (wearer) wearing the head mounted display 2 to obtain an iris image.

[0014] Display 11 may be, for example, a liquid crystal display, and may include a right-eye sub-display that displays an image for the right eye, and a left-eye sub-display that displays an image for the left eye, or may be a single display device that displays an image for the right eye and an image for the left eye on a common screen.

[0015] The input device 12 is, for example, a button or the like arranged on a mounting portion (not shown) of the head mounted display 2, and receives an operation by the wearer. The input device 12 outputs an input signal indicating the received operation by the wearer to the processor 14.

[0016] The memory 13 stores a program for controlling the head mounted display 2. The processor 14 controls the head mounted display 2 by reading out the program stored in the memory 13 and executing the read program.

[0017] The sensor 15 detects the direction (gaze direction) in which the gaze of the right eye and the left eye of the user wearing the head mounted display 2 is directed. For example, a known sensor having an eye tracking function can be adopted as the sensor 15. The sensor 15 preferably includes a right eye sensor and a left eye sensor. For example, the sensor 15 may be a sensor that detects the rotation angle of each eyeball by irradiating the right eye and the left eye of the user with infrared light and receiving the reflected light from the cornea and the iris in response to the irradiated light. The sensor 15 can detect the gaze direction of the user based on each detected rotation angle.

[0018] The control device 16 has a user authentication processing unit 18, an application management unit 19, and a communication processing unit 20. The storage device 17 stores user information 21 and application programs 22. The control device 16 and the storage device 17 will be described in detail later.

[0019] 3 is a block diagram showing the functional configuration of the PF authentication server 3. The PF authentication server 3 includes a processor 25, a memory 26, an input device 27, an output device 28, a communication device 29, a control device 30, and a storage device 31.

[0020] The processor 25 executes programs stored in the memory 26. The memory 26 includes a ROM (Read Only Memory), which is a non-volatile storage element, and a RAM (Random Access Memory), which is a volatile storage element. The ROM stores immutable programs (e.g., a Basic Input / Output System (BIOS)). The RAM is a high-speed, volatile storage element such as a DRAM (Dynamic Random Access Memory), and temporarily stores programs executed by the processor 25 and data used when the programs are executed.

[0021] The input device 27 is a device such as a keyboard or a mouse that receives input from an operator. The output device 28 is a device such as a display device or a printer that outputs the results of program execution in a format that can be viewed by the operator. The communication device 29 is a network interface device that controls communication with other devices according to a predetermined protocol.

[0022] The control device 30 has a PF authentication processing unit 32, a user management unit 33, and a communication processing unit 34. User information 35 (personal information 35A, biometric information 35B, and two-factor authentication information 35C) is stored in the storage device 31. The control device 30 and the storage device 31 will be described in detail later.

[0023] 4 is a block diagram showing the functional configuration of the application server 4. The application server 4 includes a processor 40, a memory 41, an input device 42, an output device 43, a communication device 44, a control device 45, and a storage device 46.

[0024] The processor 40 executes programs stored in the memory 41. The memory 41 includes a ROM, which is a non-volatile storage element, and a RAM, which is a volatile storage element. The ROM stores unchanging programs (e.g., BIOS) and the like. The RAM is a high-speed, volatile storage element such as a DRAM, and temporarily stores the programs executed by the processor 40 and data used when the programs are executed.

[0025] The input device 42 is a device such as a keyboard or a mouse that receives input from an operator. The output device 43 is a device such as a display device or a printer that outputs the results of program execution in a format that can be viewed by the operator. The communication device 44 is a network interface device that controls communication with other devices according to a predetermined protocol.

[0026] The control device 45 has a user authentication processing unit 47, a user management unit 48, and a communication processing unit 49. User information 50 (personal information 50A, registered applications / services 50B) is stored in the storage device 46. The control devices 45 and 46 will be described in detail later.

[0027] FIG. 5 is a diagram showing an example of the contents of a user information database managed by the head mounted display. As shown in FIG. 5, in the user information database 60, user information 61 is stored for each user who wears the head mounted display 2 and has a simulated experience. The user information 61 includes a user ID 62, a usage status 63, and application / service information 64. The user ID 62 is the ID of a user who has registered an account. The usage status 63 is the status of the user who is currently wearing the head mounted display 2, and indicates only whether or not the user is logged in. The status is ON when the target user is wearing the display, and is OFF when another user is using the display. Information on the application or service used by the user is registered in the application / service information 64.

[0028] Fig. 6 is a diagram showing an example of the contents of a user information database managed by the PF authentication server. As shown in Fig. 6, in the user information database 70, user information 71 is stored for each user who wears the head mounted display 2 and performs a simulated experience. The user information 71 includes a user ID 72, biometric information 73, a two-factor authentication pattern 74 (input pattern), two-factor authentication correct answer information 75 (correct answer information), and user attributes 76. In this example, only the minimum information required for authentication processing in the PF authentication server 3 is described.

[0029] The user ID 72 is the ID of the user who has registered the account. The biometric information 73 is an iris image of the target user received from the head mounted display 2. The two-factor authentication pattern 74 is an input pattern for two-factor authentication used by the target user, and is an image, a lock pattern, a PIN number, or key information (such as letters or symbols) determined by the target user's gaze, or input from a virtual keyboard.

[0030] One example of an operating method for determining a lock pattern with one's line of sight is a method that sequentially performs the steps of step S1 of displaying a UI on a screen, step S2 in which the user gazes at a point to be used as the starting point, step S3 in which the user confirms the starting point and draws a line by sequentially looking at the points of the lock pattern, and step S4 in which the user gazes at the end point to confirm the lock pattern.

[0031] One example of an operation method for inputting characters using a virtual keyboard with one's eyes is a method in which the user sequentially performs step S1 of gazing at the key to be input, step S2 of gazing at the key for a certain period of time as the background color of the key changes, and step S3 of inputting the character after the certain period of time has elapsed.

[0032] The two-factor authentication correct answer information 75 is information indicating the correct answer of the two-factor authentication pattern selected by the target user. The two-factor authentication pattern 74 and the two-factor authentication correct answer information 75 are managed as a set, and are collated with the information entered by the user at the time of authentication to determine whether or not authentication is possible. The user attributes 76 are various types of user information required by the PF authentication server 3, and include gender, age, language, etc.

[0033] Fig. 7 is a diagram showing an example of the contents of a user information database managed by an application server. As shown in Fig. 7, in a user information database 80, user information 81 is stored for each user who wears a head mounted display 2 and has a simulated experience. The user information 81 includes a user ID 82 and application / service information 83. The user ID 82 is the ID of a user who has registered an account. The application / service information 83 is information indicating which application / service the target user is using (registering).

[0034] Next, a general flow of processing executed by the authentication system 1 will be described with reference to Fig. 1. In step S1 of Fig. 1, a user wears the head mounted display 2 on his / her head. In step S2 of Fig. 1, the PF authentication server 3 performs biometric authentication (first authentication) using the eyes of the user wearing the head mounted display 2. In step S3 of Fig. 1, the PF authentication server 3 performs two-factor authentication (second authentication) using the eyes of the user wearing the head mounted display 2. In step S4 of Fig. 1, the PF authentication server completes user authentication.

[0035] In step S5 of FIG. 1, a request to execute an application / service is made from the head mounted display 2 to the application server 4. In step S6 of FIG. 1, the application server 4 responds to the request to execute an application / service by inquiring of an authentication result from the PF authentication server 3. In step S7 of FIG. 1, the application server 4 receives the authentication result from the PF authentication server 3. In step S8 of FIG. 1, the application server 4 authenticates the user as a result of authentication by the PF authentication server 3 and permits the use of the application. In step S9 of FIG. 1, the user starts using the application.

[0036] Next, a description will be given of the operation of the authentication system according to this embodiment. Fig. 8 is a flowchart showing an example of an account registration process in the head mounted display 2. First, initial settings of the head mounted display 2 and the like are performed (step S101).

[0037] Next, the control device 16 causes the user authentication processing unit 18 to execute account registration (step S102). Next, the user authentication processing unit 18 accepts input of user information 61 (step S103). Next, the user authentication processing unit 18 stores the accepted user information 61 in the storage device 17 (step S104).

[0038] Next, the user authentication processing unit 18 controls the camera 10 to capture an image of the iris of the user wearing the head mounted display 2 (step S105). Next, the communication processing unit 20 transmits the iris image captured by the camera 10 together with the user information 61 to the PF authentication server 3 (step S106).

[0039] Next, an account registration process is executed in the PF authentication server 3 (step S300). Details of this process will be described later. Next, the communication processing unit 20 receives a result of the account registration from the PF authentication server 3 (step S107). Next, a two-factor authentication information registration process is executed in the head mounted display 2 (step S200). Then, the account registration process in the head mounted display 2 ends.

[0040] FIG. 9 is a flowchart showing a two-factor authentication information registration process in the head mounted display 2, which is an example of the account registration process in the head mounted display 2.

[0041] First, the user authentication processing unit 18 selects one two-factor authentication pattern 74 from among a plurality of two-factor authentication patterns based on the user's line of sight detected by the sensor 15 (step S201).

[0042] Next, the user authentication processing unit 18 registers two-factor authentication correct answer information 75 indicating the correct answer of the two-factor authentication pattern based on the line of sight direction of the user detected by the sensor 15 (step S202).

[0043] Next, the communication processing unit 20 transmits two-factor authentication information including at least the two-factor authentication pattern 74 and the two-factor authentication answer information 75 to the PF authentication server 3 together with the user information 61 (step S203).

[0044] Next, the PF authentication server 3 executes a process of linking the two-factor authentication information to the user information (step S400). The details of this process will be described later.

[0045] Next, the communication processing unit 20 receives the registration result of the two-factor authentication information from the PF authentication server 3 (step S204). Next, the user authentication processing unit 18 displays the registration result on the display 11 (step S205). Then, the head mounted display 2 and the PF authentication server 3 become available (step S206). This ends the two-factor authentication information registration process in the head mounted display 2.

[0046] FIG. 10 is a flowchart showing an example of an account registration process in the PF authentication server 3.

[0047] First, the communication processing unit 34 receives an account registration request from the head mounted display 2 (step S301).

[0048] Next, the user management unit 33 judges whether the requesting user is already registered (step S302). If it is judged that the requesting user is already registered (YES in step S302), the communication processing unit 34 transmits a registered account result to the head mounted display 2 (step S303). This ends the account registration process in the PF authentication server 3.

[0049] On the other hand, if it is determined that the requesting user has not been registered (NO in step S302), the user management unit 33 registers the user information and biometric information (iris image) (step S304). Next, the communication processing unit 34 responds to the head mounted display 2 with the registration result of the user information and biometric information (step S305). This ends the account registration process in the PF authentication server 3.

[0050] FIG. 11 is a flowchart showing an example of an account registration process in the PF authentication server 3.

[0051] First, the communication processing unit 34 receives two-factor authentication information from the head mounted display 2 (step S401).

[0052] Next, the user management unit 33 judges whether the requesting user is already registered (step S402). If it is judged that the requesting user is already registered (YES in step S402), the communication processing unit 34 transmits a registered account result to the head mounted display 2 (step S403). This ends the account registration process in the PF authentication server 3.

[0053] On the other hand, if it is determined that the requesting user has not been registered (NO in step S402), the user management unit 33 registers the user information and the two-factor authentication information (step S404). Next, the communication processing unit 34 responds to the head mounted display 2 with the registration result of the user information and the two-factor authentication information (step S405). This ends the account registration process in the PF authentication server 3.

[0054] 12 is a flowchart showing an example of a user authentication process in the head mounted display 2. In this example, in the initial state, the head mounted display 2 is security locked.

[0055] First, the user authentication processing unit 18 controls the camera 10 to detect the eyes of the user wearing the head mounted display 2 (step S501). Next, the user authentication processing unit 18 controls the camera 10 to capture an image of the user's irises (step S502).

[0056] Then, the user authentication processing unit 18 acquires the iris image (step S503) Next, the communication processing unit 20 transmits encrypted data obtained by encoding the iris image to the PF authentication server 3 (step S504).

[0057] Next, the biometric authentication process is executed in the PF authentication server 3 (step S700). The details of this process will be described later.

[0058] Next, the communication processing unit 20 receives an authentication result of the biometric authentication process from the PF authentication server 3 (step S505). If the authentication result is successful (authentication OK in step S506), the two-factor authentication process is executed in the PF authentication server 3 (step S800). On the other hand, if the authentication result is unsuccessful (authentication NG in step S506), the security lock applied to the head mounted display 2 is not released, and the user authentication process in the head mounted display 2 ends.

[0059] Next, the communication processing unit 20 receives the authentication result of the two-factor authentication process from the PF authentication server 3 (step S507). If the authentication result is successful (authentication OK in step S508), the user authentication processing unit 18 releases the security lock applied to the head mounted display 2 (step S509). Then, the user authentication process in the head mounted display 2 ends.

[0060] On the other hand, if the authentication result in step S508 is unsuccessful (authentication NG in step S508), the security lock applied to the head mounted display 2 is not released, and the user authentication process in the head mounted display 2 ends.

[0061] FIG. 13 is a flowchart showing an example of a user authentication process in the head mounted display 2.

[0062] First, the user authentication processing unit 18 acquires the user information 61 (step S601). Next, the user authentication processing unit 18 acquires the two-factor authentication pattern 74 based on the user's line of sight direction detected by the sensor 15 (step S602). Next, the user authentication processing unit 18 controls the display 11 to display a two-factor authentication input screen for assisting the user in inputting two-factor authentication answer information 75 (step S603).

[0063] Next, the user authentication processing unit 18 acquires the two-factor authentication correct answer information 75 based on the line of sight of the user detected by the sensor 15 (step S604).

[0064] Next, the communication processing unit 20 transmits two-factor authentication information including at least the two-factor authentication pattern 74 and the two-factor authentication answer information 75 to the PF authentication server 3 together with the user information 61 (step S605).

[0065] Next, the two-factor authentication process is executed in the PF authentication server 3 (step S800). The details of this process will be described later.

[0066] Next, the communication processing unit 20 receives the authentication result of the two-factor authentication process from the PF authentication server 3 (step S606). If the authentication result is successful (authentication OK in step S607), the user authentication process in the head mounted display 2 ends.

[0067] On the other hand, if the authentication result is unsuccessful (authentication NG in step S607), it is determined whether the number of authentication failures exceeds a certain number (step S608). If it is determined that the number of failures exceeds the certain number (YES in step S608), the user authentication process in the head mounted display 2 ends. On the other hand, if it is determined that the number of failures does not exceed the certain number (NO in step S608), the process repeats step S603 to have the user re-input the two-factor authentication correct answer information 75.

[0068] FIG. 14 is a flowchart showing an example of the biometric authentication process in the PF authentication server 3.

[0069] First, the communication processing unit 34 receives a user authentication request from the head mounted display 2 (step S701). Next, the communication processing unit 34 acquires an iris image from the head mounted display 2 (step S702).

[0070] Next, the PF authentication processing unit 32 compares (matches) the iris image acquired in step S702 with a pre-registered iris image, and authenticates (first authentication) whether the user is a pre-registered person (step S703).

[0071] If the authentication is successful, that is, if the iris image matches the registered iris image (authentication OK in step S703), the user's account is unlocked (step S704).

[0072] On the other hand, if the authentication fails, that is, if the iris image does not match the registered iris image (authentication NG in step S703), the user's account remains locked (step S705).

[0073] Then, the communication processing unit 34 returns the authentication result to the head mounted display 2 or the application server 4 (step S706). This ends the biometric authentication process in the PF authentication server 3.

[0074] FIG. 15 is a flowchart showing an example of the two-factor authentication process in the PF authentication server 3.

[0075] First, the communication processing unit 34 receives two-factor authentication information including at least the two-factor authentication pattern 74 and the two-factor authentication answer information 75 from the head mounted display 2 together with the user information 61 (step S801).

[0076] Next, the PF authentication processing unit 32 compares (collates) the two-factor authentication pattern 74 and the two-factor authentication answer information 75 acquired in step S801 with the two-factor authentication pattern 74 and the two-factor authentication answer information 75 registered in advance, and authenticates (second authentication) whether the user is a registrant registered in advance (step S802).

[0077] Next, the communication processing unit 34 transmits the authentication result to the head mounted display 2 or the application server 4 (step S803). This ends the two-factor authentication process in the PF authentication server 3.

[0078] FIG. 16 is a flowchart showing an example of an application / service startup process in the head mounted display 2.

[0079] First, the application management unit 19 starts an application / service (step S901). Next, the user authentication processing unit 18 starts a user authentication process for the application / service (step S902).

[0080] Next, the communication processing unit 20 transmits a user authentication request to the application server 4 (step S903). Next, the application server 4 executes a user authentication process (step S1000). The details of this process will be described later.

[0081] Next, if the authentication result is successful (authentication OK in step S904), the application management unit 19 maintains the application / service in its activated state (step S905). Then, the application / service activation process in the head mounted display 2 ends.

[0082] On the other hand, if the authentication result is a failure in step S904 (authentication NG in step S904), the application management unit 19 ends the application / service being started (step S906). Then, the application / service start-up process in the head mounted display 2 ends.

[0083] FIG. 17 is a flowchart showing an example of a user authentication process in the application server 4.

[0084] First, the communication processing unit 49 receives an application / service execution request from the head mounted display 2 (step S1001).

[0085] Next, the communication processing unit 49 transmits a user authentication request to the PF authentication server 3 (step S1002).

[0086] Next, the communication processing unit 49 receives a result of the user authentication from the PF authentication server 3 (step S1003).

[0087] Next, if the authentication result is successful (authentication OK in step S1004), the user authentication processing unit 47 authenticates that the user is a pre-registered person (step S1005). Next, the communication processing unit 49 transmits a response of permission to use the application / service to the head mounted display 2 (step S1006). Then, the user authentication processing in the application server 4 ends.

[0088] On the other hand, if the authentication result is a failure in step S1004 (authentication NG in step S1004), the communication processing unit 49 transmits a response indicating that the application / service is not available to the head mounted display 2 (step S1007). Then, the user authentication process in the application server 4 ends.

[0089] FIG. 18 is a flowchart showing an example of the user authentication process in the PF authentication server 3.

[0090] First, the communication processing unit 34 receives an authentication request from the application server 4 (step S1101). Next, the PF authentication server 3 executes a user authentication process (step S1200).

[0091] Next, the PF authentication processing unit 32 performs authentication judgment of the user (step S1102). Next, the communication processing unit 34 returns the authentication result to the application server 4 (step S1103). Then, the user authentication processing in the PF authentication server 3 ends.

[0092] In this embodiment, the inventor has studied a mechanism for determining a UI object using the user's line of sight as an operation method in a head mounted display 2 where the field of vision is obstructed. Specifically, a function for determining a two-factor authentication pattern 74 is provided by applying a mechanism for changing the color of a UI object by gazing at it for a certain period of time. In this function, the determination of a UI object is confirmed by gazing at it for a certain period of time for all of the images, lock patterns, and PIN numbers exemplified as the two-factor authentication pattern 74. If the eyes are deviated from the UI object even slightly, the determination is reset as having failed, and the process is started over from the initial state. It is possible to determine where the user is currently looking by, for example, inverting the color of the UI object.

[0093] Next, an example of a process for determining a UI object by a line of sight will be described. Fig. 19 is a flowchart showing an example of an account registration process.

[0094] First, the user registers an account and selects an image for two-factor authentication from a PC or mobile device (step S1301).

[0095] Next, the PF authentication server 3 associates the user account with the registered image (step S1302), and the account registration process ends.

[0096] FIG. 20 is a flowchart showing an example of the user authentication process.

[0097] First, a plurality of images including a user-selected image are transmitted from the PF authentication server 3 to the HMD (step S1401).

[0098] Next, the user selects his / her own registered image from the images displayed on the HMD with his / her line of sight (step S1402).

[0099] Next, the PF authentication server 3 determines whether the image selected by the user is correct (step S1403).

[0100] As described above, in this embodiment, the account registration process and the user authentication process are performed using the iris image captured by the camera 10 mounted on the head mounted display 2 and the two-factor authentication element (second authentication element) that the user can determine with his / her line of sight. Therefore, the user only needs to move his / her eyes to perform the account registration process and the user authentication process. In this way, the user can complete the account registration process and the user authentication process by simply moving his / her eyes while remaining silent, which simplifies the operations required for authentication. Furthermore, there is no risk of information such as a password being overheard by those around, which improves security. In addition, it can be used conveniently even in noisy surroundings.

[0101] In this embodiment, the biometric authentication process and the two-factor authentication process are mainly performed by the PF authentication server 3, and a single sign-on is realized in which the application server 4 accesses the PF authentication server 3 at any time. Therefore, it is only necessary that the PF authentication server 3 stores information such as the biometric information 73, the two-factor authentication pattern 74 (input pattern), and the two-factor authentication correct answer information 75 (correct answer information), and it is not necessary to register this information in the application server 4.

[0102] The present invention is not limited to the above-described embodiment, and includes various modified examples. The above-described embodiment has been described in detail to clearly explain the present invention, and is not necessarily limited to those having all of the configurations described. Also, a part of the configuration of one embodiment can be replaced with the configuration of another embodiment. Also, the configuration of another embodiment can be added to the configuration of one embodiment. Also, other configurations can be added, deleted, or replaced with respect to part of the configuration of each embodiment.

[0103] The components of the present invention may be selected arbitrarily, and the invention having the selected components is also included in the present invention. Furthermore, the components described in the claims may be combined in combinations other than those explicitly stated in the claims.

[0104] In addition, the threshold that determines the success rate of iris authentication may be lowered when the second authentication factor is successful.

[0105] It should be noted that iris authentication may be performed without the user's knowledge while using the service.

[0106] When the head mounted display 2 is removed from the user's head and then reattached, only the iris authentication may be performed.

[0107] The above-described embodiment includes an authentication system having the following configuration. (Expression 1) An authentication system in which a head mounted display having a display for a simulated experience, an authentication server for authenticating whether a wearer of the head mounted display is a pre-registered person, and an application server for providing an application for the simulated experience to the display of the head mounted display are mutually connected via a network, The head mounted display includes: A processor; A camera for capturing an image of the wearer's iris; a memory for storing an iris image captured by the camera; A gaze direction detection unit that detects a gaze direction of the wearer; A communication unit that is connected to the authentication server, The processor, transmitting the iris image stored in the memory, the input pattern displayed on the display, and the gaze direction detected by the gaze direction detection unit to the authentication server via the communication unit; The authentication server, performing a first authentication for authenticating that the wearer is the registered person by comparing an iris image transmitted from the head mounted display with a pre-registered registered iris image, and then performing a second authentication for authenticating whether the wearer is the registered person based on an input pattern and a gaze direction transmitted from the head mounted display and pre-registered correct answer information; The application server includes: An authentication system that provides the application for the simulated experience to the display of the head-mounted display when the wearer is authenticated as a registered person by the authentication server after the second authentication is performed. (Expression 2) In the authentication system according to claim 1, The input pattern is one of an image, a lock pattern, and a PIN number. (Expression 3) In the authentication system according to Representation 1 or Representation 2, The input pattern is key information input from a virtual keyboard operated by the wearer's line of sight. (Expression 4) In the authentication system according to any one of Representation 1 to Representation 3, The authentication server, A storage unit in which the correct answer information is registered, An authentication system that extracts an input pattern selected by the wearer based on the input pattern and gaze direction transmitted from the head mounted display, and authenticates the wearer as the registered person when the extracted input pattern matches pre-registered correct answer information. (Expression 5) In the authentication system according to any one of Representation 1 to Representation 4, The processor, Transmitting the input pattern and the gaze direction to the authentication server together with user information indicating attributes of the wearer; The authentication server, An authentication system that performs processing to link the input pattern and the gaze direction to the user information. (Expression 6) In the authentication system according to any one of claims 1 to 5, The processor, an authentication system that determines that the gaze direction detected by the gaze direction detection unit is the gaze direction for the second authentication when a predetermined time has elapsed since the detection. (Expression 7) In the authentication system according to any one of claims 1 to 6, The processor, An authentication system that displays multiple images with different display positions on the display, and when the gaze direction detected by the gaze direction detection unit is directed toward a pre-registered image, determines that the gaze direction is the gaze direction for the second authentication. (Expression 8) In the authentication system according to any one of claims 1 to 7, An authentication system in which the first authentication and the second authentication are repeated a number of times, and a threshold that determines a success rate of the first authentication, iris authentication, is lowered when the second authentication is successful. (Expression 9) An authentication method using an authentication system in which a head mounted display having a display for a simulated experience, an authentication server for authenticating whether a wearer wearing the head mounted display is a pre-registered person, and an application server for providing an application for the simulated experience to the display of the head mounted display are mutually connected via a network, The head mounted display includes: Taking an image of the wearer's iris; storing the captured iris image; Detecting the gaze direction of the wearer, Transmitting the stored iris image, the input pattern displayed on the display, and the detected gaze direction to the authentication server; The authentication server, performing a first authentication for authenticating that the wearer is the registered person by comparing an iris image transmitted from the head mounted display with a pre-registered registered iris image, and then performing a second authentication for authenticating whether the wearer is the registered person based on an input pattern and a gaze direction transmitted from the head mounted display and pre-registered correct answer information; The application server includes: An authentication method in which, after the second authentication is performed, when the wearer is authenticated as a registered person by the authentication server, the application for the simulated experience is provided to the display of the head mounted display. (Expression 10) A program to be executed by a computer constituting an authentication server that authenticates whether a wearer who wears a head mounted display having a display for a simulated experience is a registered person who has been registered in advance, The computer includes: a step of performing a first authentication by comparing an iris image transmitted from the head mounted display with a registered iris image registered in advance to authenticate that the wearer is the registered person; A program for executing a second authentication step of authenticating whether the wearer is a registered person based on the input pattern and gaze direction transmitted from the head mounted display and pre-registered correct answer information. [Explanation of symbols]

[0108] 1: Authentication system, 2: Head-mounted display, 3: Authentication server, 4: Application server, 10: Camera, 11: Display

Claims

1. An authentication system in which a head mounted display having a display for a simulated experience, an authentication server for authenticating whether a wearer of the head mounted display is a pre-registered person, and an application server for providing an application for the simulated experience to the display of the head mounted display are mutually connected via a network, The head mounted display includes: A processor; A camera for capturing an image of the wearer's iris; a memory for storing an iris image captured by the camera; A gaze direction detection unit that detects a gaze direction of the wearer; A communication unit that is connected to the authentication server, The processor, transmitting the iris image stored in the memory, the input pattern displayed on the display, and the gaze direction detected by the gaze direction detection unit to the authentication server via the communication unit; The authentication server, performing a first authentication for authenticating that the wearer is the registered person by comparing an iris image transmitted from the head mounted display with a pre-registered registered iris image, and then performing a second authentication for authenticating whether the wearer is the registered person based on an input pattern and a gaze direction transmitted from the head mounted display and pre-registered correct answer information; The application server includes: An authentication system that provides the application for the simulated experience to the display of the head-mounted display when the wearer is authenticated as a registered person by the authentication server after the second authentication is performed.

2. 2. The authentication system according to claim 1, The input pattern is one of an image, a lock pattern, and a PIN number.

3. 2. The authentication system according to claim 1, The input pattern is key information input from a virtual keyboard operated by the wearer's line of sight.

4. 2. The authentication system according to claim 1, The authentication server, A storage unit in which the correct answer information is registered, An authentication system that extracts an input pattern selected by the wearer based on the input pattern and gaze direction transmitted from the head mounted display, and authenticates the wearer as the registered person when the extracted input pattern matches pre-registered correct answer information.

5. 2. The authentication system according to claim 1, The processor, Transmitting the input pattern and the gaze direction to the authentication server together with user information indicating attributes of the wearer; The authentication server, An authentication system that performs processing to link the input pattern and the gaze direction to the user information.

6. 2. The authentication system according to claim 1, The processor, an authentication system that determines that the gaze direction detected by the gaze direction detection unit is the gaze direction for the second authentication when a predetermined time has elapsed since the detection.

7. 2. The authentication system according to claim 1, The processor, An authentication system that displays multiple images with different display positions on the display, and when the gaze direction detected by the gaze direction detection unit is directed toward a pre-registered image, determines that the gaze direction is the gaze direction for the second authentication.

8. 2. The authentication system according to claim 1, An authentication system in which the first authentication and the second authentication are repeated a number of times, and a threshold value that determines a success rate of the first authentication, iris authentication, is lowered when the second authentication is successful.

9. An authentication method using an authentication system in which a head mounted display having a display for a simulated experience, an authentication server for authenticating whether a wearer wearing the head mounted display is a pre-registered person, and an application server for providing an application for the simulated experience to the display of the head mounted display are mutually connected via a network, The head mounted display includes: Taking an image of the wearer's iris; storing the captured iris image; Detecting the gaze direction of the wearer, Transmitting the stored iris image, the input pattern displayed on the display, and the detected gaze direction to the authentication server; The authentication server, performing a first authentication for authenticating that the wearer is the registered person by comparing an iris image transmitted from the head mounted display with a pre-registered registered iris image, and then performing a second authentication for authenticating whether the wearer is the registered person based on an input pattern and a gaze direction transmitted from the head mounted display and pre-registered correct answer information; The application server includes: An authentication method in which, after the second authentication is performed, when the wearer is authenticated as a registered person by the authentication server, the application for the simulated experience is provided to the display of the head-mounted display.

10. A program to be executed by a computer constituting an authentication server that authenticates whether a wearer who wears a head mounted display having a display for a simulated experience is a registered person who has been registered in advance, The computer includes: a step of performing a first authentication by comparing an iris image transmitted from the head mounted display with a registered iris image registered in advance to authenticate that the wearer is the registered person; A program for executing a step of performing a second authentication to authenticate whether the wearer is a registered person based on the input pattern and gaze direction transmitted from the head mounted display and pre-registered correct answer information.

Images