Update method, update program, information processing device, and collation processing system

Abstract

To provide an update method, update program, information processing device, and collation processing system that can improve collation efficiency.SOLUTION: An update method includes causing a computer to execute processing of: when collation data is acquired and authentication is performed by collating the collation data with at least one of pieces of registered data of users, determining an update priority of the registered data according to an authentication frequency of each user, and update the registered data according to the priority; and when new collation data is acquired, collating the new collation data with the registered data for which updating has been completed.SELECTED DRAWING: Figure 12

Description

[Technical field]

[0001] The present invention relates to an update method, an update program, an information processing device, and a verification processing system. [Background technology]

[0002] As an example of a biometric authentication system, a method has been disclosed in which, when an old template obtained by converting original fingerprint features using old transformation parameters is leaked, a new template is registered (replaced) by using new transformation parameters to replace the old template, thereby updating the template without re-acquiring the fingerprint (see, for example, Patent Document 1). [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2006-158851 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, if it takes a long time to change the number of documents, the time during which matching processing cannot be performed will increase, which may result in a decrease in matching efficiency.

[0005] In one aspect, an object of the present invention is to provide an update method, an update program, an information processing device, and a matching processing system that can improve matching efficiency. [Means for solving the problem]

[0006] In one aspect, the update method is characterized in that when comparison data is acquired, authentication is performed by comparing the comparison data with at least one of the registered data of each user, the computer determines a priority for updating the registered data according to the authentication frequency of each user, updates the registered data according to the priority, and, when new comparison data is acquired, compares the new comparison data with the registered data for which updating has been completed. Effect of the Invention

[0007] The matching efficiency can be improved. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 illustrates a biometric template protection technique. [Diagram 2] FIG. 10 is a diagram illustrating a matching process to which the biometric template protection technology is applied. [Diagram 3] 1 is a block diagram illustrating an example of an overall configuration of a verification processing system according to a first embodiment. [Figure 4] 11 is a diagram illustrating a registration data table stored in a biometric data management unit. FIG. [Diagram 5] FIG. 11 is a diagram illustrating a flowchart of a registration process. [Figure 6] FIG. 11 is a diagram illustrating a flowchart of a matching process. [Figure 7] FIG. 13 is a diagram illustrating an example of a user ID list. [Figure 8] FIG. 11 is a diagram illustrating an example of authentication results to be stored. [Figure 9] FIG. 13 is a flowchart illustrating a replacement washing control process; [Figure 10] FIG. 13 is a flowchart illustrating a replacement washing control process; [Figure 11] FIG. 11 is a diagram illustrating the result of step S23. [Figure 12] FIG. 13 is a diagram illustrating an example of a table. [Figure 13]FIG. 11 is a block diagram illustrating an example of an overall configuration of a verification processing system according to a second embodiment. [Figure 14] FIG. 2 illustrates an example of a cache. [Figure 15] FIG. 11 is a diagram illustrating a flowchart of a matching process according to the second embodiment. [Figure 16] FIG. 11 is a diagram illustrating an example of authentication results to be stored. [Figure 17] FIG. 11 is a flowchart illustrating a replacement control process according to the second embodiment. [Figure 18] FIG. 11 is a flowchart illustrating a replacement control process according to the second embodiment. [Figure 19] FIG. 11 is a block diagram illustrating an example of an overall configuration of a verification processing system according to a third embodiment. [Figure 20] FIG. 13 is a diagram illustrating an example of priority of replacement. [Figure 21] FIG. 13 is a diagram illustrating an example of the priority order of replacement. [Figure 22] 1A and 1B are block diagrams for explaining a hardware configuration. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Biometric authentication is a technology that uses biometric features such as fingerprints, faces, and veins to verify a person's identity. When identity verification is required, biometric authentication compares (matches) matching data acquired by a biometric sensor with pre-registered data, and determines whether the degree of similarity is equal to or exceeds a threshold for determining identity. Biometric authentication is used in a variety of fields, including bank ATMs and entrance / exit management, and has recently begun to be used for cashless payments at supermarkets, convenience stores, and other facilities.

[0010] To strengthen security, the matching processing system is equipped with a biometric protection template mechanism. Biometric features such as fingerprints and faces are used for personal authentication because they differ from person to person. However, if the registered data is leaked, there is a risk of impersonation using the leaked data. Therefore, it is difficult to re-register the registered data. As shown in Fig. 1, the biometric template protection technology converts biometric information extracted from a face image or vein image using conversion parameters (auxiliary information) and registers the converted data as registered data. During matching, matching data obtained by converting the biometric information using the auxiliary information in the same way is compared with the registered data. If the registered data is leaked, it is possible to re-register the registered data by re-converting the registered data using new auxiliary information.

[0011] In a matching processing system equipped with a biometric protection template mechanism, when enrollment data is leaked, the enrollment data of all users must be updated (re-washed) with new auxiliary information. However, during the period when the data is being re-washed with the new auxiliary information, matching processing cannot be performed, and matching efficiency decreases.

[0012] In the following embodiments, an update method, an update program, an information processing device, and a matching processing system that can improve the matching efficiency during the execution of a new check will be described.

[0013] First, each method of biometric authentication will be explained. There are two types of biometric authentication: 1:1 authentication, which checks for a match with registered data specified by an ID or card, and 1:N authentication, which searches for matching registered data from a group of registered data that includes other people's registered data. In stores, the 1:N authentication method is often preferred for its convenience. However, since biometric data fluctuates depending on the acquisition situation, the possibility of mismatches increases when the number of registered data to be searched increases. For this reason, the 1:N authentication method is sometimes implemented after narrowing down the matching targets using a simple PIN code, etc., and making the search set sufficiently small. The extent to which it needs to be small enough to be practical depends on the biometric authentication method. However, even if it is simple, entering a PIN code reduces convenience, so a biometric authentication system that does not require an ID or card is sometimes desired.

[0014] Therefore, a multi-biometric authentication has been proposed, which uses multiple types of modalities, performs a first authentication to narrow down the search set using matching data from the first modality, and performs a second authentication to identify the user using matching data from the second modality. A modality is a type of biometric feature, such as fingerprint, vein, iris, face shape, palm shape, etc. Therefore, the fingerprint and vein of the same finger are different modalities. Since it is inconvenient to input multiple modalities separately, a method of acquiring palm veins at the same time as inputting fingerprints, and a method of capturing a face image when inputting palm veins have been proposed.

[0015] The update method, update program, information processing device, and matching processing system described in the following embodiments are applicable to any authentication method, but a multi-biometric authentication method will be described as an example. EXAMPLES

[0016] As an example of a multi-biometric authentication method, we will explain a method in which candidates are narrowed down by face recognition in the first authentication, and the user is identified by palm vein patterns in the second authentication. In this method, for example, a list of N candidate users is created by face recognition, and 1:N authentication using palm vein patterns is performed within the resulting user list to identify the user.

[0017] FIG. 2 is a diagram illustrating a matching process to which the biometric template protection technology is applied. The client acquires facial feature data from a camera, converts it with auxiliary information to generate matching facial data, and transmits it to a server. The server compares the matching facial data received from the client with N registered facial data preloaded in memory, performs a narrowing process, manages the narrowed-down user ID list by linking it to a unique character string (list handle), and returns the list handle to the client. Next, the client acquires vein data, converts it with auxiliary information to generate matching vein data, and transmits it to the server together with the list handle. The server acquires the registered vein data from a database using the user ID list linked to the list handle received from the client, and performs 1:N authentication with the matching vein data received from the client.

[0018] Fig. 3 is a block diagram illustrating an example of the overall configuration of a matching processing system 400 according to the first embodiment. As illustrated in Fig. 3, the matching processing system 400 has a configuration in which a server 100 and a client 200 are connected via a telecommunication line 300 such as the Internet or a LAN (Local Area Network). The server 100 functions as an information processing device according to the present embodiment.

[0019] The server 100 includes a narrowing down unit 10, a list management unit 20, a vein authentication unit 30, an authentication result management unit 40, a replacement management unit 50, an authentication means control unit 60, a biometric data management unit 70, an auxiliary information management unit 80, etc. The client 200 includes a face image acquisition unit 110, a vein image acquisition unit 120, an auxiliary information acquisition unit 130, a face data generation unit 140, a vein data generation unit 150, etc. The matching processing system 400 includes a camera 160, a vein sensor 170, an input device 180, a display device 190, etc.

[0020] The biometric data management unit 70 stores in advance the registered face data and registered vein data for a plurality of users as registered data, linked to the user ID. Fig. 4 is a diagram illustrating a registered data table stored in the biometric data management unit 70. Note that auxiliary information used to generate the registered face data and registered vein data may be linked to the user ID. This allows the auxiliary information used to generate the registered face data and registered vein data to be referenced.

[0021] (Registration process) 5 is a diagram illustrating a flowchart of the registration process, which will be described below with reference to FIG.

[0022] First, the auxiliary information management unit 80 synchronizes the latest auxiliary information with the auxiliary information acquisition unit 130 of the client 200 (step S1). As a result, the auxiliary information acquisition unit 130 holds the latest auxiliary information. The auxiliary information is a code for encrypting and converting biometric information data. For example, the auxiliary information is a conversion code required for encrypting and converting by deforming the shape of a biometric body according to a predetermined rule. If the biometric information is converted using different auxiliary information, different biometric information data can be obtained. For example, the biometric information data can be obtained by distorting or curving a linear pattern or the like included in the biometric information according to a predetermined rule.

[0023] Next, the biometric data management unit 70 acquires from the client 200 the registered face data, the registered vein data, auxiliary information used to obtain the registered data, and the user ID (step S2). The registered face data is data obtained by converting the biometric information extracted from the face image acquired by the face image acquisition unit 110 from the camera 160 using the latest auxiliary information by the face data generation unit 140. The registered vein data is data obtained by converting the biometric information extracted from the vein image acquired by the vein image acquisition unit 120 from the vein sensor 170 using the latest auxiliary information by the vein data generation unit 150.

[0024] Next, the biometric data management unit 70 associates the registered face data, registered vein data, and auxiliary information acquired in step S2 with the user ID, and stores them in the registered data table of the biometric data management unit 70 (step S3). Then, the execution of the flowchart ends.

[0025] (Matching process) 6 is a diagram illustrating a flowchart of the matching process. The matching process will be described below with reference to FIG.

[0026] First, in the client 200, the auxiliary information acquisition unit 130 acquires the latest auxiliary information at a predetermined cycle from the auxiliary information management unit 80 of the server. Next, the face data generation unit 140 converts the biometric information extracted from the face image acquired by the face image acquisition unit 110 from the camera 160 using the latest auxiliary information to generate face data for matching.

[0027] The narrowing down unit 10 acquires face data for matching from the client 200 (step S11). The data amount of the face data for matching and the registered face data is smaller than the data amount of the vein data for matching and the registered vein data. This can reduce the time required for narrowing down.

[0028] Next, the narrowing-down unit 10 compares the face data for comparison acquired in step S11 with the registered face data stored in the biometric data management unit 70, and narrows down the user IDs whose similarity is equal to or greater than a threshold value (step S12).

[0029] Next, the narrowing down unit 10 creates a user ID list, creates a list handle that uniquely identifies the user ID list, and holds the user ID list in association with the list handle (step S13). Fig. 7 is a diagram illustrating an example of a user ID list.

[0030] Next, the narrowing down unit 10 transmits the list handle held in step S13 to the client 200 (step S14).

[0031] Next, the vein authentication unit 30 acquires the matching vein data and the list handle from the client 200 (step S15). The matching vein data is data generated by the vein data generation unit 150 by converting the biometric information extracted from the vein image acquired by the vein image acquisition unit 120 from the vein sensor 170 using the latest auxiliary information.

[0032] Next, the vein authentication unit 30 compares the matching vein data acquired in step S15 with the registered vein data associated with the user ID list among the registered vein data stored in the biometric data management unit 70 (step S16).

[0033] Next, the vein authentication unit 30 judges whether or not there is registered vein data whose similarity is equal to or greater than a threshold value (step S17). By executing step S17, it is possible to judge whether or not authentication has been successful.

[0034] If the result of the determination in step S17 is "Yes", the vein authentication unit 30 outputs information related to successful authentication (step 18).

[0035] If the result of the determination in step S17 is "No", the vein authentication unit 30 outputs information related to authentication failure (step S19).

[0036] After step S18 or step S19 is executed, the authentication result management unit 40 accumulates the authentication result (step S20). For example, FIG. 8 is a diagram illustrating the accumulated authentication results. As illustrated in FIG. 8, the authentication date and time and the authentication result are associated with the user ID and accumulated. Thereafter, the execution of the flowchart ends. Note that both authentication success and authentication failure authentication results may be accumulated, or only authentication results related to authentication success may be accumulated.

[0037] (Washing control process) 9 and 10 are diagrams illustrating a flowchart of the replacement control process. The replacement control process will be described below with reference to FIG. 9 and FIG. 10. The replacement control process is repeatedly executed at a predetermined cycle, such as once a year, once a month, or once a week. Alternatively, the replacement control process is automatically executed when a leak of the registered data stored in the biometric data management unit 70 is confirmed. Alternatively, the replacement control process is executed when an administrator or the like issues an instruction using the input device 180 or the like.

[0038] The auxiliary information management unit 80 generates the latest auxiliary information (step S21).

[0039] Next, the replacement management unit 50 calculates the authentication frequency for each of all users stored in the biometric data management unit 70 (step S22). For example, the replacement management unit 50 refers to the authentication results stored in the authentication result management unit 40 and calculates the number of authentications per unit period. In this case, only the number of authentication results related to authentication success may be used, or the total number of authentication successes and authentication failures may be used.

[0040] Next, the replacement management unit 50 sets the priority of users whose authentication frequency is equal to or greater than the threshold to "high" and sets the priority of users whose authentication frequency is less than the threshold to "low" (step S23). Fig. 11 is a diagram illustrating the result of step S23. As illustrated in Fig. 11, the replacement management unit 50 sets the priority of users whose authentication frequency is equal to or greater than the threshold to "high" and sets the priority of users whose authentication frequency is less than the threshold to "low."

[0041] Next, the replacement management unit 50 starts replacement for high-priority users using the latest auxiliary information generated in step S21 (step S24). Specifically, the replacement management unit 50 sequentially converts each registered face data and each registered vein data stored in the biometric data management unit 70 for high-priority users using the latest auxiliary information. Note that the replacement management unit 50 holds information indicating that replacement has been performed for users for whom replacement has been completed. For example, the replacement management unit 50 holds a table as shown in FIG. 12.

[0042] Next, the replacement management unit 50 prohibits the matching process using the old auxiliary information (step S25).

[0043] Next, the re-cleaning management unit 50 determines whether or not the re-cleaning has been completed for all registered data of high-priority users (step S26).

[0044] If it is determined to be "No" in step S26, the authentication means control unit 60 prohibits the matching process in Fig. 6, enables the alternative authentication means, and performs the alternative authentication process (step S27). For example, a password authentication process that does not use biometric data is performed. Then, step S26 is performed.

[0045] If the result of the determination in step S26 is "Yes," the replacement management unit 50 starts replacement of the low-priority users using the latest auxiliary information generated in step S21 (step S28). Specifically, the replacement management unit 50 sequentially converts each registered face data and each registered vein data stored in the biometric data management unit 70 for the low-priority users using the latest auxiliary information.

[0046] Next, the re-cleaning management unit 50 judges whether or not the re-cleaning has been completed for all registered data of users with low priority (step S29).

[0047] 6 is requested, the authentication means control unit 60 allows only the registered data of a user with a high priority (step S30). By executing step S30, only the registered face data that has been replaced is used when step S12 is executed, and only the registered vein data that has been replaced is used when step S16 is executed.

[0048] Next, the authentication means control unit 60 judges whether or not information related to successful authentication has been output as a result of the execution of the matching process (step S31). If the judgment in step S31 is "Yes", the execution of the flowchart ends.

[0049] If the result of step S31 is "No," the authentication means control unit 60 enables the alternative authentication means and performs an alternative authentication process (step S32). For example, a password authentication process that does not use biometric data is performed. Then, step S29 is performed again.

[0050] If the result of the determination in step S29 is "Yes", the authentication means control unit 60 disables the alternative authentication means (step S33).

[0051] Next, the authentication means control unit 60 allows the matching process to be performed using all registered data (step S34). By executing step S34, all registered face data is used when executing step S12, and all registered vein data is used when executing step S16. Thereafter, the execution of the flowchart ends.

[0052] According to this embodiment, since the registered data is replaced, even if the registered data is leaked, it is possible to prevent impersonation. While the replacement is being performed, the matching process is prohibited, but since an alternative authentication means is allowed, it is possible to suppress a decrease in user convenience. In addition, when the authentication history of each user is accumulated and a bias in the authentication frequency occurs, it is possible to use the bias in the authentication frequency among users to preferentially replace the registered data of the registered users who are authenticated frequently. As a result, even if the replacement of the registered data occurs due to a leak or the like, it is possible to shorten the system downtime for the registered users who are authenticated frequently. As a result, even if the replacement of the registered data is started, the possibility of performing the necessary matching process is high, which results in improved matching efficiency. EXAMPLES

[0053] Fig. 13 is a block diagram illustrating an example of the overall configuration of a verification processing system 400a according to a second embodiment. As illustrated in Fig. 13, the verification processing system 400a has a server 100a instead of the server 100. The server 100a differs from the server 100 in that it further includes a cache management unit 90. In addition, the server 100a has a plurality of clients 200. For example, each client 200 is provided in each store.

[0054] The cache management unit 90 creates and holds a cache (subset) for a set of users stored in the biometric data management unit 70. For example, the cache management unit 90 may create a cache according to the frequency of use of each store by users. For example, as illustrated in FIG. 14, the cache management unit 90 creates a cache for each store that contains the top 10% of users with the most successful authentications. For example, in the case where store A has 10,000 users who have been successfully authenticated in the past, the cache contains the top 10% (thousand users) with the most successful authentications.

[0055] (Matching process) 15 is a diagram illustrating a flowchart of a matching process according to the second embodiment. First, in the client 200, the auxiliary information acquisition unit 130 acquires the latest auxiliary information at a predetermined cycle from the auxiliary information management unit 80 of the server. Next, the face data generation unit 140 converts the biometric information extracted from the face image acquired by the face image acquisition unit 110 from the camera 160 using the latest auxiliary information to generate face data for matching.

[0056] The narrowing-down unit 10 acquires a store ID and face data for matching from the client 200 (step S41). The data amount of the face data for matching and the registered face data is smaller than the data amount of the vein data for matching and the registered vein data. This can reduce the time required for narrowing down.

[0057] Next, the narrowing down unit 10 compares the face data for matching with the registered face data of the user ID included in the cache identified by the store ID among the registered face data stored in the biometric data management unit 70, and narrows down the user IDs whose similarity is equal to or greater than a threshold (step S42). If there is no corresponding user ID, the matching targets may be increased to all users who have been successfully authenticated at the store in the past, and if there is still no corresponding user ID, the matching targets may be increased to all users stored in the biometric data management unit 70.

[0058] Next, the narrowing-down unit 10 creates a user ID list, creates a list handle that uniquely identifies the user ID list, and holds the user ID list linked to the list handle (step S43).

[0059] Next, the narrowing down unit 10 transmits the list handle held in step S43 to the client 200 (step S44).

[0060] Next, the vein authentication unit 30 acquires the store ID, the vein data for matching, and the list handle from the client 200 (step S45). The vein data for matching is data generated by the vein data generation unit 150 by converting the biometric information extracted from the vein image acquired by the vein image acquisition unit 120 from the vein sensor 170 using the latest auxiliary information. Next, the vein authentication unit 30 compares the matching vein data acquired in step S45 with the registered vein data associated with the user ID list among the registered vein data stored in the biometric data management unit 70 (step S46).

[0061] Next, the vein authentication unit 30 judges whether or not there is registered vein data whose similarity is equal to or greater than a threshold value (step S47). By executing step S47, it is possible to judge whether or not authentication has been successful.

[0062] If the result of the determination in step S47 is "Yes", the vein authentication unit 30 outputs information related to successful authentication (step 48).

[0063] If the result of the determination in step S47 is "No", the vein authentication unit 30 outputs information related to authentication failure (step S49).

[0064] After step S48 or step S49 is executed, the authentication result management unit 40 accumulates the authentication result (step S50). For example, FIG. 16 is a diagram illustrating the accumulated authentication results. As illustrated in FIG. 16, the authentication date and time, the authentication result, and the store ID are associated with the user ID and accumulated. Thereafter, the execution of the flowchart ends. Note that both authentication success and authentication failure authentication results may be accumulated, or only authentication results related to authentication success may be accumulated.

[0065] (Washing control process) 17 and 18 are diagrams illustrating a flowchart of the replacement control process according to the second embodiment. The replacement control process is repeatedly executed at a predetermined cycle, such as once a year, once a month, or once a week. Alternatively, the replacement control process is automatically executed when a leak of the registered data stored in the biometric data management unit 70 is confirmed. Alternatively, the replacement control process is executed when an administrator or the like issues an instruction using the input device 180 or the like.

[0066] The auxiliary information management unit 80 generates the latest auxiliary information (step S51).

[0067] Next, the replacement management unit 50 calculates the authentication frequency for each of all users stored in the biometric data management unit 70 (step S52). For example, the replacement management unit 50 refers to the authentication results stored in the authentication result management unit 40 and calculates the number of authentications per unit period. In this case, the total number of authentication successes and authentication failures may be used, or only the number of authentication results related to authentication success may be used.

[0068] Next, the cache management unit 90 records a predetermined percentage of users with the highest authentication frequency for each store as a cache (step S53). For example, the cache management unit 90 records users with the highest authentication frequency of 10% as a cache, as described in FIG.

[0069] Next, the replacement management unit 50 judges whether the number of users included in each cache is equal to or greater than a predetermined number (for example, 1000 people) (step S54).

[0070] If the result of the determination in step S54 is "Yes," the re-polishing management unit 50 sets the priority of the predetermined number of users to "high" for each cache (step S55).

[0071] If the result of step S55 is "No", the re-cleaning management unit 50 sets the priority of all users included in each cache to "high" (step S56). Note that if the number of users for a certain cache is equal to or greater than a predetermined number, the priority of the predetermined number of users for that cache is set to "high".

[0072] It should be noted that for users who were not given the "high" priority in steps S55 and S56, the re-classification management unit 50 gives them the "low" priority.

[0073] After step S55 or step S56 is executed, the replacement management unit 50 starts replacement for high-priority users using the latest auxiliary information generated in step S51 (step S57). Specifically, the replacement management unit 50 sequentially converts each registered face data and each registered vein data stored in the biometric data management unit 70 for high-priority users using the latest auxiliary information.

[0074] Next, the replacement management unit 50 prohibits the matching process using the old auxiliary information (step S58).

[0075] Next, the re-cleaning management unit 50 judges whether or not the re-cleaning has been completed for all registered data of high-priority users (step S59).

[0076] If the result of step S59 is "No", the authentication means control unit 60 prohibits the matching process, enables the alternative authentication means, and performs the alternative authentication process (step S60). For example, a password authentication process that does not use biometric data is performed. Then, step S59 is performed.

[0077] If the result of step S59 is "Yes," the replacement management unit 50 starts replacement of low-priority users using the latest auxiliary information generated in step S51 (step S61). Specifically, the replacement management unit 50 sequentially converts each registered face data and each registered vein data stored in the biometric data management unit 70 for low-priority users using the latest auxiliary information.

[0078] Next, the re-cleaning management unit 50 judges whether or not the re-cleaning has been completed for all registered data of users with low priority (step S62).

[0079] If the result of step S62 is "No" and a matching process is requested, the authentication means control unit 60 allows only the registered data of a user with a high priority (step S63). By executing step S63, only the registered face data that has been replaced is used when step S42 is executed, and only the registered vein data that has been replaced is used when step S46 is executed.

[0080] Next, the authentication means control unit 60 judges whether or not information related to successful authentication has been output as a result of the execution of the matching process (step S64). If the judgment in step S64 is "Yes", the execution of the flowchart ends.

[0081] If the result of step S64 is "No," the authentication means control unit 60 enables the alternative authentication means and performs an alternative authentication process (step S65). For example, a password authentication process that does not use biometric data is performed. Then, step S62 is performed again.

[0082] If the result of the determination in step S62 is "Yes", the authentication means control unit 60 disables the alternative authentication means (step S66).

[0083] Next, the authentication means control unit 60 allows the matching process to be performed using all registered data (step S67). By executing step S67, all registered face data is used when step S42 is executed, and all registered vein data is used when step S46 is executed. After that, the execution of the flowchart ends.

[0084] According to this embodiment, even if a recheck is required in a store that a certain user frequently visits, the registered data of the user is more likely to be given priority for rechecking, thereby improving the efficiency of the recheck. EXAMPLES

[0085] Fig. 19 is a block diagram illustrating an example of an overall configuration of a matching processing system 400b according to Example 3. As illustrated in Fig. 19, the matching processing system 400b has a server 100b instead of the server 100. The server 100b differs from the server 100a of Example 2 in that the server 100b further includes a priority determination unit 95.

[0086] In this embodiment, the priority determination unit 95 manages the priority of the re-cleaning among a plurality of caches, and controls so that the order of the re-cleaning among the plurality of caches is uniform. For example, in the example of FIG. 20, users with high priority of the re-cleaning for store A include User0000001, User0000002, User0000004, and User0000005. Users with high priority of the re-cleaning for store B include User0000003 and User0000006. The priority determination unit 95 determines the priority of the re-cleaning by mixing users with high priority for store A and users with high priority for store B, so that users with high priority for store A are not re-cleaned far earlier than users with high priority for store B. For example, in the example of FIG. 21, the order is uniformed so that users with high priority for store A and users with high priority for store B are alternately re-cleaned.

[0087] According to this embodiment, it is possible to prevent bias in the order in which rechecking is performed between caches, and therefore it is possible to prevent users of a specific store from having to wait a long time for the matching process when rechecking.

[0088] The upper limit of user settings with high priority for updating registered data using the latest auxiliary information may be changed for each cache. For example, since store A has a large number of users, the number of users recorded in the authentication result of store A is 150,000, of which 10% (1,500) are recorded in the cache for store A. Since store B has a small number of users, the number of users recorded in the authentication result is 5,000, of which 10% (500) are recorded in the cache for store B. Here, if the user settings with high priority for each cache are 1,000 from the users with the most authentications, the remaining 500 are set as low priority users when using the cache for store A, which has a large number of users, and since only 500 are registered in the cache for store B, the priority of updating can be set high for all cache users. Therefore, the upper limit of user settings with high priority for updating may be changed for each cache, such as setting the upper limit of high priority user settings for the cache for store A to 1,200 and the upper limit of high priority user settings for the cache for store B to 300.

[0089] In the above examples, one client 200 includes the face image acquisition unit 110, the vein image acquisition unit 120, the face data generation unit 140, and the vein data generation unit 150, but is not limited to this. For example, the vein image acquisition unit 120 and the vein data generation unit 150 may be provided in a higher performance edge server such as a GPU, separately from the client 200.

[0090] FIG. 22(a) is a block diagram for explaining the hardware configuration of the server 100. As illustrated in FIG. 22(a), the server 100 includes a CPU 101, a RAM 102, a storage device 103, a communication device 104, and the like. These devices are connected by a bus or the like. The CPU (Central Processing Unit) 101 is a central processing unit. The RAM (Random Access Memory) 102 is a volatile memory that temporarily stores a program executed by the CPU 101, data processed by the CPU 101, and the like. The storage device 103 is a non-volatile storage device. For example, a ROM (Read Only Memory), a solid state drive (SSD) such as a flash memory, or a hard disk driven by a hard disk drive can be used as the storage device 103. The CPU 101 executes an update program stored in the storage device 103 to realize the function of each part of the server 100. The function of each part of the server 100 may be configured by a dedicated circuit or the like. The communication device 104 is an interface to the electric communication line 300. The servers 100a and 100b have the same configuration.

[0091] FIG. 22(b) is a block diagram for explaining the hardware configuration of the client 200. As illustrated in FIG. 22(b), the client 200 includes a CPU 201, a RAM 202, a storage device 203, a communication device 204, and the like. These devices are connected by a bus or the like. The CPU 201 is a central processing unit. The RAM 202 is a volatile memory that temporarily stores a program executed by the CPU 201, data processed by the CPU 201, and the like. The storage device 203 is a non-volatile storage device. For example, a solid state drive such as a ROM or a flash memory, or a hard disk driven by a hard disk drive can be used as the storage device 203. The CPU 201 executes a program stored in the storage device 203 to realize the functions of each of the face image acquisition unit 110, the vein image acquisition unit 120, the auxiliary information acquisition unit 130, the face data generation unit 140, and the vein data generation unit 150 of the client 200. Note that these functions of the client 200 may be configured by dedicated circuits or the like. The communication device 204 is an interface to the telecommunications line 300 .

[0092] In each of the above examples, the narrowing down unit 10 and the vein authentication unit 30 are an example of an authentication unit that performs authentication by matching the matching data with at least one of the registered data of each user when the matching data is acquired. The replacement management unit 50 is an example of a determination unit that determines the priority of updating the registered data according to the authentication frequency of each user, and is an example of an update unit that updates the registered data according to the priority. The cache management unit 90 is an example of a cache management unit that adds users with an authentication frequency equal to or higher than a certain level to a cache set. The authentication means control unit 60 is an example of an authentication means control unit that requests an alternative authentication means from the user of the new matching data.

[0093] Although the embodiments of the present invention have been described in detail above, the present invention is not limited to such specific embodiments, and various modifications and variations are possible within the scope of the gist of the present invention described in the claims. (Appendix 1) When verification data is acquired, authentication is performed by verifying the verification data with at least one of the registered data of each user, The computer determining a priority for updating the registration data according to the authentication frequency of each user; updating the registration data according to the priority; An updating method comprising the steps of: when new matching data is acquired, executing a process of matching the new matching data with the registered data for which updating has been completed. (Appendix 2) The updating method according to claim 1, characterized in that when updating the registered data of each user, the registered data is converted using common conversion parameters. (Appendix 3) The updating method according to claim 2, wherein the new matching data is data transformed using the common transformation parameters. (Appendix 4) The update method according to claim 1, characterized in that the priority is set to high or low based on a predetermined threshold for the authentication frequency, and the registered data with a higher priority is updated before the registered data with a lower priority. (Appendix 5) The update method described in Appendix 1, characterized in that a user whose authentication frequency is equal to or higher than a certain level is added to a cache set, and the new matching data is matched with the registration data of the user included in the cache set. (Appendix 6) The update method described in Appendix 5, characterized in that when new matching data is obtained and the registration data of all users included in the cache set has been updated, the matching is narrowed down to users for which the update has been completed. (Appendix 7) The update method described in Appendix 5, characterized in that when the new matching data is obtained and the registered data of some users included in the cache set has not been updated, matching with the registered data is prohibited and an alternative authentication means is requested from the user of the new matching data. (Appendix 8) The updating method described in Appendix 1, characterized in that each of the matching data and the enrollment data includes first biometric information relating to a first modality and second biometric information relating to a second modality different from the first modality. (Appendix 9) When verification data is acquired, authentication is performed by verifying the verification data with at least one of the registered data of each user, To your computer determining a priority for updating the registration data according to the authentication frequency of each user; updating the registration data according to the priority; An update program characterized in that, when new verification data is acquired, a process is executed to verify the new verification data with the registered data whose update has been completed. (Appendix 10) The update program according to claim 9, wherein when updating the registration data of each user, the registration data is converted using common conversion parameters. (Appendix 11) The update program according to claim 10, wherein the new matching data is data converted using the common conversion parameter. (Appendix 12) The update method according to claim 9, further comprising: setting the priority of the authentication frequency to high or low based on a predetermined threshold; and updating registered data with a higher priority before updating registered data with a lower priority. (Appendix 13) The update method according to claim 9, further comprising: adding a user whose authentication frequency is equal to or higher than a certain level to a cache set; and comparing the new matching data with the registration data of the user included in the cache set. (Appendix 14) The update program described in Appendix 13, characterized in that when the new matching data is obtained and the registration data of all users included in the cache set has been updated, the matching is narrowed down to users for which the update has been completed. (Appendix 15) The update program described in Appendix 13, characterized in that when the new matching data is obtained and the registration data of some users included in the cache set has not been updated, matching with the registration data is prohibited and an alternative authentication method is requested of the user of the new matching data. (Appendix 16) The update program described in Appendix 9, characterized in that each of the matching data and the enrollment data includes first biometric information relating to a first modality and second biometric information relating to a second modality different from the first modality. (Appendix 17) an authentication unit that, when acquiring the verification data, authenticates the user by comparing the verification data with at least one of the registered data of each user; a determination unit that determines a priority of updating the registered data according to an authentication frequency of each user; an update unit that updates the registration data in accordance with the priority; The information processing apparatus according to claim 1, wherein the authentication unit, when acquiring new verification data, compares the new verification data with the registered data whose update has been completed. (Appendix 18) The information processing device according to claim 17, wherein the update unit converts the registered data using common conversion parameters when updating the registered data of each user. (Appendix 19) The information processing device according to claim 18, wherein the new matching data is data converted using the common conversion parameter. (Appendix 20) The information processing device described in Appendix 17, characterized in that the update unit sets the priority to high or low based on a predetermined threshold for the authentication frequency, and updates the registered data with a higher priority before the registered data with a lower priority. (Appendix 21) a cache management unit that adds a user having a certain authentication frequency or more to a cache set; The information processing device according to claim 17, wherein the authentication unit compares the new matching data with the registration data of the user included in the cache set. (Appendix 22) The information processing device described in Appendix 21, characterized in that when the authentication unit obtains new matching data and the registration data of all users included in the cache set has been updated, the authentication unit narrows down the matching to users for which the update has been completed. (Appendix 23) The information processing device described in Appendix 21 is characterized in that, when the new matching data is obtained and the registered data of some users included in the cache set has not been updated, the information processing device is provided with an authentication means control unit that prohibits matching with the registered data and requests an alternative authentication means from the user of the new matching data. (Appendix 24) The information processing device described in Appendix 17, characterized in that each of the matching data and the enrollment data includes first biometric information relating to a first modality and second biometric information relating to a second modality different from the first modality. (Appendix 25) A verification processing system that, when verification data is acquired from at least one of a plurality of acquisition devices, authenticates a user by verifying the verification data with at least one of registered data of each user, comprising: a storage unit configured to store an authentication frequency of each user for each of the plurality of acquisition devices; a determination unit that determines an update order of the registration data such that the registration data is mixed among the plurality of acquisition devices according to an authentication frequency of each user; an update unit that updates the registration data in accordance with the order; A matching processing system comprising: a matching unit that, when new matching data is acquired, matches the new matching data with the registered data whose update has been completed. [Explanation of symbols]

[0094] 10. Narrowing section 20 List Management Department 30 Vein authentication unit 40 Authentication Result Management Unit 50 Washing Management Department 60 Authentication means control section 70 Biometric Data Management Department 80 Auxiliary Information Management Department 100,100a,100b servers 110 Face image acquisition unit 120 Vein image acquisition unit 130 Auxiliary information acquisition unit 140 Face Data Generation Unit 150 Vein data generation unit 160 Camera 170 Vein Sensor 180 Input Devices 190 Display device 200 clients 400, 400a, 400b Matching Processing System

Claims

1. When verification data is acquired, authentication is performed by verifying the verification data with at least one of the registered data of each user, The computer determining a priority for updating the registration data according to the authentication frequency of each user; updating the registration data according to the priority; An updating method comprising the steps of: when new matching data is acquired, executing a process of matching the new matching data with the registered data for which updating has been completed.

2. 2. The method according to claim 1, wherein when the registered data of each user is updated, the registered data is converted using a common conversion parameter.

3. 3. The method according to claim 2, wherein the new verification data is data that has been transformed using the common transformation parameters.

4. 2. The method according to claim 1, wherein the priority is set to high or low based on a predetermined threshold value for the authentication frequency, and the registered data with a higher priority is updated before the registered data with a lower priority.

5. 2. The method according to claim 1, further comprising adding a user whose authentication frequency is equal to or higher than a certain level to a cache set, and matching the new matching data with the registered data of the user included in the cache set.

6. The update method described in claim 5, characterized in that when new matching data is obtained and the registration data of all users included in the cache set has been updated, the matching is narrowed down to users for which the update has been completed.

7. The update method described in claim 5, characterized in that when new matching data is obtained and the registration data of some users included in the cache set has not been updated, matching with the registration data is prohibited and an alternative authentication means is requested from the user of the new matching data.

8. The updating method according to claim 1, characterized in that each of the matching data and the enrollment data includes first biometric information relating to a first modality and second biometric information relating to a second modality different from the first modality.

9. When verification data is acquired, authentication is performed by verifying the verification data with at least one of the registered data of each user, To your computer determining a priority for updating the registration data according to the authentication frequency of each user; updating the registration data according to the priority; An update program characterized in that, when new verification data is acquired, a process is executed to verify the new verification data with the registered data whose update has been completed.

10. an authentication unit that, when acquiring the verification data, authenticates the user by comparing the verification data with at least one of the registered data of each user; a determination unit that determines a priority of updating the registered data according to an authentication frequency of each user; an update unit that updates the registration data in accordance with the priority; The information processing apparatus according to claim 1, wherein the authentication unit, when acquiring new verification data, compares the new verification data with the registered data whose update has been completed.

11. an authentication unit that, when acquiring matching data from at least one of a plurality of acquisition devices, authenticates the user by comparing the matching data with at least one of the registered data of each user; a storage unit configured to store an authentication frequency of each user for each of the plurality of acquisition devices; a determination unit that determines an update order of the registration data such that the registration data is mixed among the plurality of acquisition devices according to an authentication frequency of each user; an update unit that updates the registration data in accordance with the order; A matching processing system comprising: a matching unit that, when new matching data is acquired, matches the new matching data with the registered data whose update has been completed.

Images