Authentication device, method of controlling authentication device, and program

Abstract

To provide an authentication method of high safety.SOLUTION: An authentication device comprises: storage means 206 for storing a key column S in a memory in association with identification information of a user; generation means 207 for generating a gesture column T by converting the key column S stored in the storage means 206; acquisition means 207 for acquiring a gesture detection result; and authentication means 207 for determining whether or not a gesture authentication is successful on the basis of a gesture column T' as the gesture detection result acquired by the generation means 207 and the gesture column T generated by the generation means 207. The generation means 207 generates the gesture column T such that the key column S cannot be uniquely estimated from the gesture column T.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to authentication processing. [Background technology]

[0002] In recent years, a new authentication technology called gesture authentication has been proposed. Gesture authentication is a technology in which the person to be authenticated (user) is authenticated by making gestures using their hands, face, etc. In gesture authentication, the person to be authenticated registers a secret gesture in the authentication system beforehand prior to authentication. Then, at the time of authentication, the person to be authenticated makes a secret gesture in front of a camera. Authentication is successful only when it is determined that the person to be authenticated has made the secret gesture.

[0003] Gesture authentication can be used, for example, to unlock a locked door. Unlike authentication using a keypad, it has the advantage of being hygienic because it can be unlocked without contact. Gesture authentication can also be used to complement biometric authentication. Biometric authentication is a technology that uses a person's biometric information, such as face authentication and fingerprint authentication, to authenticate an individual.

[0004] Biometric authentication has two major problems. The first is the problem of failures called false acceptance and false rejection. For example, if false acceptance occurs in a payment service that uses facial recognition, there is a risk that payments will be made to someone else's account. The second is the problem of vulnerability to attacks called spoofing. For example, in the case of facial recognition, there is a spoofing attack called presentation attack. This is an attack in which a malicious third party impersonates the target and breaks through authentication by holding up a paper with the target's face printed on it to the camera or by standing in front of the camera wearing a high-resolution mask that resembles the target's face. These problems can be mitigated by combining biometric authentication with gesture authentication.

[0005] Patent Document 1 discloses a technology for performing authentication by combining biometric authentication such as face recognition with revealing a PIN number by finger gestures. Patent Document 2 discloses a technology for performing authentication by gestures input in the air by the person to be authenticated after face recognition. Patent Document 3 discloses a technology for performing authentication by movements of organs such as the eyes, mouth, eyebrows, head, and arms in addition to face recognition. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Patent No. 6897831 [Patent Document 2] JP 2021-119428 A [Patent Document 3] JP 2017-004398 A Summary of the Invention [Problem to be solved by the invention]

[0007] However, the methods disclosed in Patent Documents 1 to 3 have a drawback in that if a malicious third party spies on or records the gesture authentication, the gestures can be stolen. Even if an authentication system that combines biometric authentication and gesture authentication is constructed, if a malicious third party steals the gestures, there is a risk that the authentication can be broken through by an advanced presentation attack using face moving image synthesis technology (deep fake).

[0008] The present invention has been made in consideration of the above problems, and an object of the present invention is to provide an authentication method with high security. [Means for solving the problem]

[0009] In order to achieve the above-mentioned object, an authentication device according to one aspect of the present invention includes a storage means for storing a key sequence S in a memory in correspondence with a user's identification information, a generation means for converting the key sequence S stored in the storage means to generate a gesture sequence T, an acquisition means for acquiring a gesture detection result, and an authentication means for determining whether gesture authentication has been successful based on the gesture sequence T' as the gesture detection result acquired by the acquisition means and the gesture sequence T generated by the generation means, and the generation means generates the gesture sequence T such that the key sequence S cannot be uniquely inferred from the gesture sequence T. Effect of the Invention

[0010] According to the present invention, highly secure authentication is possible. [Brief description of the drawings]

[0011] [Figure 1] FIG. 2 illustrates an example of a hardware configuration of an authentication device. [Diagram 2] FIG. 2 illustrates an example of a functional configuration of an authentication device. [Diagram 3] 13 is a flowchart showing a flow of a registration process performed by the authentication device. [Figure 4] 13 is a flowchart showing a flow of authentication processing by the authentication device. [Diagram 5] 10 is a flowchart showing an example of the flow of a gesture authentication process performed by the authentication device. [Figure 6] FIG. 13 is a diagram showing an example of additional information provided to a person to be authenticated. [Figure 7] FIG. 13 is a diagram showing an example of additional information provided to a person to be authenticated. [Figure 8] 10 is a flowchart showing an example of the flow of a gesture authentication process performed by the authentication device. [Figure 9] 10 is a flowchart showing an example of the flow of a gesture authentication process performed by the authentication device. [Figure 10] FIG. 13 is a diagram showing an example of additional information provided to a person to be authenticated. [Figure 11]13 is a flowchart showing a flow of authentication processing by the authentication device. [Figure 12] FIG. 13 is a diagram showing an example in which a set of possible values ​​for a key is the positions of points arranged in a 3×3 pattern. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. Note that the configurations shown in the following embodiments are merely examples, and the present invention is not limited to the configurations shown in the drawings.

[0013] <Embodiment 1> The authentication device (processing device) 100 in this embodiment authenticates the person to be authenticated using both biometric authentication and gesture authentication. Note that, in the following description of this embodiment, face authentication is used as the biometric authentication, but the biometric authentication is not limited to face authentication, and other biometric authentication such as vein authentication and iris authentication may be used.

[0014] The gestures used for gesture authentication in this embodiment are actions that the person to be authenticated intentionally performs using the face or hands. In this embodiment, the walking habits of the person to be authenticated or the slight shaking when standing upright are not used for gesture authentication. Note that gestures used for gesture authentication are not limited to the face or hands, but may also be the arms, the whole body, or belongings. For example, actions such as "closing the right eye" or "closing the left eye" may be used for gesture authentication. Also, the authentication device 100 in this embodiment assumes a 1:N authentication method. However, the present invention is not limited to this, and may also be applied to a 1:1 authentication method.

[0015] 1 is a diagram showing an example of a hardware configuration of an authentication device 100 according to this embodiment. The authentication device 100 has, as its hardware configuration, a control device 11, a storage device 12, a calculation device 13, an input device 14, an output device 15, and an I / F device 16.

[0016] The control device 11 is a central processing unit constituted by a CPU and an MPU, and controls the entire authentication device 100 by executing a control program stored in the storage device 12 .

[0017] The storage device (memory) 12 is composed of a ROM, a RAM, and a secondary storage device. The ROM is a non-volatile memory, and stores the control program in this embodiment and other programs and data required for control. The RAM is a volatile memory, and stores temporary data such as image data and processing results. The secondary storage device is a rewritable secondary storage device such as a hard disk drive or flash memory, and stores image information, programs, various setting contents, and the like.

[0018] The arithmetic device 13 executes necessary arithmetic processing based on the control from the control device 11. For example, it executes arithmetic processing in each functional unit shown in FIG. 2, which will be described later. The input device 14 is a human interface device or the like, and inputs user operations to the authentication device 100. The output device 15 is a display device such as a monitor or a display, and presents the processing results of the authentication device 100 and instructions for the user, which will be described later, to the user.

[0019] The I / F device 16 is a wired interface such as a universal serial bus, Ethernet (registered trademark), or optical cable, or a wireless interface such as Wi-Fi (registered trademark), Bluetooth (registered trademark), etc. The I / F device 16 has functions such as connecting an imaging device such as a camera to input a captured image to the authentication device 100, transmitting a processing result obtained by the authentication device 100 to the outside, and inputting a program, data, etc. required for the operation of the authentication device 100 to the authentication device 100.

[0020] 2 is a diagram showing an example of a functional configuration of the authentication device 100 in this embodiment. The authentication device 100 has, as its functional configuration, an image acquisition unit 201, a biometric information acquisition unit 202, a biometric information storage unit 203, a biometric authentication unit 204, a spoofing determination unit 205, a secret information storage unit 206, a gesture authentication unit 207, and a general authentication unit 208.

[0021] The image acquisition unit 201 acquires images necessary for biometric authentication, spoofing determination, and gesture authentication from an imaging device (not shown) configured with a camera or the like. Then, the image acquisition unit 201 transmits the acquired images to the biometric information acquisition unit 202, the spoofing determination unit 205, and the gesture authentication unit 207. Here, the image acquired by the image acquisition unit 201 is an image (face image) in which a person's face (face area) is captured. Note that the image acquisition unit 201 does not acquire images directly from the imaging device, but may acquire the images by, for example, reading them from the storage device 12 or other devices in which previously captured images are stored.

[0022] The biometric information acquiring unit 202 acquires biometric information (facial feature amount in this embodiment) used for biometric authentication from the face image of the person to be authenticated (user's face information in the image) acquired from the image acquiring unit 201. Then, the biometric information acquiring unit 202 transmits the acquired biometric information to the biometric information storage unit 203 and the biometric authentication unit 204.

[0023] The biometric information storage unit 203 stores the biometric information (facial feature amount in this embodiment) used for biometric authentication obtained from the biometric information acquisition unit 202 in the storage device 12. In the 1:N authentication assumed in this embodiment, the biometric information of N people (N is an integer equal to or greater than 1) is stored in association with a unique ID (for example, an employee number or an email address) representing the person to be registered.

[0024] The biometric authentication unit 204 compares the biometric information (facial feature amount) of the person to be authenticated obtained from the biometric information acquisition unit 202 with the biometric information of N people (one or more people) stored in the biometric information storage unit 203, and calculates a matching score (authentication score) based on the biometric information. Then, the biometric authentication unit 204 transmits the calculated matching score (authentication result) to the general authentication unit 208.

[0025] The spoofing determination unit 205 determines whether the person to be authenticated is a living body or not from the face image acquired by the image acquisition unit 201, and calculates a non-biological score which is a score indicating the likelihood of the person being a non-biological body. The non-biological score calculated by the spoofing determination unit 205 makes it possible to quantify how close the face image is to a living body (a real person) or a non-biological body (a person printed or displayed on an artificial object such as paper or a display). The spoofing determination unit 205 then transmits the calculated non-biological score (calculation result) to the general authentication unit 208.

[0026] The secret information storage unit 206 stores information (secret information) that only the person to be authenticated knows in the storage device 12. The secret information is stored in association with a unique ID that represents the person to be registered as described above. The secret information is, for example, information such as a key string arbitrarily set by the person to be authenticated or a key string generated by the secret information storage unit 206. In the case of a key string generated by the secret information storage unit 206, the key string is assumed to have been transmitted to the person to be authenticated.

[0027] The gesture authentication unit 207 detects a gesture (gesture sequence) performed by the person to be authenticated based on the image (image sequence) acquired from the image acquisition unit 201. Then, the gesture authentication unit 207 judges whether the person to be authenticated has presented information that only the person to be authenticated knows by a gesture based on the detected gesture sequence and the secret information stored in the secret information storage unit 206. Then, the gesture authentication unit 207 transmits the judgment result to the general authentication unit 208.

[0028] The comprehensive authentication unit 208 integrates (combines) the matching score obtained from the biometric authentication unit 204, the non-biometric score obtained from the spoofing determination unit 205, and the determination result obtained from the gesture authentication unit 207. Then, the comprehensive authentication unit 208 determines and determines (specifies) whether the person to be authenticated who appears in the face image acquired by the image acquisition unit 201 is someone among the N people stored in the biometric information storage unit 203, or a person different from any of the N people.

[0029] The authentication device 100 according to this embodiment performs registration processing and authentication processing. The registration processing flow and authentication processing flow by the authentication device 100 will be described below in order with reference to Figs. 3 and 4. Fig. 3 is a flowchart showing the registration processing flow by the authentication device 100 of embodiment 1. Note that each operation (process) shown in the flowchart of Fig. 3 is realized by the control device 11 of the authentication device 100 executing a program stored in the storage device 12. Also, each process (step) is represented by adding an S to the beginning, thereby omitting the representation of the process (step).

[0030] In S301, the image acquisition unit 201 acquires an image required for biometric authentication, spoofing determination, and gesture authentication from an imaging device. In this embodiment, the image acquired by the image acquisition unit 201 is an image including at least the face of the person to be authenticated (hereinafter, face image). Furthermore, when a gesture using hands is performed in gesture authentication described later, the control device 11 controls the imaging device to adjust the angle of view of the imaging device so that the image includes not only the face but also the hand area. The image acquisition unit 201 transmits the acquired image to the biometric information acquisition unit 202, the spoofing determination unit 205, and the gesture authentication unit 207.

[0031] In S302, the biometric information acquisition unit 202 acquires facial features to be used for biometric authentication from the facial image of the person to be authenticated acquired by the image acquisition unit 201. The biometric information acquisition unit 202 transmits the facial features, which are the acquired biometric information, to the biometric information storage unit 203 and the biometric authentication unit 204. After receiving the facial feature information from the biometric information acquisition unit 202, the biometric information storage unit 203 stores the information in the storage device 12. When storing the biometric information of N people (N is an integer equal to or greater than 1) in the storage device 12, the biometric information storage unit 203 stores the information in association with information such as an employee number or an email address as a unique ID representing the person to be registered.

[0032] A pre-trained feature extractor is used to extract facial features. When a facial image that has been subjected to a prescribed normalization process is input into the feature extractor, biometric information called features for identifying the identity of the face is output. Features are generally feature vectors of fixed dimensions (e.g., 256 or 512 dimensions). Features extracted from facial images of the same person are trained to produce a high degree of similarity, while features extracted from facial images of different people are trained to produce a low degree of similarity. The feature extractor can be trained using known methods, so a detailed explanation will be omitted.

[0033] In S303, the biometric information storage unit 203 stores the biometric information (here, facial feature amounts) acquired by the biometric information acquisition unit 202 in the storage device 12. The biometric information is stored in association with a unique ID (for example, an employee number or an email address) that represents the person to be registered. Note that it is also possible to register multiple pieces of biometric information for one ID. This can improve the robustness of biometric authentication. In addition, in order to prevent leakage of the biometric information, the biometric information storage unit 203 may encrypt the facial feature amounts using a known encryption technology before storing them. The biometric authentication unit 204 transmits the calculated matching score (calculation result) to the comprehensive authentication unit 208.

[0034] In S304, the secret information storage unit 206 stores information (secret information) that can only be known by the person to be authenticated (a target user in the authentication process described below) in the storage device 12. In this embodiment, the secret information storage unit 206 stores the secret information by any of the methods described below.

[0035] In the first method, the person to be authenticated (user) determines a key sequence S, and stores the determined key sequence as secret information in the storage device 12. Hereinafter, this method will be referred to as Method A. Here, a key is defined as one element in a predetermined set, and a key sequence is defined as a sequence of one or more keys. If the set of values ​​that a key can take is X, then a key sequence S of length L can be expressed by the following equation 1.

number

[0036] Examples of the predetermined set include, but are not limited to, numbers from 0 to 9, English letters from a to z, positions of points arranged in a 3×3 pattern, and a set of predefined gestures. An example of a key string when the set X is the numbers {0, ..., 9} is [7, 2, 9, 3]. Also, an example of a key string when the positions of points arranged in a 3×3 pattern are assigned symbols L1, ..., L9 and the set X is the position {L1, ..., L9} is [L3, L5, L1]. An example of such a set is shown in FIG. 12. FIG. 12 is a diagram showing an example when the set of values ​​that a key can take is the positions of points arranged in a 3×3 pattern.

[0037] In the second method, the secret information storage unit 206 generates and determines the key sequence S. Then, the determined key sequence S is notified (transmitted) only to the person to be authenticated and stored as secret information. Hereinafter, this method will be referred to as method B. In method B, as in method A, the key sequence S is defined as a sequence of one or more keys. Here, the key sequence S may be generated randomly or according to a predetermined rule defined in advance, but it is generated so that the generated key sequence S cannot be guessed by a third party. Then, the secret information storage unit 206 transmits the generated key sequence S only to the person to be authenticated by a method such as displaying it on a display or sending it by email. That is, the key sequence S is notified to the person to be authenticated (user) corresponding to the above-mentioned identification information.

[0038] In method B, the key string generated and determined by the secret information storage unit 206 is discarded after the authentication of the person to be authenticated is performed a predetermined number of times in the authentication process described below, or after a predetermined time has elapsed. Therefore, the person to be authenticated needs to perform the process of S304 every time as necessary prior to authentication.

[0039] Next, an example of the flow of authentication processing by the authentication device 100 in this embodiment will be described with reference to Fig. 4. Fig. 4 is a flowchart showing the flow of authentication processing by the authentication device 100 in embodiment 1. Note that each operation (processing) shown in the flowchart in Fig. 4 is realized by the control device 11 of the authentication device 100 executing a program stored in the storage device 12. Also, each process (step) is represented with an S at the beginning to omit the representation of the process (step).

[0040] In S401, the image acquisition unit 201 acquires a face image of the person to be authenticated who is about to undergo authentication processing from an image capture device. Note that details of the processing in S401 are the same as those in S301, and therefore will not be described.

[0041] In S402, the biometric information acquisition unit 202 acquires face feature amounts (biometric information) used for biometric authentication from the face image of the person to be authenticated acquired by the image acquisition unit 201. Note that details of the process in S402 are the same as those in S302, and therefore will not be described.

[0042] In S403, the biometric authentication unit 204 performs authentication using biometric information by calculating a matching score based on the biometric information and the facial feature amount information of N people. That is, the facial feature amount of the person to be authenticated obtained from the biometric information acquisition unit 202 is matched with the facial feature amount of N people stored in the storage device 12 by the biometric information storage unit 203 before the start of the process of S403, and a matching score is calculated based on the biometric information. The matching score is calculated, for example, by the cosine similarity or L2 distance between the features (facial feature amounts). The biometric authentication unit 204 transmits the calculated matching score (authentication result) to the general authentication unit 208.

[0043] In S404, the spoofing determination unit 205 determines whether the person to be authenticated is a living body or not from the face image acquired by the image acquisition unit 201, and calculates a non-living body score which is a score indicating the likelihood of the person being a non-living body. The spoofing determination unit 205 transmits the calculated non-living body score (calculation result) to the general authentication unit 208.

[0044] Any known technology can be applied to the spoofing determination. As an example, a case of training a spoofing determiner that calculates a non-living score based on an image will be described. First, a set of images containing living bodies and a set of images containing non-living bodies are collected as training data. Then, using these training data, a binary classification neural network is trained that classifies living bodies in the input image as class 0 and non-living bodies as class 1. By setting the activation function of the output layer of this neural network to a sigmoid function, the output of the neural network becomes a scalar between 0 and 1. This output value is used as the non-living score.

[0045] In S405, the gesture authentication unit 207 performs authentication by gesture. In the gesture authentication, first, a gesture sequence performed by the person to be authenticated is detected based on the image sequence acquired by the image acquisition unit 201. Then, the gesture authentication unit 207 judges whether or not information known only to the person to be authenticated is presented by a gesture based on the detected gesture sequence and the secret information. The gesture authentication unit 207 transmits the judgment result to the comprehensive authentication unit 208. The secret information is information known only to the person to be authenticated that is stored in the storage device 12 by the secret information storage unit 206 in S304. The gesture authentication unit 207 transmits the judgment result to the comprehensive authentication unit 208.

[0046] Here, the flow of the gesture authentication process performed by the gesture authentication unit 207 in S405 differs depending on the format of the secret information saved in S304. Below, the flow of gesture authentication will be described according to the format of the secret information. First, the flow of gesture authentication when secret information is saved by method A will be described with reference to FIG. 5. FIG. 5 is a flowchart showing an example of the flow of gesture authentication process by the authentication device 100 of the first embodiment. Note that each operation (process) shown in the flowchart of FIG. 5 is realized by the control device 11 of the authentication device 100 executing a program stored in the storage device 12. Also, each process (step) is written with an S at the beginning to omit the notation of the process (step).

[0047] In S501, the gesture recognition unit 207 determines a conversion function f for converting a key sequence S into a gesture sequence T. At this time, the conversion function f needs to satisfy the following conversion condition 1 and conversion condition 2.

[0048] Conversion condition 1: The pre-conversion key sequence S cannot be uniquely inferred by observing the value of the post-conversion gesture sequence T only once. Conversion condition 2: The gesture sequence T cannot be used consecutively for authentication (cannot be used to determine the success or failure of gesture authentication).

[0049] Conversion condition 1 guarantees that the key sequence S, which is secret information, cannot be uniquely deduced by a third party if the gesture sequence performed by the person to be authenticated is secretly observed by a third party only once. If the gesture sequence is secretly observed repeatedly, the key sequence S may be deduced. However, by setting the length of the key sequence S to be sufficiently long, the number of times that the key sequence S can be observed in order to infer it can be increased, thereby increasing the strength of security.

[0050] Also, the person to be authenticated may be encouraged to periodically change the key sequence S. For example, when a preset period has elapsed, a notification urging the user to change the key sequence S may be sent to the output device 15 or the like, or a notification may be sent to an electronic device such as a mobile terminal carried by the user.

[0051] The conversion condition 2 ensures that a third party who sees a gesture sequence performed by a person to be authenticated does not always reuse the gesture sequence immediately after it is seen, thereby breaking through the authentication. That is, the conversion condition 2 ensures that a gesture sequence T1 obtained by converting the same key sequence S at a certain time and a gesture sequence T2 obtained by converting the same key sequence S at a time different from the time when the gesture sequence T1 was converted are not always the same.

[0052] Hereinafter, when simply described as a conversion condition, it includes (refers to) both the above conversion condition 1 and conversion condition 2. As long as the conversion function f satisfies the conversion condition, it is possible to reduce the probability of authentication being broken through even if a malicious third party spies on the authentication process.

[0053] Here, consider an example of the above conversion function f, where the key sequence S is a numeric sequence [7,2,9,3]. The gesture authentication unit 207 generates and determines a correspondence table between keys and gestures so that one gesture always corresponds to two or more keys every time authentication processing is performed. An example of the correspondence table generated by the gesture authentication unit 207 is given below.

[0054] 1: Close your left eye 2: Open your mouth 3: Look left 4: Look left 5: Close your right eye 6: Close your left eye 7: Look right 8: Close your right eye 9: Look right 0: Open your mouth

[0055] In the above example, 10 types of keys correspond to 5 types of gestures, and one gesture corresponds to 2 keys. The correspondence table may be generated randomly, but is not limited to this, and may be generated according to a predetermined rule.

[0056] The conversion function f converts each number constituting the key sequence S using this correspondence table, and outputs the result of concatenating the converted numbers as the gesture sequence T. That is, the gesture authentication unit 207 can generate a conversion function f that converts the key sequence S into the gesture sequence T based on the generated correspondence table. For example, when the key sequence S is a number sequence [7,2,9,3], the conversion function f outputs the gesture sequence T as [turn right, open mouth, turn right, turn left]. This conversion function f can output the same gesture sequence T as above even if the key sequence is [9,0,9,3] or [7,2,7,4]. In this example, since there are 2 n key sequences corresponding to a certain n-digit gesture sequence, the original key sequence cannot be uniquely restored from the converted gesture sequence. In addition, the correspondence table is changed every time authentication is performed. As described above, the conversion function f satisfies the above conversion conditions.

[0057] If the converted gesture sequence T includes consecutive identical gestures, a special gesture may be inserted between the consecutive gestures to indicate a break between the gestures. For example, the special gestures may be a gesture of closing both eyes, a gesture of shaking the head, or a gesture of staring straight into the camera with a straight face.

[0058] Alternatively, restrictions may be imposed so that the converted gesture sequence T does not have the same consecutive gestures, and so that the key sequence S set by the person to be authenticated does not have the same consecutive keys, and restrictions may also be imposed on the generation of the above-mentioned correspondence table.

[0059] In S502, the gesture authentication unit 207 instructs the person to be authenticated to make a gesture in front of the imaging device. Specifically, the gesture authentication unit 207 notifies (presents) the person to be authenticated of additional information including instructions necessary for the person to be authenticated to make a gesture via an external device such as a display or a speaker. In this case, the additional information as shown in FIG. 6 is notified (presented) to the person to be authenticated via an external device such as a display (display device) or a speaker (audio device).

[0060] FIG. 6 is a diagram showing an example of additional information presented to the person to be authenticated in this embodiment. The additional information shown in FIG. 6 includes the correspondence table determined in S501 and information on the contents of instructions to the person to be authenticated. In the example of FIG. 6, this additional information is displayed on the display. The user performs gestures according to the instructions displayed on the display or the instructions given by voice from the speaker. The imaging device controlled by the control device 11 captures an image of the person to be authenticated performing a gesture. Then, in the example of FIG. 6, the image acquisition unit 201 acquires an image sequence in which at least four gestures are captured. The four-digit PIN shown in FIG. 6 is secret information preset by the user.

[0061] In S503, the gesture authentication unit 207 detects a gesture sequence T' performed by the person to be authenticated. Any existing method can be applied to recognize the gesture sequence. For example, when detecting a facial gesture, first, the positions of facial organ points are detected from the image acquired by the image acquisition unit 201. Next, based on the positions of the facial organ points, it is determined what gesture the person to be authenticated is performing. This determination may be made on a rule basis or a machine learning basis. Similarly, when detecting a hand gesture, the gesture can be detected using the positions of the organ points of the fingers as clues.

[0062] In S504, the gesture authentication unit 207 compares the gesture sequence T' detected in S503 with the gesture sequence T obtained by the conversion function f determined in S501. That is, the gesture authentication unit 207 determines whether the gesture authentication is successful or not based on the gesture sequence T and the gesture sequence T' (determines whether the gesture sequence T and the gesture sequence T' match).

[0063] If the gesture authentication unit 207 determines that the gesture sequence T and the gesture sequence T' match, it determines that the person to be authenticated knows the secret information that only the person to be authenticated knows and that was saved in S304. On the other hand, if it determines that the gesture sequence T and the gesture sequence T' do not match, it determines that the person to be authenticated does not know the secret information that only the person to be authenticated knows and that was saved in S304.

[0064] The flow of gesture authentication when secret information is stored by method A has been described above with reference to FIG. 5. Note that the design of the conversion function f described above is not limited to the above example. Other design examples will be described below.

[0065] For example, in S501, the gesture authentication unit 207 generates and determines a correspondence table between keys and gestures so that one gesture corresponds to one or more keys for each authentication process. An example of the correspondence table generated by the gesture authentication unit 207 in this case is given below.

[0066] 1: Close your left eye 2: Open your mouth 3: Look left 4: Close your right eye 5: Look right 6: Tilt your face to the left 7: Close your eyes 8: Look down 9: Tilt your face to the right 0: Look up

[0067] In the above example, 10 keys correspond to 10 gestures. The correspondence table may be generated randomly or according to some predetermined rules.

[0068] The conversion function f converts only some of the numbers constituting the key sequence S, not all of them, using this correspondence table, and outputs the concatenated numbers as the gesture sequence T. That is, the gesture recognition unit 207 can generate a conversion function f that converts a part of the key sequence S into the gesture sequence T based on the generated correspondence table.

[0069] For example, the conversion function f extracts the third and first numbers from the key sequence S, converts the extracted numbers in order using this correspondence table, and outputs the connected numbers as the gesture sequence T. If the key sequence S is a number sequence [7,2,9,3], the gesture sequence T is [tilt face to the right, close both eyes]. This conversion function f can output the same gesture sequence T as above even if the key sequence is [7,8,9,0] or [7,1,9,2]. In this way, since this conversion function f returns the same T' for at least two or more different key sequences S1 and S2, the original key sequence cannot be uniquely restored from the converted gesture sequence. In addition, the correspondence table is changed every time authentication is performed. Therefore, the conversion function f satisfies the above-mentioned conversion conditions.

[0070] When the process of S502 is performed using the conversion function f in this case, the gesture authentication unit 207 instructs the person to be authenticated to make a gesture in front of the imaging device in the same manner as in S502. The gesture authentication unit 207 notifies (presents) the person to be authenticated of additional information including instructions necessary for the person to be authenticated to make a gesture via an external device such as a display or a speaker. In this case, the additional information as shown in FIG. 7 is notified (presented) to the person to be authenticated via an external device such as a display (display device) or a speaker (audio device).

[0071] Fig. 7 is a diagram showing an example of additional information given to the person to be authenticated in this embodiment. The additional information shown in Fig. 7 is the correspondence table determined in the above example, and information on the contents of instructions to the person to be authenticated. In the example of Fig. 7, this additional information is displayed on the display. The user performs gestures in accordance with the instructions displayed on the display or the voice instructions from the speaker. Here, the four-digit PIN number (secret information) shown in Fig. 7 is preset by the user.

[0072] In the gesture authentication described with reference to Figures 5, 6, and 7, as described above, it was necessary to notify the authenticatee of additional information via an external device such as a display or speaker. Below, with reference to Figure 8, a process flow in the case of gesture authentication without the need to present additional information will be described.

[0073] Fig. 8 is a flowchart showing an example of the flow of gesture authentication processing by the authentication device 100 of embodiment 1. Note that each operation (processing) shown in the flowchart in Fig. 8 is realized by the control device 11 of the authentication device 100 executing a program stored in the storage device 12. Also, each process (step) is represented with an S at the beginning to omit the representation of the process (step).

[0074] In S801, the gesture authentication unit 207 determines a conversion function f for converting the key sequence S into a gesture sequence T. At this time, the conversion function f changes which part of the key sequence S to use for conversion every time authentication is performed according to a predetermined rule shared in advance with the person to be authenticated.

[0075] For example, assume that a key string S of length L is expressed by the following formula 2.

number

[0076] The conversion function g(x) is a function that converts a number into a predetermined gesture, in which the gesture corresponding to the number j is a gesture of holding up j fingers.

[0077] At that time, f(S) = [g(x1)] (x at the first authentication or the previous authentication) L (When authenticated using f(S) = [g(x i+1 )] (x was used during last authentication i (When authenticated using 1≦i≦L-1) The transformation function f can be defined as follows:

[0078] This conversion function f converts the key sequence S into a gesture sequence using only a part of the key sequence S, so the key sequence S cannot be uniquely restored from the converted gesture sequence. Also, the part of the key sequence S used for conversion changes every time authentication is performed. Therefore, this conversion function f satisfies the conversion conditions described above.

[0079] As an example, consider a case where the key sequence S is a numeric sequence [7,2,9,3]. For example, if the person to be authenticated last time was authenticated using the second digit (2), then the person to be authenticated this time will be authenticated using the third digit (9). In other words, the gesture sequence T becomes [9 fingers held up]. The gesture of holding up fingers can be performed with one hand if 0 to 5 fingers are held up, and can be performed with both hands if 6 to 9 fingers are held up. Note that although the gesture of holding up fingers is used as an example, other gestures are also possible.

[0080] In S802, the gesture authentication unit 207 detects a gesture sequence performed by the person to be authenticated. Note that the details of the process in S802 are the same as those in S503, and therefore will not be described.

[0081] In S803, the gesture authentication unit 207 compares the gesture sequence T' detected in S802 with the gesture sequence T obtained by the conversion function f determined in S801. That is, the gesture authentication unit 207 determines whether the gesture authentication is successful or not based on the gesture sequence T and the gesture sequence T' (determines whether the gesture sequence T and the gesture sequence T' match).

[0082] If the gesture authentication unit 207 determines that the gesture sequence T and the gesture sequence T' match, it determines that the person to be authenticated knows the secret information that is stored in S304 and that only the person to be authenticated knows. On the other hand, if it determines that the gesture sequence T and the gesture sequence T' do not match, it determines that the person to be authenticated does not know the secret information that is stored in S304 and that only the person to be authenticated knows. The details of the process in S803 are the same as those in S504.

[0083] In the processing method shown in Fig. 8, both the person to be authenticated and the authentication device need to remember which part of the key string was used in the previous authentication. However, gesture authentication is possible without the need to notify the person to be authenticated of additional information via an external device such as a display or speaker. Therefore, in such a case, S502 shown in Fig. 5 is unnecessary.

[0084] 5 to 8, the flow of gesture authentication when secret information is stored by method A has been described. However, the above-described gesture authentication is only an example, and the gesture authentication method is not limited to this.

[0085] Next, the flow of gesture authentication when secret information is stored by method B will be described with reference to Fig. 9. Fig. 9 is a flowchart showing an example of the flow of gesture authentication processing by the authentication device 100 of embodiment 1. Note that each operation (processing) shown in the flowchart of Fig. 9 is realized by the control device 11 of the authentication device 100 executing a program stored in the storage device 12. Also, each process (step) is represented by adding an S to the beginning, thereby abbreviating the representation of the process (step).

[0086] In S901, the gesture authentication unit 207 determines a conversion function f that converts the key sequence S into a gesture sequence T. At this time, the conversion function f needs to satisfy only conversion condition 2 (the gesture sequence T cannot be used for repeated authentication) among the above-mentioned conversion conditions.

[0087] For example, if a key sequence S of length L is expressed by the following formula 3, the converted gesture sequence T is expressed as T=[y1,…,y L ] can be converted.

number

[0088] where y i For example, y is calculated by the transformation function g(x) mentioned above. i =g(x i ) In addition, if a key sequence S of length L is expressed as the following number 4, the conversion function f can be the identity function, that is, f(S)=S.

number

[0089] In the case of the above conversion function f, the pre-conversion key sequence S can be uniquely guessed from the post-conversion gesture sequence T, that is, conversion condition 1 is not satisfied. However, in this case, the key sequence (secret information) generated in S304 is discarded after being used for authentication a predetermined number of times, so even if conversion condition 1 is not satisfied, there is no risk of a malicious third party breaking through the authentication.

[0090] In S902, the gesture authentication unit 207 detects a gesture sequence T' performed by the person to be authenticated. Note that details of the process in S902 are the same as those in S503, and therefore will not be described.

[0091] In S903, the gesture authentication unit 207 compares the gesture sequence T' detected in S901 with the gesture sequence T determined in S901. That is, the gesture authentication unit 207 determines whether the gesture authentication is successful or not based on the gesture sequence T and the gesture sequence T' (determines whether the gesture sequence T and the gesture sequence T' match).

[0092] If the gesture authentication unit 207 determines that the gesture sequence T and the gesture sequence T' match, it determines that the person to be authenticated knows the secret information that only the person to be authenticated knows and that was saved in S304. On the other hand, if it determines that the gesture sequence T and the gesture sequence T' do not match, it determines that the person to be authenticated does not know the secret information that only the person to be authenticated knows and that was saved in S304.

[0093] The details of the gesture authentication in S405 (determination of success or failure of gesture authentication) have been described above based on the cases of Method A and Method B.

[0094] 4, in S406, the comprehensive authentication unit 208 combines the results of the biometric authentication unit 204, the spoofing determination unit 205, and the gesture authentication unit 207. Then, it determines whether or not to authenticate the person to be authenticated who appears in the face image acquired by the image acquisition unit 201. That is, the comprehensive authentication unit 208 determines whether or not the authentication is successful based on the matching score calculated by the biometric authentication unit 204, the non-biometric score calculated by the spoofing determination unit 205, and the comparison result of the gesture sequence by the gesture authentication unit 207.

[0095] If the comprehensive authentication unit 208 determines that the person to be authenticated should be authenticated (authentication successful), the process proceeds to S407. On the other hand, if the comprehensive authentication unit 208 determines that the person to be authenticated should not be authenticated (authentication denied), the process proceeds to S408. Note that in this embodiment, when the comprehensive authentication unit 208 determines that the person to be authenticated should be authenticated, the description will be focused on an example in which the comprehensive authentication unit 208 authenticates the person to be authenticated by satisfying all of the following three conditions (acceptance conditions). In this case, if any one of the following three conditions is not satisfied, the unit determines that the person to be authenticated should not be authenticated.

[0096] Acceptance condition 1: As a result of the biometric authentication in S403, the matching score between the person to be authenticated and a specific person (hereinafter referred to as person A) among the N people stored in the biometric information storage unit 203 is greater than or equal to a predetermined threshold 1 (first threshold). Acceptance condition 2: As a result of the spoofing determination in S404, the non-liveness score is less than a predetermined threshold 2 (second threshold). Acceptance condition 3: As a result of the gesture authentication in S405, it is determined that the person to be authenticated has presented information that only person A can know (if it is determined that gesture sequence T and gesture sequence T' match).

[0097] Below, we will provide further details on acceptance condition 1. First, the comprehensive authentication unit 208 identifies person A who has the highest matching score among the matching scores of N people stored in the biometric information storage unit 203. Then, it compares the matching score of person A with a predetermined threshold 1, and determines that if the matching score is less than the threshold, the person to be authenticated is different from any of the N people, and if the score is equal to or greater than the threshold, there is a possibility that the person to be authenticated is person A.

[0098] In S406, the authentication of the person to be authenticated is deemed successful, and the person is accepted as person A. Then, the process ends. In S407, the authentication of the person to be authenticated is deemed unsuccessful, and acceptance of person A is denied. Then, the process ends.

[0099] Here, in the case where there are multiple people whose matching scores in biometric authentication are equal to or greater than a predetermined threshold value 1, it is possible to use acceptance condition 3 or another authentication means such as an ID card to identify the person to be authenticated as one of the multiple people. Furthermore, the acceptance conditions are not limited to the above three. For example, as a result of the spoofing determination in S404, it is also possible to remove acceptance condition 2, in which the non-biometric score is less than a predetermined threshold value 2 (less than the second threshold value), from the acceptance conditions. In this case, the spoofing determination process described in S404 can be omitted.

[0100] That is, the comprehensive authentication unit 208 can determine whether authentication is successful or not based on the comparison result between the matching score calculated by the biometric authentication unit 204 and the gesture sequence by the gesture authentication unit 207. If both the above-mentioned acceptance condition 1 and acceptance condition 3 are satisfied in the judgment, the comprehensive authentication unit 208 determines to authenticate the person to be authenticated. On the other hand, if either one of the acceptance condition 1 or the acceptance condition 3 is not satisfied, the comprehensive authentication unit 208 determines not to authenticate the person to be authenticated.

[0101] The flow of the process of registering secret information and gesture authentication by the authentication device 100 of the embodiment has been described above with reference to Fig. 4 to Fig. 9. Here, in order to further improve convenience, the following may be performed.

[0102] The gesture authentication unit 207 may change the strength of the gesture authentication required of the person to be authenticated according to the security level required for the authentication. For example, the gesture authentication unit 207 sets the conversion function f so as to lengthen the gesture sequence used for authentication in authentication at the door to a room handling highly confidential information.

[0103] In addition, authentication may be possible using multiple types of gestures. Specifically, the conversion function f may be a function that converts multiple gesture sequences T1, T2, ..., T K (K is an integer equal to or greater than 2). In other words, the conversion function f is a multi-valued function. This makes it possible to normally use hand gestures, which are more reliable, for authentication, and use face gestures when both hands are occupied.

[0104] For example, the gesture authentication unit 207 determines a correspondence table between keys and gestures such that one gesture is always associated with two or more keys, and one key is always associated with two or more gestures. An example is given below.

[0105] 1: Close your left eye and hold up three fingers 2: Open mouth and hold up five fingers 3: Look left and hold up one finger 4: Look left and hold up two fingers 5: Close your right eye and hold up two fingers 6: Close your left eye and hold up five fingers 7: Look to the right, hold up four fingers 8: Close your right eye and hold up three fingers 9: Look right and hold up one finger 0: Open mouth, hold up four fingers

[0106] In this example, 10 types of keys correspond to 5 types of gestures using the face and 5 types of gestures using the hands. In addition, one gesture corresponds to 2 keys. The conversion function f converts each number that makes up the key sequence S using this correspondence table, and outputs the connected numbers as the gesture sequence T.

[0107] As described above, the conversion function f is a multi-valued function. For example, when the key sequence S is a numeric sequence [7,2,9,3], the conversion function f returns multiple gesture sequences such as [turn right, open mouth, turn right, turn left] and [hold up four fingers, hold up five fingers, hold up one finger, hold up one finger]. The gesture authentication unit 207 presents the person to be authenticated with additional information as shown in FIG. 10. In the above, the person to be authenticated makes a facial gesture (first gesture) and a hand gesture (second gesture). However, this is not limiting, and different gestures may be combined.

[0108] FIG. 10 is a diagram showing an example of additional information given to the person to be authenticated. The additional information shown in FIG. 10 is the correspondence table determined in the above example, and information on the contents of instructions to the person to be authenticated. In the example of FIG. 10, this additional information is displayed on the display. The user makes gestures according to the instructions displayed on the display or the instructions given by voice from the speaker. The person to be authenticated may use either facial gestures or hand gestures. In addition, both the face and hands may be used. Here, the four-digit PIN number (secret information) shown in FIG. 10 is preset by the user.

[0109] If the gesture sequence T' performed by the person to be authenticated matches any of the gesture sequences T returned by the conversion function f, the gesture authentication unit 207 determines that the person to be authenticated knows the secret information. That is, if the person to be authenticated makes a gesture using his / her hands that corresponds to a four-digit PIN, the gesture authentication unit 207 determines that the gesture sequence T matches the gesture sequence T'. Alternatively, if the person to be authenticated makes a gesture using his / her face that corresponds to a four-digit PIN, the gesture authentication unit 207 determines that the gesture sequence T matches the gesture sequence T'. Note that a gesture may be made by combining the hands and the face. Even in this case, if the gesture corresponds to the four-digit PIN, the gesture authentication unit 207 determines that the gesture sequence T matches the gesture sequence T'. On the other hand, if the gesture sequence T' performed by the person to be authenticated does not match any of the gesture sequences T returned by the conversion function f, the gesture authentication unit 207 determines that the person to be authenticated does not know the secret information.

[0110] The conversion function f may be designed so that the gesture sequence converted by the conversion function f always includes a gesture that contributes to improving the accuracy of spoofing detection and biometric authentication. For example, if not only a frontal face image but also a face image facing left and right can be obtained, the accuracy of spoofing detection can be improved based on a clue as to whether the face is flat or not. In addition, by using both a frontal face and an oblique face for face authentication, highly robust face authentication can be achieved. Therefore, for example, by determining the conversion function f so that either "facing left" or "facing right" is always included in the gesture sequence, the accuracy of spoofing detection and biometric authentication can be improved while satisfying the above-mentioned conversion conditions.

[0111] As described above, according to the authentication device 100 of the first embodiment, by authenticating an authenticatee using both biometric authentication and gesture authentication, it is possible to perform safe gesture authentication even if a third party secretly views the gesture.

[0112] <Embodiment 2> In this embodiment, an authentication device 100 will be described that first performs authentication using biometric information and spoofing judgment, and then performs gesture authentication only when the accuracy of whether the person is the real person or a different person is low. Note that the same parts of the second embodiment as those of the first embodiment will not be described, and only the differences will be described. Also, the hardware configuration and functional configuration of the authentication device 100 of the second embodiment will not be described because they are the same as those of the first embodiment.

[0113] The authentication device 100 according to this embodiment performs registration processing and authentication processing in the same manner as in the first embodiment. The registration processing is similar to the method described in the first embodiment, so a description thereof will be omitted. The flow of the authentication processing will be described below with reference to FIG. 11. FIG. 11 is a flowchart showing the flow of the authentication processing by the authentication device 100 according to the second embodiment. Note that each operation (process) shown in the flowchart in FIG. 11 is realized by the control device 11 of the authentication device 100 executing a program stored in the storage device 12. Also, each process (step) is represented by adding an S to the beginning to omit the representation of the process (step).

[0114] In S1101, the comprehensive authentication unit 208 integrates (combines) the results of the biometric authentication unit 204 and the spoofing determination unit 205. Then, it is determined whether or not to authenticate the person to be authenticated who appears in the face image acquired by the image acquisition unit 201. That is, the comprehensive authentication unit 208 determines whether or not the person to be authenticated who appears in the face image acquired by the image acquisition unit 201 matches the person of the biometric information stored in advance, based on the authentication result of the biometric authentication unit 204 and the calculation result of the spoofing determination unit. Furthermore, the comprehensive authentication unit 208 of this embodiment determines whether or not the person to be authenticated who appears in the face image acquired by the image acquisition unit 201 matches the person of the biometric information stored in advance, based on the accuracy (first accuracy).

[0115] Then, if the first certainty that the person to be authenticated is a specific person (call it person A) among the N people stored in the biometric information storage unit 203 is sufficiently high, the comprehensive authentication unit 208 determines that the authentication of the person to be authenticated is successful, and proceeds to S1102. On the other hand, if the first certainty is low, the comprehensive authentication unit 208 determines that the authentication of the person to be authenticated is unsuccessful, and proceeds to S1103.

[0116] For example, when both of the following two acceptance conditions (acceptance conditions 4 and 5) are satisfied, the comprehensive authentication unit 208 determines that the first certainty is sufficiently high.

[0117] Acceptance condition 4: As a result of biometric authentication, the matching score between the subject and person A is the highest, and the matching score is equal to or greater than the predetermined threshold value 4. Acceptance condition 5: The result of the spoofing check is that the non-biometric score is less than the predetermined threshold of 5.

[0118] In this way, the first certainty is the degree of certainty in person authentication based on the authentication result of the biometric authentication unit 204 and the calculation result of the spoofing determination unit 205. Incidentally, the acceptance condition 5 may be excluded from the acceptance conditions. In that case, the spoofing determination process described in S404 can be omitted. Here, if there are multiple persons whose matching score with the authenticatee in biometric authentication is equal to or greater than a predetermined threshold value 4, it is possible to proceed to S1103 as there is a possibility that person A is one of the multiple persons. Alternatively, person A may be identified as one person using another authentication means such as an ID card, and then proceed to S1103.

[0119] In S1102, the authentication of the person to be authenticated is deemed successful, and the person is accepted as person A. Then, the process ends.

[0120] In S1103, the comprehensive authentication unit 208 combines the results of the biometric authentication unit 204 and the spoofing determination unit 205. Then, it determines whether or not to authenticate the person to be authenticated who appears in the face image acquired by the image acquisition unit 201. That is, the comprehensive authentication unit 208 determines whether or not the authentication of the person to be authenticated who appears in the face image acquired by the image acquisition unit 201 is successful, based on the authentication result of the biometric authentication unit 204 and the calculation result of the spoofing determination unit. Furthermore, the comprehensive authentication unit 208 of this embodiment determines whether or not the authentication of the person to be authenticated who appears in the face image acquired by the image acquisition unit 201 is successful, based on the accuracy (second accuracy).

[0121] Then, if the second certainty that the person to be authenticated is different from any of the N people stored in the biometric information storage unit 203 is sufficiently high, the comprehensive authentication unit 208 determines that the authentication of the person to be authenticated has failed, and proceeds to S1104. On the other hand, if the certainty is low, the comprehensive authentication unit 208 determines that the authentication of the person to be authenticated has succeeded, and proceeds to S1105.

[0122] For example, when at least one of the following two conditions (rejection conditions 1 and 2) is satisfied, the comprehensive authentication unit 208 determines that the degree of certainty is sufficiently high.

[0123] Rejection condition 1: As a result of biometric authentication, the maximum value of the similarity between the person to be authenticated and N people stored in the biometric information storage unit 203 is less than a predetermined threshold value 6. Rejection condition 2: The result of the spoofing check is that the non-biometric score is equal to or greater than the threshold of 7.

[0124] In this way, the second certainty is the degree of certainty in person authentication based on the authentication result of the biometric authentication unit 204 and the calculation result of the masquerade determination unit 205. Note that the rejection condition 2 may be removed from the rejection conditions. In that case, the masquerade determination process described in S404 can be omitted.

[0125] In S1104, the authentication of the person to be authenticated is deemed to have failed, and the person A is refused admission. After that, the process ends.

[0126] In S1105, the gesture authentication unit 207 performs authentication by gesture. In the gesture authentication, first, a gesture sequence performed by the person to be authenticated is detected based on the image sequence acquired by the image acquisition unit 201. Then, the gesture authentication unit 207 determines whether or not information that only the person to be authenticated knows is presented by a gesture based on the detected gesture sequence and secret information. Note that the details of the process in S1105 are the same as those in S405, and therefore will not be described.

[0127] In S1106, the comprehensive authentication unit 208 integrates (combines) the results of the biometric authentication unit 204, the spoofing determination unit 205, and the gesture authentication unit 207. Then, it is determined whether or not to authenticate the person to be authenticated who appears in the face image acquired by the image acquisition unit 201. If it is determined that the person to be authenticated is to be authenticated, the process proceeds to S1107. On the other hand, if it is determined that the person to be authenticated is not to be authenticated, the process proceeds to S1108. Note that the details of the process in S1106 are the same as those in S406, and therefore will not be described.

[0128] In S1107, the authentication of the person to be authenticated is deemed successful, and the person is accepted as person A. Then, the process ends. In S1108, the authentication of the person to be authenticated is deemed unsuccessful, and acceptance of person A is denied. Then, the process ends.

[0129] As described above, the authentication device 100 of the second embodiment first performs authentication using biometric information and spoofing judgment, and performs gesture authentication only when the accuracy of whether the person is the real person or a different person is low. By configuring the device to perform authentication using gestures when necessary, the authentication time can be shortened, and it is possible to provide an authentication device 100 that has the same effect as the first embodiment, and also improves the convenience of the person to be authenticated.

[0130] Although the preferred embodiments of the present invention have been described in detail above, the present invention is not limited to such specific embodiments, and various modifications and variations are possible within the scope of the gist of the present invention described in the claims.

[0131] A program for implementing one or more functions in the signal processing according to the present invention can be supplied to a system or device via a network or a storage medium, and can be implemented by being read and executed by one or more processors of a computer in the system or device. It can also be implemented by a circuit (e.g., ASIC) that implements one or more functions.

[0132] Furthermore, the functions of the above-described embodiments are not only realized by the computer reading and executing the program code, but also include an operating system (OS) running on the computer performing all or part of the actual processing based on the instructions of the program code.

[0133] Furthermore, the functions of the above-described embodiments may be realized by the following method: Program code read from a recording medium is written into a memory provided in a function expansion card inserted into a computer or a function expansion unit connected to a computer. Then, based on the instructions of the program code, a CPU provided in the function expansion card or function expansion unit performs some or all of the actual processing.

[0134] When the present invention is applied to the above-mentioned recording medium, the recording medium stores program code corresponding to the flowcharts described above.

[0135] The above-mentioned embodiments are merely examples of the implementation of the present invention, and the technical scope of the present invention should not be interpreted as being limited by these. In other words, the present invention can be implemented in various forms without departing from its technical concept or main characteristics.

[0136] The disclosure of this embodiment includes the following configuration, method, and program.

[0137] (Configuration 1) a storage means for storing the key sequence S in a memory in association with the user's identification information; a generating means for generating a gesture sequence T by converting the key sequence S stored in the storage means; An acquisition means for acquiring a gesture detection result; and an authentication means for determining whether or not gesture authentication has been successful based on a gesture sequence T' obtained by the acquisition means as a result of the gesture detection and a gesture sequence T generated by the generation means, The authentication device is characterized in that the generation means generates the gesture sequence T such that the key sequence S cannot be uniquely estimated from the gesture sequence T.

[0138] (Configuration 2) 2. The authentication device according to configuration 1, wherein the key sequence S is determined by a user arranging one or more elements included in a predefined set.

[0139] (Configuration 3) The authentication device according to configuration 1, further comprising a notification means for determining the key sequence S in which one or more elements included in a predefined set are arranged, and notifying the user corresponding to the identification information of the key sequence S.

[0140] (Configuration 4) 4. The authentication device according to configuration 3, wherein the key sequence S is discarded after a predetermined number of times of authentication processing for a user corresponding to the identification information, or after a predetermined time has elapsed since its generation.

[0141] (Configuration 5) The authentication device according to any one of configurations 1 to 4, wherein the generation means converts the key sequence S into the gesture sequence T based on a conversion function that satisfies a first condition and a second condition that is different from the first condition.

[0142] (Configuration 6) The authentication device according to configuration 5, wherein the first condition is that the pre-conversion key sequence S cannot be uniquely guessed by observing the converted value of the gesture sequence T only once, and the second condition is that the gesture sequence T cannot be used consecutively to determine the success or failure of the gesture authentication.

[0143] (Configuration 7) the authentication means generates a correspondence table in which one gesture corresponds to two or more keys for each gesture authentication; 6. The authentication device according to claim 5, wherein the gesture sequence T is generated by converting each number constituting the key sequence based on the correspondence table using the conversion function.

[0144] (Configuration 8) the authentication means generates a correspondence table in which one gesture corresponds to one key for each gesture authentication; 6. The authentication device according to claim 5, wherein the gesture sequence T is generated by converting each number constituting the key sequence based on the correspondence table using the conversion function.

[0145] (Configuration 9) An image acquisition means for acquiring an image in which at least a face of a user is captured; a matching means for matching biometric information obtained from a user in the image obtained by the image obtaining means with biometric information of one or more persons stored in advance, and calculating a matching score based on the biometric information; and a determination means for determining whether authentication of the user in the image has been successful or not based on the matching score calculated by the matching means and the determination result determined by the authentication means. 9. The authentication device according to any one of configurations 1 to 8.

[0146] (Configuration 10) The authentication device described in configuration 9, characterized in that the determination means determines that the user in the image matches the person in the pre-stored biometric information when the matching score is equal to or greater than a first threshold value and the gesture authentication determines that the gesture sequence T and the gesture sequence T' match.

[0147] (Configuration 11) a calculation means for determining whether or not the user in the image is a living body and calculating a non-living body score which is a score representing the likelihood of the user being a non-living body; The authentication device described in configuration 9, characterized in that the determination means determines whether authentication of the user in the image has been successful or not based on the matching score calculated by the matching means, the determination result determined by the authentication means, and the non-biometric score calculated by the calculation means.

[0148] (Configuration 12) The authentication device described in configuration 11, characterized in that the determination means determines that authentication of the user in the image is successful when the matching score is equal to or greater than a first threshold, the non-biometric score is less than a second threshold, and the gesture authentication determines that the gesture sequence T and the gesture sequence T' match.

[0149] (Configuration 13) 13. The authentication device according to any one of configurations 1 to 12, further comprising a presentation unit that presents to a user information prompting the user to perform the gesture via a display device or an audio device.

[0150] (Configuration 14) The authentication device according to any one of configurations 1 to 6, wherein the authentication means generates a correspondence table that associates a first gesture using a part of the user's body with a second gesture different from the first gesture for each gesture authentication.

[0151] (Configuration 15) The authentication device according to any one of configurations 5 to 8, wherein the authentication means sets the conversion function so as to increase the length of the gesture sequence T converted by the key sequence S according to a security level.

[0152] (Configuration 16) The determination means is If the accuracy based on the matching score calculated by the matching means is higher than a predetermined accuracy, it is determined that the authentication of the user in the image has been successful without determining the gesture authentication, The authentication device according to configuration 9, wherein, when the certainty is lower than the predetermined certainty, gesture authentication is performed by the authentication means to determine whether authentication of the user in the image has been successful.

[0153] (Configuration 17) When the matching score calculated by the matching means and the accuracy according to the non-biometric score calculated by the calculation means are higher than a predetermined accuracy, it is determined that authentication of the user in the image has been successful without determining the gesture authentication, 12. The authentication device according to claim 11, wherein, if the certainty is lower than the predetermined certainty, gesture authentication is performed by the authentication means to determine whether authentication of the user in the image has been successful.

[0154] (Configuration 18) A method for controlling an authentication device, comprising: a storing step of storing the key sequence S in a memory in association with the user's identification information; a generating step of converting the key sequence S stored in the storing step to generate a gesture sequence T; An acquisition step of acquiring a gesture detection result; an authentication step of determining whether or not gesture authentication has been successful based on a gesture sequence T' obtained as a result of the gesture detection obtained in the acquisition step and a gesture sequence T generated in the generation step; The control method for an authentication device, wherein the generating step generates the gesture sequence T such that the key sequence S cannot be uniquely estimated from the gesture sequence T.

[0155] (Configuration 19) A program for causing a computer to operate as the authentication device according to any one of configurations 1 to 17. [Explanation of symbols]

[0156] 100 Authentication Device 201 Image Acquisition Unit 202 Biometric information acquisition unit 203 Biometric Information Storage Department 204 Biometrics Department 205 Spoofing Detection Unit 206 Confidential Information Storage Department 207 Gesture Recognition Unit 208 General Certification Department

Claims

1. a storage means for storing the key string S in a memory in association with the user's identification information; a generating means for converting the key sequence S stored in the storage means to generate a gesture sequence T; An acquisition means for acquiring a gesture detection result; an authentication means for determining whether or not gesture authentication has been successful based on a gesture sequence T' obtained by the acquisition means as a result of the gesture detection and a gesture sequence T generated by the generation means; The authentication device is characterized in that the generating means generates the gesture sequence T such that the key sequence S cannot be uniquely inferred from the gesture sequence T.

2. 2. The authentication device according to claim 1, wherein the key sequence S is determined by a user arranging one or more elements included in a predefined set.

3. 2. The authentication device according to claim 1, further comprising a notification means for determining the key sequence S in which one or more elements included in a predefined set are arranged, and notifying the user corresponding to the identification information of the key sequence S.

4. 4. The authentication device according to claim 3, wherein the key sequence S is discarded when a predetermined number of times have elapsed since the key sequence S was generated, or when a predetermined time has elapsed since the key sequence S was generated, to perform authentication processing for a user corresponding to the identification information.

5. 2. The authentication device according to claim 1, wherein the generating means converts the key sequence S into the gesture sequence T based on a conversion function that satisfies both a first condition and a second condition that is different from the first condition.

6. 6. The authentication device according to claim 5, wherein the first condition is that the pre-conversion key sequence S cannot be uniquely inferred by observing the converted value of the gesture sequence T only once, and the second condition is that the gesture sequence T cannot be used consecutively to determine the success or failure of the gesture authentication.

7. the authentication means generates a correspondence table in which one gesture corresponds to two or more keys for each gesture authentication; 6. The authentication device according to claim 5, wherein the gesture sequence T is generated by converting each number constituting the key sequence using the conversion function based on the correspondence table.

8. the authentication means generates a correspondence table in which one gesture corresponds to one key for each gesture authentication; 6. The authentication device according to claim 5, wherein the gesture sequence T is generated by converting each number constituting the key sequence using the conversion function based on the correspondence table.

9. An image acquisition means for acquiring an image in which at least a face of a user is captured; a matching means for matching biometric information acquired from a user in the image acquired by the image acquisition means with biometric information of one or more persons stored in advance, and calculating a matching score based on the biometric information; and a determination means for determining whether authentication of the user in the image has been successful or not based on the matching score calculated by the matching means and the determination result determined by the authentication means.

2. The authentication device according to claim 1.

10. 10. The authentication device according to claim 9, wherein the determination means determines that the user in the image matches the person in the pre-stored biometric information when the matching score is equal to or greater than a first threshold value and when the gesture authentication determines that the gesture sequence T and the gesture sequence T' match.

11. a calculation means for determining whether or not the user in the image is a living body and calculating a non-living body score which is a score representing the likelihood of the user being a non-living body; The authentication device according to claim 9, characterized in that the determination means determines whether authentication of the user in the image has been successful or not based on the matching score calculated by the matching means, the determination result determined by the authentication means, and the non-biometric score calculated by the calculation means.

12. The authentication device according to claim 11, wherein the determination means determines that authentication of the user in the image has been successful when the matching score is equal to or greater than a first threshold, the non-biometric score is less than a second threshold, and the gesture authentication determines that the gesture sequence T and the gesture sequence T' match.

13. 2. The authentication device according to claim 1, further comprising a presentation unit that presents to the user, via a display device or an audio device, information that prompts the user to perform the gesture.

14. The authentication device according to claim 1, characterized in that the authentication means generates a correspondence table that associates a first gesture using a part of the user's body and a second gesture different from the first gesture for each gesture authentication.

15. 6. The authentication device according to claim 5, wherein the authentication means sets the conversion function so as to increase the length of the gesture sequence T converted by the key sequence S in accordance with a security level.

16. The determination means is If the accuracy based on the matching score calculated by the matching means is higher than a predetermined accuracy, it is determined that the authentication of the user in the image has been successful without determining the gesture authentication, 10. The authentication device according to claim 9, wherein, when the certainty is lower than the predetermined certainty, gesture authentication is performed by the authentication means to determine whether authentication of the user in the image has been successful.

17. When the matching score calculated by the matching means and the accuracy according to the non-biometric score calculated by the calculation means are higher than a predetermined accuracy, it is determined that authentication of the user in the image has been successful without determining the gesture authentication, 12. The authentication device according to claim 11, wherein, when the certainty is lower than the predetermined certainty, gesture authentication is performed by the authentication means to determine whether authentication of the user in the image has been successful.

18. A method for controlling an authentication device, comprising: a storing step of storing the key sequence S in a memory in association with the user's identification information; a generating step of converting the key sequence S stored by the storing step to generate a gesture sequence T; An acquisition step of acquiring a gesture detection result; an authentication step of determining whether or not gesture authentication has been successful based on a gesture sequence T' obtained as a result of the gesture detection obtained in the acquisition step and a gesture sequence T generated in the generation step; The control method for an authentication device, wherein the generating step generates the gesture sequence T such that the key sequence S cannot be uniquely inferred from the gesture sequence T.

19. A program for causing a computer to operate as the authentication device according to any one of claims 1 to 17.

Images