Authentication system, terminal device, personal confirmation method, and program

Abstract

To provide an authentication system capable of constructing a mechanism for making a user having a use right source of a storage medium surely execute personal confirmation using the storage medium, and consequently, improving authentication intensity of the personal confirmation by preventing unauthorized use of the storage medium.SOLUTION: A terminal device 20 or a server device for authentication 10 has a mechanism for executing not only a key code (PIN) for reading personal confirmation information stored in an IC card 60 but also authentication using a face image in the case of executing personal confirmation processing using the IC card 60, and making a registration desiring user surely exist near the IC card 60 on a real space by controlling timing to image the face of the registration desiring user in inputting the key code of the IC card 60.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present invention relates to an authentication system, a terminal device, an identity verification method, and a program. [Background technology]

[0002] 2. Description of the Related Art Conventionally, network services such as Internet banking or mail order sites have been provided to provide services to customers via a communication network.

[0003] Recently, it has become common to conduct identity verification when registering to use such network services. In such cases, a card for identifying individual citizens, such as a My Number card or a Social Security Number, or an IC card such as a driver's license is often used.

[0004] For example, a system for performing identity verification using such an IC card is known that performs identity verification by performing key code authentication and facial authentication using an IC card that stores various information such as information (including personal identification information) of a user who has legitimate authority to use the IC card, a facial image of the user, and an electronic certificate, which are associated with key information such as a PIN, and a facial image generated by capturing an image of the face of the person wishing to be identified (for example, Patent Document 1). [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2019-050014 A Summary of the Invention [Problem to be solved by the invention]

[0006] However, systems such as the one described in Patent Document 1 do not control the timing of capturing the facial image of the person wishing to have their identity verified, making it possible for fraudulent authentication such as obtaining the facial image of the person in advance, and therefore the authentication strength for identity verification cannot be said to be high.

[0007] The present invention has been made to solve the above-mentioned problems, and its purpose is to construct a mechanism that ensures that a user who has the right to use a storage medium must carry out identity verification using the storage medium by controlling the timing of capturing a facial image of a user wishing to have their identity verified, and as a result, to provide an authentication system etc. that can prevent unauthorized use of the storage medium and improve the authentication strength of the identity verification. [Means for solving the problem]

[0008] (1) In order to solve the above problems, the present invention provides An authentication system that performs electronic authentication processing regarding identity verification using a storage medium in which given information for verifying the identity of a user who has a right of use is stored as identity verification information, comprising: The storage medium stores user-related information on the user, including at least unique identification information for identifying the user, and identity verification image information showing an image of a physical characteristic part of the user, in association with key information for authenticating whether the user is a legitimate user, as the identity verification information; a reception processing means for executing a reception process for receiving key information input by a user who wishes to be identified; a read control means for controlling a read means for reading the personal identification information from the storage medium; an imaging control means for controlling an imaging means for imaging a physical feature of the desired user and generating captured image information; an authentication control means for executing an identity verification process indicating a process for verifying an identity of the user or a process related to the identity verification process based on the input key information, identity verification image information included in the read identity verification information, and the generated captured image information; Equipped with The authentication control means When executing the identity verification process, if the key information is accepted and the reading position of the storage medium relative to the reading means satisfies given reading conditions, the configuration allows the imaging means to capture an image of the desired user's physical characteristics.

[0009] With this configuration, the present invention requires that a storage medium such as an IC card be present in a predetermined reading position relative to the reading means, otherwise it is not possible to capture the desired user's physical features such as a facial image and therefore it is not possible to generate captured image information in the first place. Therefore, when executing identity verification processing, it is possible to request input operations, etc., from a user who has legitimate authority to use the storage medium.

[0010] That is, the present invention controls the timing for capturing a facial image of the desired user, thereby ensuring that the desired user is present in the vicinity of the storage medium in real space when the user's identity is authenticated.

[0011] Therefore, the present invention can establish a mechanism that ensures that a user who has the authority to use a storage medium can perform identity verification using the storage medium, thereby preventing unauthorized use of the storage medium, such as the storage medium being used by another user, and improving the authentication strength of identity verification using the storage medium.

[0012] In addition, the term "storage medium" includes, for example, a storage medium in which given information is stored in an IC chip, such as an IC card or an IC tag, as well as a physical storage medium in which information is stored using light or magnetism, etc.

[0013] In particular, the storage medium may be one stored in a portable information terminal device such as a smartphone.

[0014] A "user with the right to use" refers to a user who has the right to use the storage medium, including not only a user who owns the storage medium, but also a user who is permitted to use the storage medium, such as by loaning it to someone else.

[0015] In addition, the "electronic authentication process related to identity verification" may be an identity verification process, or various authentication processes for executing the identity verification process (guidance to a web page for identity verification procedures, temporary registration of an email address, two-step authentication, one-time password authentication, or processing for accessing a relevant server device when performing various types of authentication).

[0016] And, "image of physical feature" refers to an image of a physical part that can be distinguished from others, such as a face, a fingerprint, a retina, etc. However, basically, it is preferable that the image of the physical part is a face image, because the storage medium itself serves as identification.

[0017] Furthermore, "user-related information" includes identification information (personal management number) such as My Number or Social Security Number, as well as the user's name, address, and data files for electronic certificates.

[0018] "Key information" may be a key (information) such as text or code entered directly by a user, such as a PIN (Personal Identification Number) or password, or it may refer to a key (information) such as text or code obtained via a network.

[0019] In addition to the above, the "reading means" and the "imaging means" may be provided separately from the authentication system, or may be provided within the authentication system.

[0020] Moreover, "identification processing" refers to processing for determining whether or not a user who requests identity verification is a legitimate user (a legitimate user who has already been registered in the identity verification service) (whether or not the user is the actual user).

[0021] And the "identification process" includes, for example, (A1) The input key information matches the key information stored in the storage medium, and the stored face image for identity verification is identical or deemed to be identical to the captured face image; (A2) In the case of (A1), the personal identification information stored in the storage medium is read out, and the user-related information (e.g., a personal management number) included in the read out personal identification information is identical to the user-related information already stored (a personal management number stored in another device such as a server device), and (A3) The user-related information stored in a storage medium, such as information on an electronic certificate, has been authenticated as publicly issued information indicating the identity of the user (including, for example, authentication by public key cryptography such as the My Number Card), etc.

[0022] Furthermore, "processing related to identity verification processing" includes, for example, processing for providing input key information, identity verification image information, generated captured image information, or two or more of these pieces of information to another device when identity verification processing is performed by the other device, or processing for receiving control instructions such as permission to capture images.

[0023] (2) The present invention also provides The authentication control means The device is configured such that, when the key information is accepted and the reading position of the storage medium relative to the reading means satisfies given reading conditions, the imaging means is permitted to capture an image of the desired user's physical characteristics only if the state in which the reading conditions are satisfied is maintained.

[0024] With this configuration, the present invention requires that a user with the right to use the storage medium is present in the vicinity of the storage medium in real space in order to successfully authenticate the identity of the user, thereby preventing separate use of the storage medium by another person and the user with the right to use the storage medium.

[0025] In addition, "imaging of the desired user's physical features by the imaging means is permitted only if the reading conditions are maintained" means that imaging by the imaging means is not permitted if the reading conditions are not met.

[0026] (3) The present invention also provides The reception processing means, When the reading conditions are met, input of key information is accepted from the desired user.

[0027] With this configuration, the present invention can avoid the need to input key information in advance, thereby preventing fraud using the key information, and thereby improving the authentication strength of identity verification using a storage medium.

[0028] (4) The present invention also provides The reception processing means, When the state in which the reading condition is satisfied is cancelled, the key information that has already been input is invalidated, and the desired user is allowed to input the key information again.

[0029] With this configuration, the present invention enables the desired user to stop or remain in the real space where identity verification is performed at least until imaging of the desired user's physical characteristics is completed, thereby preventing separate use of the storage medium by the user who has the authority to use the storage medium, such as the storage medium being used by another person.

[0030] (5) The present invention also provides The image information for personal identification, which indicates an image of a physical characteristic part of the user, is a face image of the user.

[0031] With this configuration, the present invention can visually verify the identity of the person, and can therefore be used as an identification card in itself.

[0032] (6) In order to solve the above problems, the present invention provides A terminal device that is connected to a given server device and executes electronic authentication processing for identity verification using a storage medium in which given information for verifying the identity of a user having a right of use is stored as identity verification information, the terminal device comprising: The storage medium stores user-related information on the user, including at least unique identification information for identifying the user, and identity verification image information showing an image of a physical characteristic part of the user, in association with key information for authenticating whether the user is a legitimate user, as the identity verification information; a reception processing means for executing a reception process for receiving key information input by a user who wishes to be identified; a reading means for reading the personal identification information from the storage medium; A read control means for controlling the read means; an imaging means for imaging a physical feature of the desired user to generate captured image information; An imaging control means for controlling the imaging means; an authentication control means for executing an identity verification process indicating a process for verifying an identity of the user or a process related to the identity verification process based on the input key information, identity verification image information included in the read identity verification information, and the generated captured image information; Equipped with The authentication control means When executing the identity verification process, if the key information is accepted and the reading position of the storage medium relative to the reading means satisfies given reading conditions, the configuration allows the imaging means to capture an image of the desired user's physical characteristics.

[0033] With this configuration, the present invention allows a user who has the right to use a storage medium such as an IC card to This makes it possible to construct a mechanism for reliably performing identity verification using the storage medium.

[0034] Therefore, the present invention can prevent unauthorized use of a storage medium, such as use by another user of the storage medium, and improve the strength of authentication for personal identification using the storage medium.

[0035] (7) The present invention also provides The authentication control means When executing processing related to the identity verification processing, the device is configured to execute at least one of the following processing related to the identity verification processing: providing information for executing the identity verification processing to the server device; receiving a result of the identity verification processing executed by the server device and providing it to the desired user; and, if the identity verification is authenticated, executing a process to request registration for a given network service.

[0036] With this configuration, the present invention can work in conjunction with a server device to prevent unauthorized use of the storage medium, such as the storage medium being used by another user, and improve the authentication strength of identity verification using the storage medium.

[0037] (8) In order to solve the above problems, the present invention provides A program for executing a process related to identity verification using a storage medium in which given information for verifying the identity of a user having a right of use is stored as identity verification information, The storage medium stores user-related information on the user, including at least unique identification information for identifying the user, and identity verification image information showing an image of a physical characteristic part of the user, in association with key information for authenticating whether the user is a legitimate user, as the identity verification information; a reception processing means for executing a reception process for receiving key information input by a user who wishes to be identified; a read control means for controlling a read means for reading the personal identification information from the storage medium; An imaging control means for controlling an imaging means for imaging a physical feature of the desired user and generating captured image information; and an authentication control means for executing an identity verification process indicating a process for performing identity verification or a process related to the identity verification process based on the input key information, identity verification image information included in the read identity verification information, and the generated captured image information; Function as a The authentication control means When the key information is accepted and the reading position of the storage medium relative to the reading means satisfies given reading conditions, the imaging means is permitted to capture an image of the desired user's physical characteristics.

[0038] With this configuration, the present invention can establish a mechanism for ensuring that a user who has the right to use a storage medium such as an IC card can perform identity verification using the storage medium.

[0039] Therefore, the present invention can prevent unauthorized use of a storage medium, such as use by another user of the storage medium, and improve the strength of authentication for personal identification using the storage medium.

[0040] (9) In order to solve the above problems, the present invention provides The given information for verifying the identity of a user who has the right to use is called identity verification information. 1. A method for verifying identity by using a storage medium having a file stored therein, the method comprising: The storage medium stores user-related information on the user, including at least unique identification information for identifying the user, and identity verification image information showing an image of a physical characteristic part of the user, in association with key information for authenticating whether the user is a legitimate user, as the identity verification information; executing a reception process for receiving key information input by a user who wishes to be identified; Controlling a reading means for reading the personal identification information from the storage medium; Controlling an imaging means for imaging a physical feature of the desired user and generating captured image information; and Executing an identity verification process indicating a process for performing identity verification or a process related to the identity verification process based on the input key information, identity verification image information included in the read identity verification information, and the generated captured image information; Including, When executing the identity verification process, if the key information is accepted and the reading position of the storage medium relative to the reading means satisfies given reading conditions, the configuration allows the imaging means to capture an image of the desired user's physical characteristics.

[0041] With this configuration, the present invention can establish a mechanism for ensuring that a user who has the right to use a storage medium such as an IC card can perform identity verification using the storage medium.

[0042] Therefore, the present invention can prevent unauthorized use of a storage medium, such as use by another user of the storage medium, and improve the strength of authentication for personal identification using the storage medium. [Brief description of the drawings]

[0043] [Figure 1] 1 is a system configuration diagram showing a configuration of an authentication management communication system according to an embodiment. [Diagram 2]FIG. 2 is a functional block diagram illustrating a configuration of an authentication server device according to an embodiment. [Diagram 3] FIG. 2 is a functional block diagram illustrating an example of a configuration of a terminal device according to one embodiment. [Figure 4] 1 is a diagram for explaining an authentication process related to a personal identification process in an authentication management communication system according to an embodiment; [Diagram 5] FIG. 2 is a diagram showing an example of personal identification information stored in an IC card according to one embodiment. [Figure 6] 10 is a flowchart showing an operation performed when performing authentication processing related to identity verification, including identity verification processing, executed in a terminal device of one embodiment; [Figure 7] 10 is a flowchart showing an operation performed when performing authentication processing related to identity verification, including identity verification processing, executed in a terminal device of one embodiment; [Figure 8] 10 is a flowchart showing an operation performed when performing authentication processing related to identity verification, including identity verification processing, executed in a terminal device of one embodiment; DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0044] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0045] In the embodiment described below, the authentication system of the present application is applied to an authentication management communication system using a storage medium such as an IC card having a terminal device used by a user, an authentication server device that controls various authentication processes, a network service server device that provides network services, and an information management server device that manages authentication processes related to identity confirmation. This is an embodiment in which the above is applied.

[0046] In addition, in this embodiment, an IC card is used as the storage medium. However, the storage medium may be, in addition to the IC card, a storage medium such as an IC tag in which given information is stored in an IC chip, or a physical storage medium in which information is stored optically or magnetically. The storage medium may be stored in a portable information terminal device such as a smartphone.

[0047] Furthermore, in this embodiment, a user with the right to use refers to a user who has the right to use the storage medium, including not only a user who owns a storage medium such as an IC card, but also a user who is permitted to use the storage medium (i.e., a user who has been loaned the storage medium), and refers to a user who has the right to use the storage medium.

[0048] [1] Authentication management and communication system First, an overview of an authentication management communication system 1 according to the present embodiment will be described with reference to FIG.

[0049] FIG. 1 is a system configuration diagram showing the configuration of an authentication management communication system 1 in this embodiment.

[0050] In addition, to prevent the diagram from becoming too complicated, FIG. 1 only shows IC cards 60 and terminal devices 20 used by some users, as well as some network service server devices (hereinafter also referred to as "service server devices") 30.

[0051] That is, in the actual authentication management communication system 1, there are many more IC cards 60, terminal devices 20, and service server devices 30 than are shown in FIG.

[0052] The authentication management communication system 1 of this embodiment is a system that executes authentication processing for a pre-registered user, and if the user authentication is successful, provides various network services to the authenticated user via a network.

[0053] In particular, the authentication management communication system 1 of this embodiment is configured with a mechanism that ensures that identity verification using an IC card 60 is performed by a user who has the authority to use the IC card 60 when performing electronic authentication processing related to identity verification, including processing for identity verification using an IC card 60, which is a storage medium (hereinafter referred to as "identity verification processing").

[0054] That is, the authentication management communication system 1 of this embodiment has a configuration for executing processing to determine whether a user who wishes to be identified using an IC card 60 (i.e., a user who wishes to use a network service and register with the service, hereinafter referred to as a "user wishing to register") is already a legitimate user whose identity can be identified (for example, a user who has already been registered with an identity identification service) (whether the user is the actual user).

[0055] Specifically, the authentication management communication system 1 of this embodiment, as shown in FIG. 1, includes an authentication server device 10 that manages authentication processing related to identity verification or various authentication processing such as logging in to network services, and a terminal device 20 (e.g., terminal devices 20A, 20B, 20C) that is connected to the authentication server device 10 via a network such as the Internet and performs authentication processing including identity verification processing in conjunction with the authentication server device 10.

[0056] As shown in FIG. 1, the authentication management communication system 1 of the present embodiment provides an identity verification service. The system comprises a service server device 30 which provides a specified network service on the premise that user registration has been performed in advance (on a network service different from the network service for which the user wishes to register), an information management server device 40 which manages (information management) identity verification information for identity verification including each user's unique identification information such as a personal management number (e.g., My Number) in accordance with legal requirements, provides and manages identity verification services, and a public authentication management server device 50 which manages identity verification information including the personal management number used when performing identity verification.

[0057] The authentication server device 10 is an information processing device that uses, for example, an API (Application Programming Interface) or a predetermined platform, and executes various processes related to identity verification at the time of registration to a network service and authentication after the registration.

[0058] Furthermore, the authentication server device 10 may be configured as one (device, processor), or may be configured as multiple (devices, processors).

[0059] The authentication server device 10 has various databases (broadly speaking, storage devices, memories) in which various information used in identity verification processing or authentication processing is stored. However, the authentication server device 10 of this embodiment may access a database (broadly speaking, storage devices, memories) connected via a network (intranet or internet).

[0060] Furthermore, the authentication server device 10 is configured to work in conjunction with each terminal device 20 and to manage the identity verification process of the user who owns each terminal device 20 and to execute the authentication process.

[0061] The terminal device 20 is a communication terminal device that is used by a user and is configured by an information processing device such as a PC (personal computer), a tablet-type information communication terminal device, a smartphone, a mobile phone, a game device, or an HMD.

[0062] In addition, the terminal device 20 is a device that can be connected to the authentication server device 10 via a network such as the Internet (WAN) or LAN, and is configured to establish a communication line with the authentication server device 10 via wired or wireless means to send and receive various types of data.

[0063] In addition, the terminal device 20 has a configuration including a communication control function for communicating with the authentication server device 10, such as input information entered by a user, and a display function for performing display control using data received from the authentication server device 10 and the service server device 30.

[0064] The service server device 30 is a server device for providing various network services including banking services for financial institutions, reservation services for restaurants, inns, transport etc., product sales services, SNS services, content provision services for games, music, videos etc., cloud services such as various applications including e-mail, and information provision services such as search and advertisement.

[0065] In particular, when a user registers for a network service, the service server device 30 is configured to register the user (hereinafter referred to as the "user wishing to register") as a user providing the network service (i.e., the user wishing to register) once the identity of the user wishing to register (hereinafter referred to as the "user wishing to register") has been confirmed through an authentication process related to identity verification processing (i.e., when identity verification authentication is successful).

[0066] In addition, the service server device 30 receives the user ID of the user who wishes to register from the authentication server device 10. If the authentication is successful, the authenticated terminal device 20 is configured to log into the network service provided, and execute various processes for providing the corresponding service to the user.

[0067] The service server device 30 may have various functions related to authentication such as the authentication process of the authentication server device 10.

[0068] The information management server device 40 is an information processing device for linking the corresponding terminal device 20 with the official authentication management server device 50 when performing processes related to identity verification, including identity verification processing.

[0069] Furthermore, the information management server device 40 may be configured as one (device, processor) or may be configured as multiple (devices, processors).

[0070] Specifically, like the authentication server device 10, the information management server device 40 has a configuration that uses, for example, an API (application programming interface) or a specified platform, etc., to link each terminal device 20 with the public authentication management server device 50 to perform authentication based on personal identification information.

[0071] The public authentication management server device 50 is an information processing device that manages (information management) identity verification information for identity verification, including each user's unique identification information (i.e., personal management number) such as a My Number, social security number, or driver's license number, in accordance with legal requirements.

[0072] Moreover, the public authentication management server device 50 may be configured with one (device, processor) or may be configured with a plurality of (devices, processors).

[0073] The public authentication management server device 50 has various databases (broadly speaking, storage devices, memories) that store the identity verification information of each user and various information used in authentication processing related to identity verification. However, the public authentication management server device 50 of this embodiment may access a database (broadly speaking, storage devices, memories) connected via a network (intranet or internet).

[0074] Specifically, the public authentication management server device 50, like the authentication server device 10, manages the personal identification information of each user using, for example, an API (application programming interface) or a specified platform, and when performing authentication processing related to personal identification, works in conjunction with the information management server device 40 to make inquiries about the personal identification information and perform other authentication-related processing.

[0075] [2] Authentication server device Next, the authentication server device 10 of this embodiment will be described with reference to Fig. 2. Fig. 2 is an example of a functional block diagram showing the configuration of the authentication server device 10 of this embodiment.

[0076] The authentication server device 10 of this embodiment includes a processing unit 100, a database 140, a storage unit 170, an information storage medium 180, and a communication unit 196, as illustrated in FIG.

[0077] It is not necessary for the authentication server device 10 to include all of the components shown in FIG. 2, and some of them may be omitted.

[0078] The storage unit 170 serves as a work area for the processing unit 100 and the like, and the function thereof can be realized by hardware such as a RAM (VRAM), etc. In particular, the storage unit 170 functions as a work area used when various processes are executed.

[0079] The information storage medium 180 is readable by a computer, and stores programs, data, and the like. That is, the information storage medium 180 stores a program for causing a computer to function as each unit of the present embodiment (a program for causing a computer to execute the processing of each unit).

[0080] The processing unit 100 can perform various processes of this embodiment based on data read from a program (data) stored in the information storage medium 180.

[0081] For example, the information storage medium 180 is an optical disk (CD, DVD), a magneto-optical disk (MO), a magnetic disk, a hard disk, a flash memory such as a solid-state drive, a magnetic tape, or a memory (ROM), a memory card, or the like.

[0082] The database 140 is formed by an optical disk (CD, DVD), a magneto-optical disk (MO), a magnetic disk, a hard disk, a flash memory such as a solid-state drive, a magnetic tape, or a memory (ROM), a memory card, or the like.

[0083] The database 140 is a database in which information about each user for performing authentication processing when logging in to each service server device 30 is registered as user authentication information.

[0084] In particular, database 140 stores, for each user, a user name, a password, and user-related information for authentication (e.g., name, credit card number, contact information such as email and mobile phone number), and user authentication information for identifying the user when performing authentication processing, such as design information, in association with each user ID.

[0085] The communication unit 196 performs various controls for communicating with the outside (e.g., terminal device 20 or service server device 30), and its functions are configured by hardware such as various processors or communication ASICs, programs, etc.

[0086] The processing unit 100 performs various processes of this embodiment based on the programs (data) stored in the storage unit 170. The processing unit 100 of this embodiment may read out the programs and data stored in the information storage medium 180, temporarily store the read out programs and data in the storage unit 170, and perform processes based on the programs and data.

[0087] Furthermore, the processing unit 100 (processor) performs various processes using the main memory in the storage unit 170 as a work area. The functions of the processing unit 100 can be realized by hardware such as various processors (CPU, DSP, etc.) or programs.

[0088] Specifically, the processing unit 100 includes a communication control unit 101 , a DB management control unit 102 , an authentication processing unit 103 , an identity verification processing management unit 104 , and a timer management unit 107 .

[0089] The communication control unit 101 establishes communication lines with the terminal device 20, the service server device 30, and the like via the network, and communicates with them.

[0090] The DB management control unit 102 executes processes such as reading, writing, deleting, and updating each piece of data in the database 140 .

[0091] The authentication processing unit 103 receives input information entered via each terminal device 20 for each terminal device 20, and performs authentication processing for each user based on the received input information (specifically, a user name or a user ID and a password) and authentication information for the user already registered in the database 140 (i.e., a user name or a user ID and a password).

[0092] The identity verification process management unit 104 cooperates with the terminal device 20 to execute identity verification process or process related to the identity verification process.

[0093] The timer management unit 107 has a function of measuring the current date and time and from a predetermined timing, and outputs the current time and the measurement result when the predetermined timing arrives.

[0094] [3] Terminal device Next, functions of the terminal device 20 will be described with reference to Fig. 3. Fig. 3 is a functional block diagram showing an example of the configuration of the terminal device 20 of this embodiment.

[0095] As shown in FIG. 3, the terminal device 20 of this embodiment has a processing unit 200, a card reader / writer 240, an imaging unit 250, an operation input unit 260 consisting of a touch panel or the like, a memory unit 270, an information storage medium 280, a display unit 290 consisting of a display element such as a liquid crystal panel, a communication unit 296, and a sound output unit 292.

[0096] The card reader / writer 240 reads and writes information from and to an IC card 60 held by a user.

[0097] For example, the card reader / writer 240 of this embodiment reads out personal identification information including a personal management number from the IC card 60 .

[0098] The card reader / writer 240 can be realized by, for example, a card reader for NFC (Near Field Communication).

[0099] The imaging section 250 is made up of an imaging camera having a predetermined imaging angle and focal length and a predetermined imaging element such as a CCD, and an image generating section that converts the output of the imaging camera into an image.

[0100] In addition, the imaging unit 250 cooperates with the processing unit 200 to transmit biometric information, such as facial image information obtained by capturing an image of the user's face and digitizing the facial image, to the authentication server device 10 when performing identity verification processing.

[0101] The operation input unit 260 is a device for inputting input information from the player, and outputs the input information from the player to the processing unit 200 .

[0102] The operation input unit 260 of this embodiment has a configuration for detecting input information (input signal) from a user, and is composed of, for example, a lever, a button, a microphone, a touch panel display, a keyboard, a mouse, and the like.

[0103] The storage unit 270 serves as a work area for the processing unit 200 and the like, and the function thereof can be realized by hardware such as a RAM (VRAM).

[0104] The storage unit 270 of this embodiment includes a main storage unit 271 used as a work area, an image buffer 272 in which display images and the like displayed during identity verification processing are stored, and an authentication user. and a user information storage unit 273 in which user information including a part or all of the user-related information is stored. Note that a configuration in which some of these are omitted may also be adopted.

[0105] The information storage medium 280 is computer-readable, and in addition to various applications and an OS (operating system), in this information storage medium 280, in particular, in this embodiment, various data including the user ID of the user corresponding to the terminal device 20 is stored.

[0106] That is, the information storage medium 280 stores applications for causing a computer to function as each unit of the present embodiment (applications for causing a computer to execute the processing of each unit) and a user ID.

[0107] For example, the information storage medium 280 is an optical disk (CD, DVD), a magneto-optical disk (MO), a magnetic disk, a hard disk drive, a flash memory, a magnetic tape, or a memory (ROM), a memory card, or the like.

[0108] The communication unit 296 performs various controls for communicating with the outside (e.g., other terminal devices 20, the authentication server device 10, and the service server device 30), and its functions are composed of hardware such as various processors or communication ASICs, programs, etc.

[0109] The processing unit 200 can perform various processes of this embodiment by reading and executing the applications stored in the information storage medium 280. Note that the types of applications stored in the information storage medium 280 are arbitrary.

[0110] The processing unit 200 performs various processes of this embodiment based on the application stored in the information storage medium 280. The processing unit 200 of this embodiment may read out a program or data stored in the information storage medium 280, temporarily store the read out program or data in the storage unit 270, and perform processing based on the program or data.

[0111] Furthermore, the processing unit 200 (processor) performs various processes using a main memory unit in the storage unit 270 as a work area. The functions of the processing unit 200 can be realized by hardware such as various processors (CPU, DSP, etc.) or programs.

[0112] The processing unit 200 includes a communication control unit 210, a web browser 211, an imaging control unit 212, a display control unit 213, an input reception processing unit 214, a reading control unit 215, an identity verification processing unit 216, a drawing unit 220, and a sound processing unit 230. Note that some of these may be omitted.

[0113] The communication control unit 210 performs processing for transmitting and receiving data to and from the authentication server device 10, the service server device 30, or the information management server device 40.

[0114] In addition, the communication control unit 210 receives data transmitted from the authentication server device 10, the service server device 30, or the information management server device 40, and performs processes such as storing the received data in the memory unit 270, analyzing the received data, and control processes related to the transmission and reception of other data.

[0115] The communication control unit 210 may store destination information (IP address, port number) of the authentication server device 10, the service server device 30, or the information management server device 40 in the information storage medium 280 and perform processing for managing the same.

[0116] Then, the communication control unit 210 may communicate with the authentication server device 10, the service server device 30, or the information management server device 40 when receiving input information for starting communication from the user.

[0117] The communication control unit 210 may communicate with the information management server device 40 via the authentication server device 10 .

[0118] In addition, the communication control unit 210 may send and receive data with the authentication server device 10, the service server device 30, or the information management server device 40 at a predetermined period, or may send and receive data with the authentication server device 10, the service server device 30, or the information management server device 40 when input information is received from the operation input unit 260.

[0119] The Web browser 211 is an application program for viewing Web pages (authentication screen, identity verification processing screen, or service enjoyment screen), and downloads HTML files, image files, etc. from a Web server (authentication server device 10, service server device 30, or information management server device 40), analyzes the layout, and controls the display.

[0120] Furthermore, the Web browser 211 transmits data using an input form (such as a link, a button, or a text box) to a Web server (the authentication server device 10, the service server device 30, or the information management server device 40).

[0121] The terminal device 20 can use the Web browser 211 to display information from a Web server (for example, the service server device 30) specified by a URL via the Internet.

[0122] For example, the terminal device 20 can display each content (data such as HTML) received from the authentication server device 10, the service server device 30, or the information management server device 40 by the Web browser 211.

[0123] When the imaging control unit 212 works in conjunction with the authentication server device 10 to perform identity verification processing, it causes the imaging unit 250 to capture an image of the user's face and generate facial image information (hereinafter referred to as "captured facial image information" or "captured image information").

[0124] The display control unit 213 performs processing for displaying on the display unit 290. For example, the display control unit 213 may use the Web browser 211 for display.

[0125] The input reception processing unit 214 recognizes input information input by the user from the operation input unit 260, and receives the recognized information.

[0126] The reading control unit 215 controls the card reader / writer 240 that reads the personal identification information from the IC card 60 .

[0127] The identity verification processing unit 216 executes identity verification processing indicating processing for performing identity verification or processing related to the identity verification processing based on the input key information, the identity verification image information contained in the read identity verification information, and the generated captured image information.

[0128] The drawing unit 220 performs drawing processing based on various processes performed by the processing unit 200, thereby generating an image, which is output to the display unit 290 by the display control unit 213.

[0129] The sound processing unit 230 performs sound processing based on the results of various processes performed by the processing unit 200 , generates background music, sound effects, voice, or the like, and outputs them to the sound output unit 292 .

[0130] [4] Method of the present embodiment [4.1] Overview Next, the authentication process related to the identity verification process in the authentication management communication system 1 of this embodiment will be described with reference to FIG.

[0131] FIG. 4 is a diagram for explaining authentication processing related to personal identification processing in the authentication management communication system 1 of this embodiment.

[0132] The authentication management communication system 1 of this embodiment has a configuration for performing electronic authentication processing related to identity verification using an IC card 60 in which given information for verifying the identity of a user who has the right to use the device is stored as identity verification information.

[0133] In other words, the authentication management communication system 1 of this embodiment has a configuration for performing authentication processing related to user registration for a network service provided by the service server device 30 and identity verification processing associated therewith, including identity verification processing, using an IC card 60 that stores identity verification information including unique identification information (i.e., a personal management number) for identifying a user.

[0134] In addition, the IC card 60 stores user-related information about the user, which includes at least the above, and identity verification image information showing an image of the user's physical characteristics, such as the face, in association with key information (i.e., a key code such as a PIN) for authenticating whether the user has legitimate authority as identity verification information.

[0135] In particular, the IC card 60 stores personal identification information that cannot be read unless a proper key code is entered.

[0136] The terminal device 20 is configured to read out the personal identification information stored in the IC card 60 based on the user's instructions and the key code entered by the user, and to execute electronic authentication processing related to personal identification in conjunction with the authentication server device 10 or the information management server device 40, or independently, based on the read out personal identification information.

[0137] In addition, when reading out personal identification information from the IC card 60, the terminal device 20 is configured not only to input a key code, but also to capture an image of the physical features of a user wishing to register, such as the face, under the instructions of the user who wishes to register for the network service.

[0138] At this time, in order to ensure that the desired user is present in the vicinity of the IC card 60 in real space, the terminal device 20 of this embodiment has a configuration that controls the timing of capturing a facial image of the user wishing to register, either alone or in conjunction with the authentication server device 10, the information management server device 40, or both.

[0139] In other words, the terminal device 20, authentication server device 10, information management server device 40, or a combination of these in this embodiment is configured to not allow imaging of physical features of a user wishing to register, such as a facial image, unless a reading condition is met, such as the IC card 60 being present in a predetermined reading position relative to the terminal device 20.

[0140] For example, in order to realize the above configuration, the terminal device 20 of the present embodiment has the following configuration as shown in FIG. (A1) A reception process for receiving a key code input by a user who wishes to register; (A2) a read control process for controlling reading of personal identification information from the IC card 60; (A3) an imaging control process for controlling imaging of physical features of the user who wishes to register and generation of captured image information; and (A4) An identity verification process that performs electronic authentication processing related to identity verification based on the input key code, identity verification image information included in the read identity verification information, and the generated captured image information; The present invention has a configuration for executing the above.

[0141] As shown in FIG. 4, when executing identity verification processing, the terminal device 20 is configured to permit imaging of the physical characteristics of the user wishing to register if a key code is accepted and if the position of the storage medium when reading user-related information from the storage medium satisfies given reading conditions.

[0142] FIG. 4 shows an example in which authentication processing for personal identification is executed by the information management server device 40 under the management of the authentication server device 10, and the IC card 60 satisfies the reading condition.

[0143] FIG. 4 shows the identity verification process in the terminal device 20 as follows: (B1) Permission to photograph the face of user P who wishes to register; (B2) Determining whether the input key code is identical to a key code already stored in the IC card 60; (B3) determining whether the captured face image is identical to the face image stored in the IC card 60; (B4) transmitting an encrypted data file of an electronic certificate for performing authentication processing to the information management server device 40; and (B5) Receiving authentication results; An example is given in which this is executed.

[0144] In addition to the terminal device 20, FIG. 4 also shows an authentication server device 10 that manages authentication processing related to identity verification processing, a service server device 30 that provides a given network service, an information management server device 40 that links the corresponding terminal device 20 with the public authentication management server device 50 when executing processing related to identity verification including identity verification processing, and the public authentication management server device 50 that manages identity verification information.

[0145] With such a configuration, the authentication management communication system 1 of this embodiment cannot capture a facial image or other physical characteristic parts (e.g., face) of the user wishing to register unless a reading condition such as the IC card 60 being present at a specified reading position is met, and therefore cannot generate captured image information in the first place.

[0146] Therefore, the authentication management communication system 1 of this embodiment is capable of requesting an input operation or the like from a user who has a legitimate right to use the storage medium when executing the identity verification process.

[0147] In other words, the authentication management communication system 1 of this embodiment controls the timing of capturing the facial image of the desired user, thereby ensuring that the user wishing to register is present in the vicinity of the IC card 60 in real space when their identity is authenticated.

[0148] As a result, the authentication management communication system 1 of the present embodiment establishes a mechanism for ensuring that a user who has the right to use the IC card 60 can perform identity verification using the IC card 60. This makes it possible to prevent unauthorized use of the IC card 60, such as use by another user of the IC card 60, and improves the strength of authentication for personal identification using the IC card 60.

[0149] In this embodiment, the authentication server device 10 or the information management server device 40 may execute one or all of the processes among the reading control process, the imaging control process, and the identity verification process. In this case, however, it is assumed that the processes of inputting the key code, reading from the IC card 60, and capturing an image of a physical feature are executed in the terminal device 20.

[0150] In addition, in the following embodiments, a case will be described in which the reading control process, the imaging control process, and the identity verification process are executed by the terminal device 20, and a modified example will be described in which some or all of the reading control process, the imaging control process, and the identity verification process are executed by either the authentication server device 10, the information management server device 40, or both.

[0151] Furthermore, in this embodiment, the image of a physical feature refers to an image of a physical part that can be distinguished from others, such as a face, a fingerprint, or a retina. However, basically, it is preferable that the image of the physical part is a face image, since the IC card 60 itself serves as identification. Therefore, in this embodiment, a description will be given using a face image.

[0152] [4.2] Personal identification information Next, the personal identification information of this embodiment will be described with reference to Fig. 5. Fig. 5 is a diagram showing an example of personal identification information stored in the IC card 60 of this embodiment.

[0153] The IC card 60 is a storage medium that stores personal identification information such as user-related information about a user who has the right of use, and also functions as an identification card with a face photograph of the user printed thereon.

[0154] As shown in FIG. 5, each IC card 60 stores a personal management number already assigned to a user (i.e., a user with the right to use), user-related information such as the user's name and a data file of an electronic certificate, and information on the user's facial image (hereinafter referred to as "facial image information for identity verification") in association with a key code such as a PIN as identity verification information.

[0155] In particular, the personal identification information is stored with reading locked based on a key code for authenticating whether the user has legitimate authority that is predetermined when the personal identification information is registered by the user or the like.

[0156] Specifically, a personal management number is a number issued to an individual by a public institution such as a government agency to a user who wishes to use it, or is issued compulsorily, and is identification information such as a My Number, a social security number, or a driver's license number.

[0157] The user-related information includes the user's name, four basic pieces of information: address, date of birth, and gender, as well as a data file of the electronic certificate, an unremovable private key, and a public key for decrypting data encrypted with the private key.

[0158] In addition, user-related information may include contact information such as a telephone number and the user's nickname, or, if rewritable data is stored, information on electronic money, digital legal tender, points or specific currencies that have monetary value in a specific commercial area, and information such as their usage history.

[0159] The identity verification face image information may basically be information on the image of the printed surface (card face) of the IC card 60 on which the face image is printed, or may simply be information on the face image.

[0160] The data file of the electronic certificate includes, for example, signature private key information, user authentication private key information, public key information, and information on the issuing certification authority of the electronic certificate.

[0161] When the IC card 60 is issued, the personal identification information is stored in the official authentication management server device 50 (specifically, in a database, not shown) in association with a personal management number, etc.

[0162] [4.3] Reception process Next, a reception process executed by the terminal device 20 of this embodiment will be described.

[0163] (Acceptance process for key code input) When identity verification processing is performed, the input reception processing unit 214 performs a reception process to perform identity verification and receive a key code entered by a user who wishes to register for a network service, as shown in FIG. 4, for example.

[0164] Specifically, when the identity verification processing unit 216 starts executing the identity verification process under the instructions of the user wishing to register, the input reception processing unit 214 works in conjunction with the display control unit 213 to display a given key button on the display unit 290 while displaying an image prompting the user to enter a key code (hereinafter referred to as the "input key code").

[0165] At this time, the input reception processing unit 214 works in conjunction with the operation input unit 260 to execute a reception process of recognizing and accepting, as an input key code, information on the keys input by the user from the operation input unit 260.

[0166] In particular, when numeric keypad buttons or various key buttons arranged in a QWERTY arrangement that prompts the user to enter an input key code such as a PIN are displayed on the display unit 290, the input reception processing unit 214 recognizes multiple pressing operations (i.e., touch operations) on the key buttons by the user wishing to register using the operation input unit 260, and executes a reception process in which the recognized key buttons are recognized as an input key code and accepted.

[0167] Then, the input reception processing unit 214 provides the received input key code to the identity verification processing unit 216 .

[0168] (Acceptance process for input of imaging instructions) The input reception processing unit 214 executes a reception process for receiving an image capture instruction input by a registration-desiring user who wishes to be identified, as shown in FIG.

[0169] Specifically, when execution of the identity verification process is started and an input key code is input, and when imaging by the imaging unit 250 is permitted by the imaging control unit 212, the input reception processing unit 214 works in conjunction with the display control unit 213 to display on the display unit 290 a message encouraging the user wishing to register to capture an image of the user's physical characteristics, while executing a reception process that accepts input of an imaging instruction for capturing an image by the imaging unit 250.

[0170] At this time, the input reception processing unit 214 displays an imaging area image that specifies the imaging range on the display unit 290, and receives input of an imaging instruction by detecting a pressing operation (i.e., a touch operation) of the imaging button displayed together with the imaging area image.

[0171] Then, the input reception processing unit 214 provides the received image capture instruction to the personal identification processing unit 216 .

[0172] [4.4] Read control process Next, a reading control process executed by the terminal device 20 of this embodiment will be described.

[0173] The reading control unit 215 controls the card reader / writer 240 that reads the personal identification information from the IC card 60 .

[0174] In particular, under the instruction of the personal identification processing unit 216 , the reading control unit 215 reads out a key code such as a PIN stored in the IC card 60 (hereinafter referred to as a “stored key code”) using the card reader / writer 240 .

[0175] Then, when the reading control unit 215 determines that the input key code matches the stored key code under the instruction of the identity verification processing unit 216, it reads out identity verification information, for example, as shown in FIG. 4, and provides the read identity verification information to the identity verification processing unit 216.

[0176] In other words, the reading control unit 215 receives an instruction to read the identity verification information from the identity verification processing unit 216 when the key code is accepted, the input key code matches the stored key code, the proximity of or contact between the IC card 60 and the card reader / writer 240 is detected, and an image of physical features such as the face of the user wishing to register is captured.

[0177] Then, when the reading control unit 215 receives an instruction to read the personal identification information, if the IC card 60 is maintained in close proximity or contact with the card reader / writer 240, the reading control unit 215 reads the personal identification information stored in the IC card 60 via the card reader / writer 240, and provides the read personal identification information to the personal identification processing unit 216.

[0178] In addition, even if the reading control unit 215 receives an instruction to read the personal identification information, if the IC card 60 is not maintained in close proximity or contact with the card reader / writer 240, the reading control unit 215 notifies the personal identification processing unit 216 of an error in reading the personal identification information.

[0179] [4.5] Imaging control processing Next, an imaging control process executed by the terminal device 20 of this embodiment will be described.

[0180] The imaging control unit 212 executes an imaging control process to control the imaging unit 250, which captures physical features such as the face of a user wishing to register and generates captured image information, based on an imaging instruction from the user wishing to register, as shown in FIG. 4, for example.

[0181] Specifically, under the instruction of the identity verification processing unit 216, the imaging control unit 212 works in conjunction with the display control unit 213 to cause the display unit 290 to display an imaging area image that specifies the imaging range and an imaging button that performs imaging in conjunction with the operation input unit 260.

[0182] Then, when the imaging control unit 212 recognizes a pressing operation (i.e., a touch operation) of the imaging button by the user wishing to register using the operation input unit 260, it images the imaging area (e.g., the face area) captured by the imaging unit 250 to generate captured image information, and provides the generated captured image information to the identity verification processing unit 216.

[0183] The imaging control unit 212 may change the imaging range and control the imaging direction of the imaging unit 250 based on an operation input via the operation input unit 260 by a user who wishes to register.

[0184] [4.6] Identity verification process including image capture permission when performing authentication process related to identity verification Next, the identity verification process of this embodiment will be described.

[0185] (Basic principles of identity verification processing) The identity verification processing unit 216 executes identity verification processing based on the input key code (i.e., the input key code), the identity verification image information contained in the read identity verification information, and the captured image information captured and generated by the imaging unit 250.

[0186] In particular, when executing the identity verification process, the identity verification processing unit 216 is configured to permit the imaging unit 250 to capture an image of the physical features (i.e., the face) of the user wishing to register if an input key code is accepted and the reading position of the IC card 60 relative to the card reader / writer 240 satisfies given reading conditions.

[0187] In other words, in order to ensure that identity verification processing using the IC card 60 is performed by a user who has the authority to use the IC card 60, the identity verification processing unit 216 is configured to not allow imaging of physical features of the user wishing to register, such as a facial image, unless a reading condition is met, such as the IC card 60 being present at a specified reading position of the card reader / writer 240, thereby improving the authentication strength of identity verification.

[0188] Specifically, the identity verification processing unit 216 performs identity verification processing as shown in FIG. (A1) a read condition determination process for determining whether or not a read condition is met when an input key code is accepted; (A2) an imaging permission process that, when the reading conditions are met by the reading condition determination process and this state is maintained, cooperates with the imaging control unit 212 to permit the imaging unit 250 to capture an image of the face of the user wishing to register; (A3) A key code identity determination process is executed to determine whether the input key code is identical to a key code already stored in the IC card 60, and if the input key code is identical to the stored key code, personal identification information is acquired from the IC card 60, and an authentication process is executed to perform personal identification of the user who wishes to register based on the acquired personal identification information; Execute.

[0189] (Reading condition determination process) When the input of the input key code is accepted by the reception process, the personal identification processing unit 216 executes a reading condition determination process to determine whether or not the IC card 60 has been detected as being placed close to or in contact with the card reader / writer 240.

[0190] In particular, the personal identification processing unit 216 determines that the reading conditions are met when the IC card 60 is placed close to or in contact with the card reader / writer 240, or when this state is maintained.

[0191] On the other hand, if the IC card 60 is not placed close to or in contact with the card reader / writer 240, or if the state of the IC card 60 being placed close to or in contact with the card reader / writer 240 is released after the reading conditions are met, the identity verification processing unit 216 determines that the reading conditions are not met.

[0192] That is, to determine whether the IC card 60 and the user wishing to register are being used separately, the identity verification processing unit 216 determines whether the input key code is accepted and whether the reading position of the IC card 60 relative to the card reader / writer 240 satisfies given reading conditions.

[0193] (Shooting permission processing) When the identity verification processing unit 216 detects that the IC card 60 is placed close to or in contact with the card reader / writer 240 and the reading conditions are met, it determines that imaging is permitted and executes an imaging permission process to display the imaging button as depressible (touchable).

[0194] If the IC card 60 remains in close proximity to or in contact with the card reader / writer 240, the identity verification processing unit 216 determines that image capture permission continues and continues to display the image capture button as depressable (touchable).

[0195] On the other hand, when the proximity or contact of the IC card 60 to the card reader / writer 240 is released, the identity verification processing unit 216 determines that imaging has been changed to not permitted, and changes the contactable imaging button to a display that indicates it cannot be pressed (cannot be contacted).

[0196] At this time, if the IC card 60 is no longer in close proximity to or in contact with the card reader / writer 240 (i.e., if the state in which the reading conditions are met is no longer met), the identity verification processing unit 216 may invalidate the input key code accepted by the reception process and prompt the user to re-enter the input key code, or, if the IC card 60 is again in close proximity to or in contact with the card reader / writer 240, cause the imaging button to be displayed as depressable (touchable).

[0197] In this case, when the state in which the reading conditions are satisfied is cancelled, the input reception processing unit 214 may invalidate the key code that has already been input, and may receive a request for re-input of the key code from the user who wishes to register.

[0198] When the imaging control unit 212 detects a press of an imaging button that is displayed as depressible, it images the imaging area (e.g., the face area) captured by the imaging unit 250 to generate captured image information.

[0199] (Identity verification process including key code identity determination process) When imaging is permitted and face image information is generated by the imaging unit 250 , the personal identification processing unit 216 controls the reading control unit 215 to read out the stored key code stored in the IC card 60 .

[0200] Then, the identity verification processing unit 216 executes a key code identity determination process to determine whether or not the input key code (PIN) input in the reception process matches the stored key code stored in the read IC card 60.

[0201] Furthermore, the personal identification processing unit 216 executes a personal identification information acquisition process for acquiring personal identification information from the IC card 60 when the input key code is identical to the stored key code.

[0202] In particular, the identity verification processing unit 216 acquires, as identity verification information, user-related information such as the personal management number, the user's name, and a data file of an electronic certificate, as well as identity verification face image information of the user wishing to register.

[0203] Then, the identity verification processing unit 216 performs identity verification processing by using the stored identity verification information. The identity of the face image and the captured face image is judged, and if the stored face image for identity verification and the captured face image are identical or deemed to be identical, the user desiring to be registered is authenticated as the person in question.

[0204] The identity verification processing unit 216 quantifies the features of each face image extracted from the facial bone structure and skin color as well as the positions and shapes of the eyes, nose, mouth and other facial features based on the stored face image for identity verification, the captured face image, and the features of each pixel in the face area of ​​each face image.

[0205] Then, based on the feature amounts of the respective face images, the personal identification processing unit 216 determines that the stored face image for personal identification and the captured face image are the same when the face images have the same feature amounts.

[0206] In particular, the identity verification processing unit 216 determines that the facial images are the same not only when the feature amounts of the facial images match completely, but also when they match at a certain rate or more (for example, 90% or more).

[0207] On the other hand, the identity verification processing unit 216 may be linked to the information management server device 40 under the management of the authentication server device 10 to execute identity verification processing for verifying the identity of the user who wishes to register.

[0208] For example, the identity verification processing unit 216 (A1) determining whether a face image for identity verification and a captured face image are identical; (A2) When the stored face image for identity verification and the captured face image are identical or deemed to be identical, read out user-related information (e.g., personal management number and name) in cooperation with the read control unit 215, (A3) Determine whether the read user-related information is identical to the user-related information registered in the public authentication management server device 50; (A4) If the read user-related information is identical to the user-related information already registered in the public authentication management server device 50, the user desiring to register may be authenticated as the user himself / herself.

[0209] In this case, the identity verification processing unit 216 may obtain registered user-related information from the public authentication management server device 50 via the information management server device 40, or may provide the read user-related information to the information management server device 40 and request a determination of its identity, and based on the result, authenticate that the user wishing to register is the user in question.

[0210] On the other hand, for example, the identity verification processing unit 216 may be configured as follows instead of the above: (B1) determining whether a face image for identity verification and a captured face image are identical; (B2) When the stored face image for identity verification and the captured face image are identical or deemed to be identical, the read control unit 215 is operated to read out the data file of the electronic certificate, the private key information, and the public key information from among the user-related information, (B3) Encrypt the read data file of the electronic certificate with the private key to generate an encrypted electronic certificate, (B4) Transmitting the data file of the encrypted electronic certificate and the public key information to the information management server device 40 and requesting identity verification; (B5) When the identity of the user is authenticated by the information management server device 40 based on the data file and public key information of the encrypted electronic certificate, the user wishing to register may be authenticated as the user himself / herself.

[0211] In this case, if the data file of the encrypted electronic certificate can be decrypted by the public key information, the information management server device 40 determines that the identity of the person has been authenticated and notifies the person of the authentication. The processing unit 216 is notified.

[0212] [4.7] Registration and logging in to network services Next, registration to a network service provided by the service server device 30 of this embodiment will be described.

[0213] When the identity verification process for the user wishing to register is completed and the identity of the user wishing to register is authenticated, the service server device 30, under the management of the authentication server device 10, works in conjunction with the corresponding terminal device 20 to register the user wishing to register as a user wishing to register who will enjoy the corresponding network service.

[0214] Specifically, the service server device 30 cooperates with the authentication server device 10 to register in the database 140 user information desiring to be registered, such as a user name or a user ID and a password.

[0215] When a login is performed by a user wishing to register, the service server device 30 works in conjunction with the authentication server device 10 and performs authentication processing for the user wishing to register based on the input information (specifically, the user name or user ID and password) entered via the terminal device 20 and the information stored in the database 140.

[0216] If the authentication of the user desiring to register is successful, the authentication processing unit 103 allows the user to log in to the network service provided by the service server device 30.

[0217] [4.8] Variations Next, a modification of this embodiment will be described.

[0218] (Identity verification process using an authentication server device, etc.) In this embodiment, the authentication server device 10 may execute the identity verification process.

[0219] That is, the authentication server device 10 may execute each step of the authentication process related to the identity verification process in conjunction with the terminal device 20 of the registration-desiring user who wishes to be identified.

[0220] In this case, the authentication server device 10 includes an identity verification process management unit 104 having some or all of the functions of the identity verification process unit 216 of the terminal device 20 .

[0221] The authentication server device 10 cooperates with the card reader / writer 240 and the image capturing section 250 of the terminal device 20 to execute each step of the authentication process related to the personal identification process.

[0222] Specifically, the identity verification process management unit 104 performs identity verification processing as follows: (A1) A read condition determination process for determining whether or not a read condition is met when an input key code is accepted by the terminal device 20; (A2) an imaging permission process that, when the reading conditions are met by the reading condition determination process and this state is maintained, cooperates with the terminal device 20 and permits the imaging unit 250 of the terminal device 20 to capture an image of the face of the user wishing to register; (A3) A key code identity determination process is executed to determine whether the input key code is identical to a stored key code stored in the IC card 60, and if the input key code is identical to the stored key code, an instruction to obtain identity verification information from the IC card 60 is sent to the terminal device 20, while an identity verification process is executed to verify the identity of the user wishing to register based on the obtained identity verification information; Execute.

[0223] The personal identification process management unit 104 may cooperate with the information management server device 40 to execute each step of the authentication process related to the personal identification process.

[0224] In this case, the terminal device 20 executes each process related to transmission and reception of various information, instructions, control data, and the like as a process related to identity verification processing.

[0225] That is, in this case, the terminal device 20 (identity verification processing unit 216) performs at least one of the following processes related to identity verification processing: providing information for executing identity verification processing to the authentication server device 10 or the information management server device 40, receiving the results of the identity verification processing performed by the authentication server device 10 or the information management server device 40 and providing them to the user wishing to register, and performing processing to request registration to a given network service if the identity verification is authenticated.

[0226] On the other hand, the authentication server device 10 may only execute the identity verification process (A3) above, and the terminal device 20 may execute the condition determination process (A1) above and the image capture permission process (A2) above, so that each step of the authentication process related to the identity verification process is executed by the authentication server device 10 (including linkage with the information management server device 40) and the terminal device 20.

[0227] In this modification, each step of the authentication process related to the personal identification process may be executed by the information management server device 40 instead of the authentication server device 10.

[0228] (Other Examples of Authentication Server Device and Service Server Device) In this embodiment, the authentication server device 10 may have the functions of the information management server device 40 .

[0229] In this embodiment, the service server device 30 may have the functions of the authentication server device 10.

[0230] (Key information obtained via a network, etc.) In this embodiment, an example is described in which the key code is directly input by the user wishing to register via the operation input unit 260, but the key code may be obtained via a network, or may be stored in advance in the terminal device 20 and obtained by reading it out at the instruction of the user wishing to register, etc.

[0231] (Timing of key code acceptance) In this embodiment, after the key code is input, a reading condition determination process is executed to determine whether or not imaging is permitted for the imaging unit 250, which determines whether the IC card 60 is present in a specified reading position of the card reader / writer 240, etc. However, if imaging is permitted for the imaging unit 250 by the reading condition determination process, the user wishing to register may be requested to input a key code.

[0232] That is, when the reading conditions are met in the reading condition determination process, the input reception processing unit 214 may receive an input of a key code from a user who wishes to register.

[0233] [5] Operation of this embodiment Next, the operation of the terminal device 20 of this embodiment when performing authentication processing related to identity verification, including identity verification processing, will be described with reference to FIGS.

[0234] 6 to 8 are flowcharts showing operations performed when performing authentication processing related to identity verification, including identity verification processing, in the terminal device 20 of this embodiment.

[0235] In this operation, it is assumed that a personal management number has already been issued and an IC card 60 has already been issued.

[0236] This operation will be described using authentication processing relating to identity verification, including identity verification processing during initial registration for a given network service.

[0237] First, when the Web browser 211 detects the start of authentication processing related to identity verification, including identity verification processing, during user registration for a given network service (step S101), the identity verification processing unit 216 requests the service server device 30 to execute authentication processing related to identity verification via the communication control unit 210 and the communication unit 296 (step S102).

[0238] At this time, the service server device 30 accesses the authentication server device 10 and performs processing to establish cooperation associated with the execution of identity verification processing between the authentication server device 10, the relevant terminal device 20 and the service server device 30, such as issuing a session ID and the associated authentication (hereinafter referred to as the "cooperation establishment processing").

[0239] Next, when cooperation is established between the authentication server device 10, the corresponding terminal device 20, and the service server device 30 (step S103), the identity verification processing unit 216 works in conjunction with the service server device 30 to execute processing related to preparations for identity verification, such as confirming the intention of the user wishing to register, registering the email address of the user wishing to register, and agreeing to the terms of use (hereinafter referred to as "identity verification preparation processing") (step S104).

[0240] Next, when the identity verification processing unit 216 detects the completion of the identity verification preparation process (step S105), it controls the display control unit 213 to execute a guidance process (hereinafter referred to as the "key code input guidance process") to prompt the user wishing to register to input an input key code such as a PIN for reading identity verification information from the IC card 60 (step S106).

[0241] For example, the display control unit 213 displays a screen that prompts the user wishing to register to input a PIN via the operation input unit 260, and when the PIN is input, displays a message indicating that the PIN has been input.

[0242] Next, when the input of the input key code is accepted by the input acceptance processing unit 214 (step S107), the identity verification processing unit 216 controls the display control unit 213 to execute an induction process (hereinafter referred to as "IC card contact induction process") to encourage the user wishing to register to contact or bring the IC card 60 close to the card reader / writer 240 (step S108).

[0243] For example, the display control unit 213 displays on the display unit 290 a screen that prompts the user to contact or place the IC card 60 close to the card reader / writer 240 while displaying the position at which the IC card 60 should be contacted.

[0244] Next, when the reading control unit 215 detects contact or close placement of the IC card 60 by the card reader / writer 240 (step S111), the identity verification processing unit 216 determines that the reading conditions are met and controls the display control unit 213 to execute a guidance process (hereinafter referred to as the "imaging guidance process") to prompt the imaging unit 250 to capture an image of the face of the user wishing to register (step S112).

[0245] At this time, the display control unit 213 causes the display unit 290 to display an imaging area image for specifying the imaging range, and an imaging button for imaging in conjunction with the operation input unit 260.

[0246] Next, the identity verification processing unit 216 repeatedly determines whether or not an imaging instruction (pressing of the imaging button) has been detected by the input reception processing unit 214, and whether or not the reading condition has been released (the state in which the IC card 60 is in contact with or in close proximity to the card reader / writer 240 (hereinafter also referred to as the "contact, etc. state") has been released) (steps S113 and S114).

[0247] At this time, if the personal identification processing unit 216 determines that the state in which the IC card 60 is in contact with or in proximity to the card reader / writer 240 has been released, the process returns to step S108.

[0248] Also, at this time, when the input reception processing unit 214 receives an image capture instruction based on the image capture button while the IC card 60 is maintained in contact or proximity with the card reader / writer 240 (step S115), the identity verification processing unit 216 causes the image capture unit 250 to capture an image of the imaging range under the instruction of the identity verification processing unit 216, and generates image information of the captured image (i.e., captured face image information) (step S115).

[0249] Next, the identity verification processing unit 216 determines whether the input key code (PIN) matches the stored key code stored in the IC card 60 (step S116), and if it is determined that the key codes do not match, proceeds to processing of step S108.

[0250] On the other hand, if the personal identification processing unit 216 determines that the input key code (PIN) matches the stored key code, it causes the reading control unit 215 to read the personal identification information stored in the IC card 60 (step S121).

[0251] Next, the personal identification processing unit 216 determines whether or not the personal identification image information included in the read personal identification information is the same as the captured face image information or is within a range that is considered to be the same as the captured face image information (step S122).

[0252] At this time, if the identity verification processing unit 216 determines that the identity verification image information and the captured facial image information are the same or are not within a range in which they can be considered to be identical, it proceeds to processing of step S108, and if it determines that the identity verification image information and the captured facial image information are the same or are within a range in which they can be considered to be identical, it proceeds to processing of step S123.

[0253] Next, the personal identification processing unit 216 transmits the read personal identification information to the information management server device 40 via the authentication server device 10, and waits to receive an authentication result based on the personal identification information (step S123).

[0254] At this time, the information management server device 40 determines whether the received personal identification information matches the personal identification information already stored in the database, and if the personal identification information matches, it determines that the personal identification has been successful and provides this information to the terminal device 20 via the authentication server device 10.If the personal identification information does not match, it determines that the personal identification has been unsuccessful and provides this information to the terminal device 20.

[0255] Next, upon receiving the authentication result (step S124), the identity verification processing unit 216 determines whether the received authentication result is successful or not (step S125).

[0256] At this time, if the identity verification processing unit 216 determines that the authentication result is successful, it works in conjunction with the authentication server device 10 and the service server device 30 to start executing processing related to new user registration (step S126), and terminates this operation.

[0257] On the other hand, if the identity verification processing unit 216 determines that the authentication result is not successful (i.e., failure), it controls the display control unit 213 to display that fact on the display unit 290 (step S127), and ends this operation.

[0258] [6] Other The present invention is not limited to the above-described embodiment, and various modifications are possible. For example, a term cited as a broadly defined or synonymous term in the description in the specification or drawings can be replaced with a broadly defined or synonymous term in other descriptions in the specification or drawings.

[0259] The present invention includes configurations that are substantially the same as the configurations described in the embodiments (for example, configurations with the same functions, methods and results, or configurations with the same purpose and effect). The present invention also includes configurations in which non-essential parts of the configurations described in the embodiments are replaced. The present invention also includes configurations that achieve the same effects as the configurations described in the embodiments or that can achieve the same purpose. The present invention also includes configurations in which publicly known technology is added to the configurations described in the embodiments.

[0260] Although the embodiments of the present invention have been described in detail as above, it will be easily understood by those skilled in the art that many modifications are possible without substantially departing from the novel features and effects of the present invention. Therefore, all such modifications are intended to be included within the scope of the present invention. [Explanation of symbols]

[0261] 1: Authentication management communication system 10: Authentication server device 20: Terminal device 30: Service server device 40: Information management server device 50: Public authentication management server device 60: IC card 100: Processing section 101: Communication control unit 102: DB management control unit 103: Authentication processing unit 104: Identity Verification Processing Management Department 107: Timer management unit 140: Database 170: Storage section 180: Information storage medium 196: Communications Department 200: Processing section 210: Communication control section 211: Web browser 212: Imaging control unit 213: Display control unit 214: Input reception processing unit 215: Reading control unit 216: Identity verification processing unit 220: Drawing section 230: Sound processing section 240: Reader / Writer 250: Imaging unit 260: Operation input section 270: Storage section 271: Main memory 272: Image buffer 273: User information storage unit 280: Information storage medium 290:Display section 292: Sound output section 296: Communications Department

Claims

1. An authentication system that performs electronic authentication processing regarding identity verification using a storage medium in which given information for verifying the identity of a user who has a right of use is stored as identity verification information, comprising: The storage medium stores user-related information on the user, including at least unique identification information for identifying the user, and identity verification image information showing an image of a physical characteristic part of the user, in association with key information for authenticating whether the user is a legitimate user, as the identity verification information; a reception processing means for executing a reception process for receiving key information input by a user who wishes to be identified; a read control means for controlling a read means for reading the personal identification information from the storage medium; an imaging control means for controlling an imaging means for imaging a physical feature of the desired user and generating captured image information; an authentication control means for executing an identity verification process indicating a process for verifying an identity of the user or a process related to the identity verification process based on the input key information, identity verification image information included in the read identity verification information, and the generated captured image information; Equipped with The authentication control means An authentication system characterized in that, when executing the identity verification process, if the key information is accepted and the reading position of the storage medium relative to the reading means meets given reading conditions, the system permits the imaging means to capture an image of the desired user's physical characteristics.

2. 2. The authentication system according to claim 1, The authentication control means An authentication system which permits the imaging means to capture an image of the desired user's physical characteristics only when the key information is accepted and the reading position of the storage medium relative to the reading means meets given reading conditions and maintains the state in which the reading conditions are met.

3. 3. The authentication system according to claim 1, The reception processing means, an authentication system that accepts input of key information from the desired user when the reading conditions are met;

4. 3. The authentication system according to claim 1, The reception processing means, When the state in which the reading condition is satisfied is cancelled, the authentication system invalidates the key information already input and allows the desired user to input the key information again.

5. 3. The authentication system according to claim 1, An authentication system, wherein the identity verification image information indicating an image of the user's physical features is a facial image of the user.

6. A terminal device that is connected to a given server device and executes electronic authentication processing for identity verification using a storage medium in which given information for verifying the identity of a user having a right of use is stored as identity verification information, the terminal device comprising: The storage medium includes at least unique identification information for identifying the user. User-related information on a user and identity verification image information showing an image of a physical characteristic part of the user are stored in association with key information for authenticating whether the user is a legitimate user, as the identity verification information; a reception processing means for executing a reception process for receiving key information input by a user who wishes to be identified; a reading means for reading the personal identification information from the storage medium; A read control means for controlling the read means; an imaging means for imaging a physical feature of the desired user to generate captured image information; An imaging control means for controlling the imaging means; an authentication control means for executing an identity verification process indicating a process for verifying an identity of the user or a process related to the identity verification process based on the input key information, identity verification image information included in the read identity verification information, and the generated captured image information; Equipped with The authentication control means A terminal device characterized in that, when executing the identity verification process, if the key information is accepted and the reading position of the storage medium relative to the reading means satisfies given reading conditions, the terminal device allows the imaging means to capture an image of the desired user's physical characteristics.

7. 7. The terminal device according to claim 6, The authentication control means A terminal device that, when executing processing related to the identity verification processing, executes at least one of the following processes related to the identity verification processing: providing information for executing the identity verification processing to the server device; receiving a result of the identity verification processing executed by the server device and providing it to the desired user; and, if the identity verification is authenticated, executing a process to request registration for a given network service.

8. A program for executing a process related to identity verification using a storage medium in which given information for verifying the identity of a user having a right of use is stored as identity verification information, The storage medium stores user-related information on the user, including at least unique identification information for identifying the user, and identity verification image information showing an image of a physical characteristic part of the user, in association with key information for authenticating whether the user is a legitimate user, as the identity verification information; a reception processing means for executing a reception process for receiving key information input by a user who wishes to be identified; a read control means for controlling a read means for reading the personal identification information from the storage medium; An imaging control means for controlling an imaging means for imaging a physical feature of the desired user and generating captured image information; and an authentication control means for executing an identity verification process indicating a process for performing identity verification or a process related to the identity verification process based on the input key information, identity verification image information included in the read identity verification information, and the generated captured image information; Function as a The authentication control means A program characterized by permitting the imaging means to capture an image of a physical characteristic part of the desired user when the key information is accepted and the reading position of the storage medium relative to the reading means meets given reading conditions.

9. The given information for verifying the identity of a user who has the right to use is called identity verification information.

1. A method for verifying identity by using a storage medium having a file stored therein, the method comprising: The storage medium stores user-related information on the user, including at least unique identification information for identifying the user, and identity verification image information showing an image of a physical characteristic part of the user, in association with key information for authenticating whether the user is a legitimate user, as the identity verification information; executing a reception process for receiving key information input by a user who wishes to be identified; Controlling a reading means for reading the personal identification information from the storage medium; Controlling an imaging means for imaging a physical feature of the desired user and generating captured image information; and Executing an identity verification process indicating a process for performing identity verification or a process related to the identity verification process based on the input key information, identity verification image information included in the read identity verification information, and the generated captured image information; Including, An identity verification method characterized in that, when executing the identity verification process, if the key information is accepted and the reading position of the storage medium relative to the reading means satisfies given reading conditions, the imaging means is permitted to capture an image of the desired user's physical characteristics.

Images