Password generation device

Abstract

To provide a password generation device that achieves higher security compared to a conventional aspect.SOLUTION: A password generation device 100 includes: an individual authentication unit 1 including a biological information acquisition unit 10 that acquires biological information of a user and a core key generation unit 20 that uses the biological information acquired by the biological information acquisition unit 10 to generate core key information; an access information acquisition unit 30 that acquires access information; and a password generation unit 40 that uses the core key information and the access information to generate a password.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a password generation device that generates a password by using biometric information of a user. [Background technology]

[0002] In terminal devices such as smartphones with biometric authentication functions, an ID and password for accessing the service are stored in advance, and access is achieved using the ID and password via the terminal device's biometric authentication function.

[0003] As an example of the prior art, for example, Patent Document 1 proposes an encryption key generation device comprising: a biometric information reading means for acquiring biometric information, and generating and outputting a biometric code based on the biometric information; an encryption key generation means for generating an encryption key to be applied to encryption processing or decryption processing based on the biometric code read and generated by the biometric information reading means; and a key generation code output means for outputting a key generation code for generating an encryption key identical to the encryption key generated by the encryption key generation means based on the biometric code. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2001-144743 Summary of the Invention [Problem to be solved by the invention]

[0005] If a conventional system is adopted that simply uses biometric information and allows access using an ID and password generated by the biometric authentication function of the terminal device, it is not easy to update the password and security is not sufficient.

[0006] The present invention provides a password generation device that achieves higher security than conventional embodiments. [Means for solving the problem]

[0007] [Concept 1] The password generating device according to the present invention comprises: A biometric information acquisition unit that acquires biometric information of a user; a seed key generation unit that generates seed key information by using the biometric information acquired by the biometric information acquisition unit; an access information acquisition unit that sets and acquires access information; a password generation unit that generates a password using the seed key information and the access information; The present invention may also include:

[0008] [Concept 2] The password generator according to Concept 1 is A storage unit that stores corresponding biometric information; a biometric information selection unit that selects corresponding biometric information corresponding to the biometric information acquired by the biometric information acquisition unit; Equipped with The seed key generation unit may generate seed key information by using the corresponding biometric information selected by the biometric information selection unit.

[0009] [Concept 3] In the password generating device according to concept 1 or 2, The storage unit stores one or more pieces of dummy biometric information in addition to the corresponding biometric information, The biometric information selection unit may select corresponding biometric information corresponding to the biometric information acquired by the biometric information acquisition unit from among corresponding biometric information and dummy biometric information.

[0010] [Concept 4] A password generating device according to any one of concepts 1 to 3, a storage unit for storing corresponding access information corresponding to the access information; an access information selection unit that selects corresponding access information; Equipped with The password generating unit may generate a password using the selected corresponding access information.

[0011] [Concept 5] A password generating device according to any one of concepts 1 to 4, a setting value generating unit that generates a password setting value using the selected corresponding access information; The password generation unit may generate a password using a password setting value generated by the setting value generation unit and seed key information generated by the seed key generation unit.

[0012] [Concept 6] 6. A password generating device according to any one of claims 1 to 5, Registration of biometric information or modification of biometric information may be possible only when a dedicated item is used.

[0013] [Concept 7] A password generating device according to any one of concepts 1 to 6, A storage unit that stores corresponding biometric information and corresponding access information; a biometric information selection unit that selects corresponding biometric information corresponding to the biometric information acquired by the biometric information acquisition unit; an access information selection unit that selects corresponding access information corresponding to the access information acquired by the access information acquisition unit; Equipped with A password generating unit may generate a password using the corresponding biometric information selected by the biometric information selecting unit and the corresponding access information selected by the access information selecting unit. Effect of the Invention

[0014] According to the present invention, it is possible to provide a password generation device that achieves higher security than conventional embodiments. [Brief description of the drawings]

[0015] [Figure 1] 1 is a diagram showing an overview of an information processing system according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a diagram showing an overview of an information processing system according to an embodiment of the present invention in a format different from that of FIG. [Diagram 3] FIG. 2 is a side view showing a dedicated item such as a dedicated card that can be used in the present embodiment and a reading device. [Figure 4] 11 is a side view showing a manner in which a dedicated item such as a dedicated card that can be used in the present embodiment communicates with a password generation device. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] Embodiment In this embodiment, not only a terminal device and a program are provided, but also a recording medium including a USB memory or the like for recording the program, an information processing device, an information processing system consisting of the information processing device and the terminal device, and an information processing method using these. The information processing method of this embodiment may be realized by a processor. In this embodiment, "or" and "alternative" also include the meanings of "and" and "as well as". That is, for example, in this embodiment, "A or B" means any of "A, B, and A and B".

[0017] The password generation device 100 of this embodiment uses a short-range communication technology such as Bluetooth (registered trademark). or USB terminal, it can communicate with terminal devices 200 such as smartphones, tablets, and personal computers. The password generation device 100 of this embodiment is used when the terminal device 200 accesses a certain site or uses a certain application. The terminal device 200 is capable of communicating with the server 300.

[0018] 1, the password generation device 100 of this embodiment may include a biometric information acquisition unit 10 consisting of a biometric sensor or the like that acquires biometric information of a user, a seed key generation unit 20 that generates seed key information using the biometric information acquired by the biometric information acquisition unit 10, an access information acquisition unit 30 that acquires access information, and a password generation unit 40 that generates a password using the seed key information and the access information. By adopting an aspect in which a password is generated using both the seed key information and the access information in this manner, higher security can be achieved.

[0019] An erasing unit 90 may be provided that erases the password generated by the password generating unit 40 a certain time (for example, 1 minute, 5 minutes, 10 minutes, etc.) after login. When such a configuration is adopted, even if the password generating device 100 is lost or stolen and analyzed by another person, it is difficult to extract the password, and password leakage can be more reliably prevented. The time for erasing the password may be set appropriately by the user who uses the password generating device 100 via the input unit 120 (see FIG. 2). Restrictions on numbers, letters, symbols, number of characters, etc. of the password generated by the password generating unit 40 may also be set via the input unit 120.

[0020] Unlike the mode in which the password is erased by the erasing unit 90, the password generated by the password generating unit 40 may be directly input when logging in to use the service, and the password may not be stored in the storage unit 60 (see FIG. 2). Even when such a mode is adopted, it is possible to prevent the password from being leaked.

[0021] The biometric information acquiring unit 10 acquires information related to the biometrics of the user, such as vein authentication, fingerprint authentication, face authentication, and retina authentication. The access information is linked to service identification information, such as a URL, a browser ID, and an application ID, and is information when accessing a specific URL or using a specific application. In this embodiment, when a user attempts to access a certain URL or use a certain application, a password is generated by the password generating unit 40 using the identification information (ID) of the URL or application and seed key information generated using the biometric information, and access to the URL or use of the application is permitted using the password.

[0022] The password generation device 100 may have a storage unit 60 that stores corresponding biometric information, and a biometric information selection unit 25 that has a pattern matching unit 26 and the like that selects corresponding biometric information corresponding to the biometric information acquired by the biometric information acquisition unit 10. In this case, the seed key generation unit 20 may generate seed key information using the corresponding biometric information selected by the biometric information selection unit 25. By adopting such an embodiment, seed key information can be generated based on corresponding biometric information prepared in advance, and it is possible to prevent a situation in which seed key information cannot be generated successfully depending on the method of biometric authentication. More specifically, when corresponding biometric information stored in advance is not used, there is a problem that the information changes depending on the acquisition range and acquisition angle of the biometric information acquired by the sensor, making it difficult to generate a fixed biometric code, but by adopting this embodiment, such inconvenience can be eliminated. In the seed key generating unit 20, a feature of a specific position may be extracted from the registered corresponding biometric information, and seed key information may be generated using a hash function. The same seed key information is generated by using the same specific position of the same corresponding biometric information. The storage unit 60 may have a second storage unit 62 and a first storage unit 61 having higher security than the second storage unit 62 (having a structure with enhanced security in terms of hardware structure). Then, the first storage unit 61 may store information for generating seed key information such as corresponding biometric information, and the second storage unit 62 may store corresponding access information, which will be described later. When such an embodiment is adopted, it is advantageous in that it becomes more difficult to extract information for generating seed key information, such as corresponding biometric information, even if password generation device 100 is lost or stolen. Typically, first storage unit 61 is provided in identity authentication unit 1.

[0023] A feature extractor 15 may be provided which extracts features of biometric information from data such as image data acquired by a biometric information acquisition unit 10 such as a biometric sensor, and sends the data to a pattern matching unit 26 and a feature data synthesizer 18.

[0024] Corresponding biometric information that matches the features extracted by the feature extractor 15 may be selected by the biometric information selection unit 25 described above.

[0025] The feature data combiner 18 may generate corresponding biometric information based on the features extracted by the feature extractor 15. The generation of corresponding biometric information by the feature data combiner 18 may be used when generating corresponding biometric information for the first time, or when generating corresponding biometric information for updating. In this embodiment, the personal authentication unit 1 has a biometric information acquisition unit 10, a feature extractor 15, a feature data combiner 18, and a biometric information selection unit 25. As will be described later, registration of biometric information may be possible only when a dedicated item 190 is used.

[0026] The storage unit 60 may store one or more pieces of dummy biometric information in addition to the corresponding biometric information used when generating the seed key information. In this case, the biometric information selection unit 25 selects the corresponding biometric information corresponding to the biometric information acquired by the biometric information acquisition unit 10 from the corresponding biometric information and the dummy biometric information. By adopting such an embodiment, it becomes difficult for a third party to determine which corresponding biometric information is actually used, so that security can be further improved. The dummy biometric information may be generated by using biometric information of a different place (area) from the corresponding biometric information when registering the biometric information. From the viewpoint of improving security, it is beneficial to generate multiple pieces of dummy biometric information.

[0027] In the feature data synthesizer 18, not only the corresponding biometric information but also dummy biometric information may be generated or updated. Also, the biometric information storage file stored in the storage unit 60 may include intermediate synthesis data. Then, the biometric information storage file may be updated using the data input from the feature extractor 15 and the intermediate synthesis data.

[0028] The feature extractor 15 may extract features from the biometric information acquired by the biometric information acquisition unit 10 such as a biometric sensor using a built-in algorithm. This algorithm may be stored in the storage unit 60. The biometric information selection unit 25, which is made up of a pattern matching unit 26 and the like, selects corresponding biometric information and data for the feature data extracted by the feature extractor 15. The degree of match with the biometric information storage file including the user's biometric information is calculated, and the data showing the highest degree of match and having a degree of match equal to or greater than a certain value is selected (if normal, the corresponding biometric information will be selected). Then, the seed key generation unit 20 generates and outputs seed key information corresponding to the selected data. Note that if the degree of match of the data showing the highest degree of match with the feature data extracted by the feature extractor 15 is less than a certain value, the seed key generation unit 20 may not generate seed key information. At this time, the fact that a password has not been generated may be notified via the terminal device 200, or may be output by the output unit 130 (see FIG. 2) of the password generation device 100.

[0029] The seed key generating unit 20 may call up the seed key information associated with the corresponding biometric information from the storage unit 60. When such an embodiment is adopted, the seed key information corresponding to each of the corresponding biometric information and one or more pieces of dummy biometric information may be stored in the storage unit 60. When such an embodiment is adopted, even if the password generating device 100 is lost or stolen and analyzed, it is unclear which seed key information is the seed key information to be used (seed key information associated with the corresponding biometric information), so that high security can be realized. However, from the viewpoint of security, as described above, it is more useful to use an embodiment in which the seed key generating unit 20 extracts a feature at a specific position from the corresponding biometric information and performs a predetermined conversion such as using a hash function to generate the seed key information.

[0030] When adopting an embodiment in which a first storage unit 61 and a second storage unit 62 are provided as the storage unit 60, an execution code may be stored in the first storage unit 61. This execution code may be included in a biometric information storage file. Then, as many files as the memory size allows may be created, and files other than the file storing the corresponding biometric information may be filled with dummy biometric information. The execution code is for calculating a hash value of the corresponding biometric information in order to generate seed key information, for example.

[0031] The storage unit 60 may store corresponding access information corresponding to each piece of access information. The service selector 50, which functions as an access information selector, selects the corresponding access information. When there is a plurality of pieces of access information, the corresponding corresponding access information corresponding to each piece of access information is stored. Corresponding access information is stored for each URL or application (e.g., application ID), and when a user terminal accesses a specific URL or uses a specific application, the corresponding corresponding access information is selected by the service selector 50, which is an access information selector. More specifically, when the access information acquisition unit 30 acquires information regarding access to a URL or application, service usage information such as a URL or application ID is sent to the service selector 50. Then, the service selector 50 extracts records (corresponding access information) that match the service designation information included in the service access information in the service information storage file stored in the storage unit 60 at a certain value or more. In this way, by using corresponding access information that matches the information regarding access at a certain value or more, the possibility of being a victim of phishing fraud can be reduced.

[0032] The corresponding access information may include user identification information such as a user ID. Then, the service selector 50 may send the password setting value and the user identification information to the password generation unit 40. When the corresponding access information includes user identification information such as a user ID, the corresponding access information is selected by the service selector 50, and the password generation unit 40 acquires the user identification information. At this time, the password setting value may be used for password generation in the password generation unit 40, while the user identification information such as the user ID may be input directly to the server 300 via the terminal device 200. In addition to this embodiment, when the terminal device 200 is connected to the server 300, the user identification information such as the user ID linked to the terminal device 200 may be automatically input to the server 300.

[0033] The service usage information is compared with the service usage history stored in the storage unit 60, and if no service access information matching a certain value or more is found, an alarm may be displayed on the terminal device 200. When service login on the terminal device 200 is successful, the time may be recorded as the service usage history.

[0034] A setting value generating unit 110 may be provided that generates a password setting value using the selected corresponding access information. The setting value generating unit 110 may generate a password setting value by applying a predetermined function such as a hash function to the corresponding access information.

[0035] When a new password is set, the access information acquisition unit 30 acquires service identification information such as a URL, a browser ID, and an application ID, and generates corresponding access information corresponding to the service identification information. The generated corresponding access information is stored in the storage unit 60. A password setting value is generated by the setting value generation unit 110 from the generated corresponding access information. On the other hand, corresponding biometric information whose pattern matches the extracted feature data of the biometric information acquired by the biometric information acquisition unit 10 at a threshold value or more is selected by the biometric information selection unit 25, and seed key information is generated using the corresponding biometric information. Then, a password is generated by the password generation unit 40 using the password setting value and the seed key information, and the password is input to the server 300 via the terminal device 200.

[0036] When resetting a password, the same process is carried out as when a new password is set. When resetting a password, the corresponding access information may be updated, or the corresponding access information already registered may be used without being updated.

[0037] When performing random number calculations to generate a password setting value when setting or resetting a password, the random number used may be stored as part of the service access information. In this case, the password setting value may be reproduced by reading and using the service access information at the second or subsequent access.

[0038] When password reset is specified by terminal device 200, the information is sent to service selector 50, and service selector 50 may read the password setting value of the corresponding service access information, update the password setting value using a random number generation function, and store it. At this time, a random number generation algorithm or the like that changes the password setting value generated by setting value generation unit 110 each time the password is reset may be used to prevent the reset password from becoming duplicated.

[0039] The reset password will be registered in the server 300 via the terminal device 200. The changed password will be used from now on. When a different password setting value is adopted for each password reset in this way, even if there is a possibility that the password may have been leaked, a different password can be generated by resetting the password, thereby improving security.

[0040] The service information storage file may include service specification information (application ID, URL, token information), service ID, password setting value, service usage history (cyclic data), and the like.

[0041] The password generating unit 40 may generate a password by applying the seed key information and the password setting value to a predetermined function. At this time, the password may be generated by applying information generated using the seed key information and the password setting value to a hash function. stomach.

[0042] The password generation unit 40 may receive an ID, a password setting value, alarm information, etc. from the service selector 50, and may also receive seed key information, alarm information, etc. from the seed key generation unit 20. The alarm information is transmitted when an inconvenience occurs, such as when there is no service access information that matches at or above a threshold, when there is no corresponding biometric information that matches at or above a threshold, and based on the alarm information, the terminal device 200 displays the information, or the output unit 130 notifies the user. The password generation unit 40 may regenerate a password based on the seed key information and the password setting value, and send the regenerated password to the terminal device 200 together with the ID information.

[0043] Registration of biometric information or change of biometric information may be possible only when using a dedicated item 190. For example, a dedicated item 190 such as a dedicated card may be read by a dedicated reading device 180 (see FIG. 3), or a dedicated item 190 such as a dedicated card may be communicated with by short-distance communication such as Bluetooth. It may be possible to register or change the biometric information, or change the internal data, only when the authentication is enabled (see FIG. 4). When such an embodiment is adopted, it is possible to further reduce the possibility of damage caused by spoofing by a third party, and to improve security. As a different embodiment (variation), it may be possible to generate seed key information by the password generation device 100 only when a dedicated item 190 such as a dedicated card is used.

[0044] The pseudo biometric information that matches the dedicated goods 190 such as a dedicated card may be stored in the storage unit 60. In this case, by having the reading device 180 read the dedicated goods 190 when registering the biometric information or changing the biometric information, execution based on the execution code for registering the biometric information or changing the biometric information is performed, and the biometric information is registered or changed.

[0045] Access to the identity authentication unit 1 or changes to information stored in the identity authentication unit 1 may be possible only from the biometric information acquisition unit 10, and may not be possible from outside. When such an embodiment is adopted, for example, internal information cannot be changed via external communication, and higher security can be achieved. In particular, as described above, when biometric information registration or biometric information change is possible only when the dedicated goods 190 is used, information for generating seed key information can be generated or updated only when both the dedicated goods 190 and the password generation device 100 are available, and therefore even higher security can be achieved. As an example, when initializing the password generation device 100, when registering service information, or when resetting a password, the dedicated goods 190 such as a setting card may be held over the biometric information acquisition unit 10 such as a biometric sensor to set the password.

[0046] When a user is about to use a service for the first time, the password generating unit 40 may generate a predetermined password by combining the seed key information and the access information corresponding to the service. As an example, when a user is about to use a certain service for the first time and a password is requested, the biometric information acquiring unit 10 may read the biometric information to generate corresponding biometric information or to change the preregistered dummy biometric information to the corresponding biometric information. In addition, at this time, the corresponding access information corresponding to the access information may be generated. Then, a password is generated by the seed key information and the corresponding access information generated by the corresponding biometric information. Then, this password is registered in the server 300 that provides the service as a password required when using the service. From the next time onwards, when the user is about to use the service, the biometric information acquiring unit 10 reads the biometric information, and the seed key generating unit 20 generates a password that is the same as the registered password by combining the seed key information and the corresponding access information generated by the corresponding biometric information, and the user can use the service by using the password.

[0047] When there is only one corresponding biometric information for generating seed key information, the same corresponding biometric information is used each time when generating seed key information. In this case, corresponding biometric information is selected from a biometric information storage file including corresponding biometric information and dummy biometric information each time, and the degree of matching with the corresponding biometric information is calculated by the biometric information selection unit 25 consisting of the pattern matching device 26 and the like. If the degree of matching is a certain value or more, seed key information corresponding to the selected corresponding biometric information is generated by the biometric information selection unit 25. On the other hand, when there are multiple corresponding biometric information for generating seed key information and different types of information are used for each service to be used, the corresponding access information is input, and the corresponding biometric information is selected from the biometric information storage file in the biometric information selection unit 25, and the degree of matching with the corresponding biometric information is calculated by the biometric information selection unit 25 consisting of the pattern matching device 26 and the like. In this case, if the degree of matching is a certain value or more, seed key information corresponding to the selected corresponding biometric information is generated by the biometric information selection unit 25.

[0048] An example of a processing method that can be adopted in this embodiment will be described.

[0049] When using a certain service such as a URL or an application, the user is required to input an ID and a password. At this time, the service selector 50, which is an access information selection unit, selects the corresponding access information for the service. Then, the password setting value corresponding to the corresponding access information is generated by the setting value generation unit 110.

[0050] Before or after the user is requested to input an ID or password, the user reads biometric information using a biometric information acquisition unit 10 such as a biometric sensor. When the biometric information is read in this way, the feature of the biometric information is extracted by the feature extractor 15. Then, from among a plurality of biometric feature storage files consisting of the corresponding biometric information and a plurality of dummy biometric information, the biometric information selection unit 25 selects the corresponding biometric information whose pattern matches the extracted feature data at a threshold value or more. At this time, the degree of match between the feature data extracted by the feature extractor 15 and the corresponding biometric information storage file including the dummy biometric information may be calculated, and data showing the highest match and having a degree of match of a certain value or more may be selected (if normal, the corresponding biometric information will be selected). Then, the seed key generation unit 20 generates seed key information based on the selected corresponding biometric information. Through such a series of processes, the personal authentication function is realized. If there is no corresponding biometric information that matches at a threshold value or more, the terminal device 200 or the output unit 130 of the password generation device 100 notifies the user that the personal authentication has not been successful.

[0051] Using the password setting value generated by the setting value generating unit 110 and the seed key information generated by the seed key generating unit 20, the password generating unit 40 generates a password required for using the service, and the password is input to the server 300 providing the service via the terminal device 200. Note that, if there is corresponding biometric information that matches the threshold or more, but the corresponding biometric information is not the corresponding biometric information that should be used, the required password will not be generated even if the generated seed key information is used. The corresponding access information and the ID may be linked, and the ID may be input to the server 300 via the terminal device 200 at the time the corresponding access information is selected. However, as another aspect (variation), not only the password but also the ID required for using the service may be generated by the password generating unit 40. In this case, the ID required for using the service is generated by the seed key information and the corresponding access information. If an ID other than a predetermined aspect such as an email address can be set, such an aspect (variation) can be used.

[0052] If biometric information is read before ID and password input is required, the password The password may be stored in storage unit 60 for a fixed period of time (e.g., 1 to 5 minutes). After the fixed period of time has elapsed, the password may be erased by erasing unit 90. The password may be output from password generation device 100 at the timing when information requesting password input is output from server 300. As another aspect, seed key information generated using biometric information may be output for a fixed period of time (e.g., 1 to 5 minutes), and the seed key information may not be output when the fixed period of time has elapsed.

[0053] In this embodiment, when accessing a network service, a password for accessing the service is generated every time based on a password setting value generated from corresponding access information and seed key information output from identity authentication unit 1 which realizes an identity authentication function, and the password is then used to log in to server 300. In this way, because the password is generated every time, the password itself is not stored, thereby improving security.

[0054] An example of an outline of the initialization procedure is as follows.

[0055] A software module for connecting to the password generation device 100 is installed in the terminal device 200 .

[0056] The password generation device 100 and the terminal device 200 are started up in a connected state.

[0057] The initialization mode is set by having the biometric information acquisition unit 10 read a dedicated item 190 such as an initialization pattern card. After that, a part of the body such as a finger to be used for personal authentication is read by the biometric information acquisition unit 10 to generate corresponding biometric information, and the corresponding biometric information is registered as one of the biometric information storage files.

[0058] The following is an example of an outline of a procedure for first service registration using the password setting device 100 according to this embodiment for a service for which a password has already been set.

[0059] After a dedicated item 190 such as a service registration start card is read by the biometric information acquisition unit 10, a part of the body such as a finger is read by the biometric information acquisition unit 10 to enter a service registration state.

[0060] Using terminal device 200, a user connects to a service for which an ID and password have already been registered, a login pop-up is displayed, and the user logs in using the pre-registered ID and password. The service information and the entered ID at this time are registered in password generation device 100 via a software module.

[0061] After switching to a password reset mode on the login screen of a service to be used using the terminal device 200, a part of a living body such as a finger is read by the biometric information acquisition unit 10, a new password is generated, and the generated password is input into a new password field on the displayed screen.

[0062] The dedicated item 190, such as a service registration start card, is read by the biometric information acquisition unit 10, and the registration mode is terminated.

[0063] An example of an outline of the service usage procedure is as follows.

[0064] With the terminal device 200 and the password generation device 100 connected, a login screen for a service to be used is displayed on the terminal device 200, and then a part of a biological body part, such as a finger, of the password generation device 100 is read by the biological information acquisition unit 10.

[0065] The ID (ID linked to the corresponding access information) stored in the password generation device 100 and the password reproduced by the password generation device 100 are automatically input to the server 300 via the terminal device 200 through the software module, and login for using the service is completed.

[0066] Each of the components including the feature data synthesizer 18, the feature extractor 15, the pattern comparator 26, the seed key generation unit 20, the access information acquisition unit 30, the password generation unit 40, the service selector 50, etc. in each of the above embodiments may be realized by a logic circuit (hardware) or a dedicated circuit formed in an integrated circuit such as an IC chip or an LSI, or may be realized by software using a CPU, a memory, etc. Also, two or more of the components including the feature data synthesizer 18, the feature extractor 15, the pattern comparator 26, the seed key generation unit 20, the access information acquisition unit 30, the password generation unit 40, the service selector 50, etc. may be realized by one control unit.

[0067] The description of each of the above-mentioned embodiments and the disclosure of the drawings are merely examples for explaining the invention described in the claims, and the invention described in the claims is not limited by the description of the above-mentioned embodiments or the disclosure of the drawings. [Explanation of symbols]

[0068] 1. Personal authentication section 10 Biometric information acquisition unit 15 Feature Extractor 18 Feature Data Synthesizer 20 Seed key generation section 25 Biometric information selection unit 26 Pattern Matcher 30 Access information acquisition unit 40 Password Generation Section 50 Service selector (access information selector) 100 Password Generator 190 Special Goods 200 Terminal Equipment 300 Servers

Claims

1. A biometric information acquisition unit that acquires biometric information of a user; a seed key generation unit that generates seed key information by using the biometric information acquired by the biometric information acquisition unit; an access information acquisition unit for acquiring access information; a password generation unit that generates a password using the seed key information and the access information; A password generating device comprising:

2. A storage unit that stores corresponding biometric information; a biometric information selection unit that selects corresponding biometric information corresponding to the biometric information acquired by the biometric information acquisition unit; Equipped with 2. The password generation device according to claim 1, wherein the seed key generation unit generates seed key information by using the corresponding biometric information selected by the biometric information selection unit.

3. The storage unit stores one or more pieces of dummy biometric information in addition to the corresponding biometric information, The password generation device according to claim 2 , wherein the biometric information selection unit selects the corresponding biometric information corresponding to the biometric information acquired by the biometric information acquisition unit from among the corresponding biometric information and dummy biometric information.

4. a storage unit for storing corresponding access information corresponding to the access information; an access information selection unit that selects corresponding access information; Equipped with 4. The password generation device according to claim 1, wherein the password generation unit generates a password using the selected corresponding access information.

5. a setting value generating unit that generates a password setting value using the selected corresponding access information; 5. The password generation device according to claim 4, wherein the password generation unit generates a password using the password setting value generated by the setting value generation unit and the seed key information generated by the seed key generation unit.

6. 4. The password generation device according to claim 1, wherein registration of biometric information or modification of biometric information is possible only when a dedicated item is used.

7. A storage unit that stores corresponding biometric information and corresponding access information; a biometric information selection unit that selects corresponding biometric information corresponding to the biometric information acquired by the biometric information acquisition unit; an access information selection unit that selects corresponding access information corresponding to the access information acquired by the access information acquisition unit; Equipped with 4. The password generation device according to claim 1, wherein the password generation unit generates a password using the corresponding biometric information selected by the biometric information selection unit and the corresponding access information selected by the access information selection unit.

Images