Communication system

Abstract

To execute authentication information exchange processing specialized in authentication before performing data communication between a portable terminal device not having authentication means and an external device having a function to be authentication means, and to allow performing the data communication only when identification is completed.SOLUTION: A communication system comprises face recognition means 103 that, in response to a connection request using first communication means from a portable terminal device 100 via a communication interface device 200, acquires an image for authentication picked up by using imaging means 302 of an external device, and performs face recognition on the basis of the acquired image and face recognition information held in the portable terminal device 100. When authentication performed by the face recognition means 103 is successful, the communication interface device 200 permits communication between the portable terminal device 100 and an information processing apparatus 300. The portable terminal device 100 starts communication with the information processing apparatus 300 by second communication means that is different from the first communication means and can perform communication directly with the information processing apparatus 300.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a communication system including a mobile terminal device, a communication interface device for communicating with the mobile terminal device, and an information processing device with which data and the like held by the mobile terminal device are exchanged via the communication interface device. [Background technology]

[0002] In recent years, wireless communication technologies such as wireless LAN and Bluetooth (registered trademark) have become widespread, and identity authentication to confirm that the operator of a terminal is a user authorized to access a network includes biometric authentication using fingerprints or veins, face authentication, etc. Technologies for implementing such authentication during communication include those disclosed in the following Patent Documents 1 and 2, for example. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 5429905 [Patent Document 2] Patent No. 5871068 Summary of the Invention [Problem to be solved by the invention]

[0004] The method of Patent Document 1 activates an appropriate authentication means from multiple authentication means using biometric information provided in the information processing device depending on the usage environment, and performs authentication processing using authentication information held by the information processing device and the authentication means provided in the information processing device, but the selection range of authentication means is limited to the authentication means provided in the information processing device.

[0005] In the method of Patent Document 2, an image including a user's face, obtained using the imaging function of a mobile terminal, is sent to a relay device via wireless communication to a time attendance management device, and an extraction unit of the time attendance management device extracts feature data and stores it in an attendance information storage unit, thereby performing a process equivalent to authentication. However, because the mobile terminal does not hold authentication information, it is not possible to restrict communications, operations, etc. of the mobile terminal by authenticating the operator of the mobile terminal.

[0006] Some mobile terminal devices do not have authentication means that use biometric information. Even if a mobile terminal device has the authentication information required for authentication, if the mobile terminal device does not have an inward-facing camera (in-camera) that can capture an image of the operator, it cannot perform face authentication as a means of biometric authentication.

[0007] When face authentication is to be performed on such a mobile terminal device, it is conceivable to connect to an external device having a camera via wireless communication and obtain a captured image.

[0008] On the other hand, when considering the security of a portable terminal device, it is ideal to be able to perform data communication via wireless communication only after confirming that the operator is the correct person and authenticating the operator.

[0009] An object of the present invention is to provide a control method and authentication system for a portable terminal device that performs an exchange process of authentication information specialized for authentication before data communication is performed between a portable terminal device that does not have an authentication means using biometric information and an external device that has a function as an authentication means, and allows data communication only when identity verification is complete. [Means for solving the problem]

[0010] In order to solve the above problems, the communication system according to the present invention comprises: A mobile terminal device; a communication interface device for communicating with the mobile terminal device; A communication system including an information processing device that transmits and receives data to and from the mobile terminal device via the communication interface device, a face authentication means for acquiring an authentication image captured by an imaging means of an external device in response to a connection request from the portable terminal device using a first communication means via the communication interface device, and performing face authentication based on the acquired image and face authentication information held by the portable terminal device; The communication interface device includes: permitting communication between the mobile terminal device and the information processing device when authentication by the face authentication means is successful; The mobile terminal device starts communication with the information processing device by a second communication means that is different from the first communication means and that can directly communicate with the information processing device. Effect of the Invention

[0011] According to the present invention, an exchange process of authentication information is carried out between a mobile terminal device and an external device, and communication is performed via a second communication means only when identity verification is completed, thereby enabling secure communication. [Brief description of the drawings]

[0012] [Figure 1] An example of a block diagram of a mobile terminal device, a communication interface device, and an information processing device according to the present invention. [Diagram 2] FIG. 11 is a sequence diagram showing an authentication operation according to the first embodiment of the present invention. [Diagram 3] Authentication sequence using video (moving image) in the third embodiment of the present invention [Figure 4] An example of a block diagram of a mobile terminal device and an information processing device incorporating the communication interface device of the present invention. [Diagram 5] An example of a block diagram of a mobile terminal device including a position acquisition unit of the present invention, a communication interface device, and an information processing device including a position acquisition unit. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Example 1 A first embodiment of the present invention will be described in detail below.

[0014] FIG. 1 is a block diagram showing a mobile terminal device 100, a communication interface device 200, and an information processing device 300 which constitute a communication system according to this embodiment.

[0015] The mobile terminal device 100 is a device equipped with a mobile terminal control unit 101, a face authentication information storage unit 102, a face authentication judgment unit 103, an encryption key storage unit 104, and a wireless communication unit 105. A barcode reader, a mobile phone (smartphone), a tablet terminal, a handheld terminal, etc. are examples of mobile terminal devices.

[0016] The mobile terminal control unit 101 corresponds to a motherboard that controls the operation of the mobile terminal device 100, and is made up of a power supply circuit for controlling the device, a CPU, a memory, a flash memory, and a peripheral IO control circuit.

[0017] The face authentication information storage unit 102 stores information for performing face authentication. Authentication processing for identity verification is performed by comparing this information with an image of the authentication target.

[0018] The form in which the facial authentication information is stored in the mobile terminal device 100 may be in an IC card such as a My Number card, or may be a secure device in which personal information is stored. Any device that includes an IC card and includes a facial authentication judgment unit 103 and a mobile terminal control unit 101 can be applied as the mobile terminal device 100 in this embodiment.

[0019] The face authentication judgment unit 103 compares the information for face authentication held in the face authentication information storage unit 102 with the image of the person to be authenticated, and determines that the person is the actual person if certain conditions are met, such as a matching rate above a certain threshold.

[0020] The encryption key storage unit 104 stores an encryption key that is used when the mobile terminal device 100 and the communication interface device 200 perform wireless communication.

[0021] The wireless communication unit 105 is an interface for communicating with the communication interface device 200, and in this embodiment, uses a communication method conforming to the standard IEEE 802.11ac, which is generally called wireless LAN. This wireless communication method may be other wireless communication methods such as short-distance wireless communication such as Bluetooth, a mobile communication system such as LTE, or LPWA.

[0022] The communication interface device 200 is a device that includes a communication interface control unit 201, an encryption key holding unit 202, a wireless communication unit 203, a wired LAN communication unit 204, and a connection destination information holding unit 205, and performs wireless communication with the mobile terminal device 100, and at the same time performs wired LAN communication with the information processing device 300, thereby relaying communication between the mobile terminal device 100 and the information processing device 300.

[0023] The communication interface control unit 201 is composed of a power supply circuit for controlling the operation of the communication interface device 200, a CPU, a memory, a flash memory, and a control circuit for peripheral IO.

[0024] The encryption key storage unit 202 stores an encryption key used when wireless communication between the mobile terminal device 100 and the communication interface device 200 is performed.

[0025] The wireless communication unit 203 is an interface for communicating with the mobile terminal device 100, and has a configuration similar to that of the wireless communication unit 105. However, it may have the same functions or different functions.

[0026] The wired LAN communication unit 204 is an interface for communicating with the information processing device 300, and in this embodiment, uses a communication method with a communication speed of 100 Mbps that conforms to the commonly used standard Fast Ethernet / IEEE 802.3u. This wired LAN communication method may use faster standards such as GbE (Gigabit Ethernet) / IEEE 802.3ab or 10GbE (10 Gigabit Ethernet) / IEEE 802.3ae.

[0027] The connection destination information storage unit 205 stores the IP address or the like of a device (an information processing device 300 described later as one example) having an imaging unit for capturing an image of an operator during face authentication, and identifies the connection destination.

[0028] The information processing device 300 is a device including an information processing device control unit 301, an imaging unit 302, and a wired LAN communication unit 303, and performs wired LAN communication with the communication interface device 200, transmits an image acquired by the imaging unit 302 for face authentication, and performs a standby operation for transmitting and receiving data as a connection destination server of the mobile terminal device 100. Note that this configuration is one example, and a device having a standby function as a connection destination server of the mobile terminal device 100 (for example, the information processing device control unit 301) and a device having the imaging unit 302 may be configured as separate devices. In that case, the IP addresses for connecting to each device are different for each device, but the information processing device control unit 301 may hold the IP address of the imaging unit 302, and the information processing device control unit 301 may acquire an image from the imaging unit 302 according to processing.

[0029] The information processing device control unit 301 corresponds to a motherboard that controls the operation of the information processing device 300, and is composed of a power supply circuit for controlling the device, a CPU, a memory, a flash memory, and a peripheral IO control circuit.

[0030] The imaging unit 302 is incorporated in the information processing device 300 and has a function of capturing an image for authenticating the person to be operated.

[0031] The wired LAN communication unit 303 is an interface for communicating with the communication interface device 200, and in this embodiment uses a communication method with a communication speed of 100 Mbps that conforms to the commonly used standard Fast Ethernet / IEEE802.3u. This wired LAN communication method may be another wired communication method in accordance with the wired LAN communication unit 204 of the communication partner. Note that the communication method between the wired LAN communication unit 303 and the wired LAN communication unit 204 is not limited to wired communication, and may be wireless communication.

[0032] The above is an explanation of the block diagram of the mobile terminal device 100, the communication interface device 200, and the information processing device 300 in the communication system according to the present embodiment.

[0033] The flow of authentication processing in this embodiment will be described with reference to the sequence diagram of FIG.

[0034] 2 shows that the mobile terminal device 100 starts communication with the communication interface device 200 using a first communication means to perform authentication processing, obtains an image for authentication using an imaging means of the information processing device 300, performs face authentication processing, and if authentication is successful, performs data communication with the information processing device 300 using a second communication means. Also shown is processing when authentication fails.

[0035] In the initial state of the communication interface device 200, the mobile terminal device 100 and the information processing device 300 are restricted from directly communicating with each other. A function generally called a firewall restricts communication through all ports, thereby preventing unauthorized access to the information processing device 300. If this sequence can authenticate that the person operating the mobile terminal device 100 is the person registered in the device, communication between the mobile terminal device 100 and the information processing device 300 becomes possible.

[0036] In step S1, the mobile terminal device 100 uses the encryption key held in the encryption key holding unit 104 to connect from the wireless communication function of the wireless communication unit 105 to the wireless communication unit 203 of the communication interface device 200. The first communication is a connection by the first communication means, and is performed for face authentication processing. An example of the first communication means can be a communication method conforming to the standard specification called IEEE802.11ac, which is generally called wireless LAN. Unlike the second communication means described later, the first communication means only needs to have an encrypted secure communication function and a procedure required for transmitting an image used in face authentication processing. For example, in the case of a minimum configuration, it may be realized by continuous communication of packets without using a protocol within an encrypted communication path. Or, an image may be treated as a file and transmitted using a general FTP protocol or the like for file transmission. Other open networks without authentication may be used.

[0037] In step S2, the mobile terminal device 100 sends to the communication interface device 200 an authentication image request for starting the authentication process.

[0038] In step S3, when the communication interface device 200 receives an authentication image request for starting authentication processing from the mobile terminal device 100, it acquires an authentication image. To acquire an authentication image, a device with an imaging device is required, and the communication interface device 200 acquires the address of the device with an imaging device from the connection destination information storage unit 205, which stores addresses of devices with imaging devices in advance. Here, it is assumed that the address of the information processing device 300 is set in advance as the connection destination information. An authentication image transmission request is sent to the address acquired from the connection destination information storage unit 205.

[0039] In step S4, when the information processing device 300 receives a request to transmit an authentication image from the communication interface device 200, the information processing device 300 uses the imaging unit 302 included in the information processing device 300 to capture an image for authentication.

[0040] In step S5, the image captured in step S4 is sent from the information processing device 300 to the communication interface device 200. There may be multiple images.

[0041] In step S6, the image obtained in step S5 is sent from the communication interface unit 200 to the mobile terminal unit 100.

[0042] In step S7, in order to perform authentication processing using the authentication image obtained in step S6, the facial authentication information stored in the facial authentication information storage unit 102 included in the mobile terminal device 100 is used to check the matching rate between the facial authentication information and the authentication image in the facial authentication judgment unit 103, and if a predetermined condition is met, such as a certain threshold or more, it is determined that the person is the person in question, authentication is successful, and the process proceeds to step S10. If the predetermined condition is not met, authentication is unsuccessful, and the process proceeds to step S20.

[0043] In step S10, the mobile terminal device 100 transmits to the communication interface device 200 a notification of successful authentication, which indicates that the authentication process in step S7 has been successful.

[0044] In step S11, the communication interface device 200 receives a notification of successful authentication and performs a process of permitting a connection using the second communication means. Specifically, when a VPN (Virtual Private Network) connection is adopted as the second communication means to perform communication, communication using UDP port 1194 and TCP port 443 is permitted. These port numbers can be changed depending on the communication method of the VPN used. For example, a variation is possible in which TCP port 1723 is permitted for PPTP, and UDP port 500 and UDP port 4500 are permitted for IPSec. These port numbers are changed depending on the communication method adopted. The connection permission process in step S11 enables direct communication between the mobile terminal device 100 and the information processing device 300 using the second communication means. Note that the second communication means may be other than a VPN connection. A means capable of secure communication may be appropriately selected at any layer of the communication function in the OSI reference model according to the environment in which the second communication means is implemented. For example, it may be realized using TLS or SSH, or may be another private network connection. The second communication means may be the same physical communication interface as the first communication means.

[0045] In step S12, in order to perform the desired data communication, the mobile terminal device 100 starts a connection to the information processing device 300 by the second communication means. That is, the mobile terminal device 100 obtains the address of the information processing device 300 by the connection destination information stored in the connection destination information storage unit 205 of the communication interface device 200, and makes a connection request.

[0046] In step S13, the information processing device 300 that has received the connection request sends back a connection completion response to the mobile terminal device 100, and the connection is completed.

[0047] In step S14, upon receiving the connection completion notification in step S13, data communication is performed between the mobile terminal device 100 and the information processing device 300. Through these procedures, even if the mobile terminal device 100 does not have an imaging device required for face authentication, the image capturing unit 302 of the connected information processing device 300 is used to acquire an image for authentication, and the mobile terminal device 100 executes face authentication processing, thereby ensuring that the operator is the real person, and data communication between the mobile terminal device 100 and the information processing device 300 can be performed safely in a trusted state.

[0048] Step S20 is a sequence for when the authentication process fails in step S7. If the face authentication process fails in step S7, the mobile terminal device 100 notifies the communication interface device 200 that the authentication has failed.

[0049] In step S21, if the communication interface device 200 receives a notification of authentication failure, the connection via the second communication means is not permitted.

[0050] In step S22, the mobile terminal device 100 attempts to connect to the information processing device 300, but since connection via the second communication means is not permitted in step S21, the connection process fails.

[0051] The authentication process is executed according to the operation sequence described above. In the operation sequence described with reference to FIG. 2, an authentication request is made from the mobile terminal device 100 in step S2, and if the authentication process is successful in step S7, a connection request to the information processing device 300 is made after receiving connection permission in step S11, but this is not limited to the above. For example, when transmitting the authentication request in step S2, face authentication information and a connection request to the information processing device 300 may be transmitted at the same time, and the authentication process may be executed on the communication interface device 200 side. In this case, if the authentication process is successful, the communication interface device 200 may transfer the connection request received from the mobile terminal device 100 in step S2 to the information processing device 300 as is, and steps after step S13 may be executed.

[0052] Example 2 In the first embodiment, in the case of a configuration having the imaging unit 302 as an external device separate from the devices constituting the information processing device 300, the imaging means can have a plurality of configurations without limiting the form of connection. For example, it may be a camera wirelessly connected to the mobile terminal device 100, or a network camera such as a surveillance camera connected to the communication interface device 200 or the information processing device 300 through a network. This allows for flexible arrangement.

[0053] Example 3 In the first embodiment, the authentication image that the mobile terminal device 100 acquires from the information processing device 300 via the communication interface device 200 may be a video (moving image). This is expected to improve the recognition rate of personal authentication. The sequence when a video (moving image) is used as the authentication image is shown in FIG.

[0054] 3, the process starts with a sequence continuing from step 1 in the embodiment 1. The information processing device 300 includes an imaging unit 302 capable of capturing moving images, and the moving images may be continuously captured in advance.

[0055] In step S2-1, the authentication process is started and a video request for authentication is made.

[0056] In step S2-2, a request for authentication video transmission is made to the information processing device 300 via the communication interface device 200.

[0057] In step S2-3, the information processing device 300 transmits a video streaming for authentication.

[0058] In step S2-4, the authentication video arrives at the mobile terminal device 100. At this time, the communication interface device 200 is only relaying the transmission of the video (moving image), and the video (moving image) can be sent to the mobile terminal device 100 one after another by streaming.

[0059] In step 2-5, the mobile terminal device 100 performs authentication processing using the video (moving image) that has arrived at the mobile terminal device 100.

[0060] The video (moving image) used in this authentication process does not have to be a moving image from the start of the authentication request, but it is invalid if a certain amount of time has passed.

[0061] For example, authentication can be performed using images captured by a network camera installed in the entrance hall up to one minute before the person entered the building. This makes it possible to smoothly carry out identity confirmation through authentication processing.

[0062] The amount of time allowed is influenced by the equipment, environment, and building in which the actual authentication is performed, and can be varied by changing the settings.

[0063] This is a communication system characterized in that if the authentication is successful, the process proceeds to step S10 of the first embodiment, and if the authentication is unsuccessful, the process returns to step S20 of the first embodiment.

[0064] Example 4 In the first embodiment, the mobile terminal device 100 may be a terminal with a built-in camera that is an imaging means. Even in this case, the present invention is a communication system that uses imaging means (for example, the imaging unit 302) other than the camera included in the mobile terminal device 100, performs face authentication in the face authentication determination unit 103 included in the mobile terminal device 100 using information stored in the face authentication information storage unit 102 included in the mobile terminal device 100 itself and an image captured using an imaging means included in a device other than the mobile terminal device 100, and permits communication via a second communication means if authentication is successful.

[0065] Example 5 In the first embodiment, the communication interface device 200 has a role of relaying between the mobile terminal device 100 and the information processing device 300, a role of holding destination information of the information processing device 300 held in the destination information holding unit 205, and a role of permitting communication when authentication is successful and not permitting communication when authentication is unsuccessful by the communication interface control unit 201. These functions can be included in the same housing as the mobile terminal device 100, and this embodiment corresponds to the case where the communication interface device 200 is included in the mobile terminal device 100, and a block diagram thereof is shown in FIG.

[0066] The mobile terminal device 100 includes a communication interface device 200, and since the communication unit 105-1 of the mobile terminal device 100 and the communication unit 203-1 of the communication interface device 200 are inside the terminal, they communicate directly with each other.

[0067] Moreover, instead of the wired LAN communication unit 204 of the communication interface device 200, a wireless / wired LAN communication unit 204-1 is provided, and communication with the information processing device 300 can be performed either wirelessly or wired. The same is true for the information processing device 300, and instead of the wired LAN communication unit 303 of the information processing device 300, a wireless / wired LAN communication unit 303-1 is provided.

[0068] According to the configuration shown in FIG. 4, the present invention provides a communication system that can be configured with only the mobile terminal device 100 and the information processing device 300.

[0069] Example 6 In the first embodiment, the location information can be used as a means for improving the reliability of the authentication process.

[0070] FIG. 5 shows a configuration including a mobile terminal device 100 equipped with a position information acquisition unit 106 (mobile terminal position information acquisition means) which is a means for identifying the location where the person is operating the device, and an information processing device 300 equipped with a position information acquisition unit 304 (imaging unit position information acquisition means) which is a means for identifying the location where an imaging unit 302 for photographing the person is installed.

[0071] 5, in the authentication process of step S7 in the sequence diagram shown in Fig. 2, the face authentication process by the face authentication judgment unit 103 is validated when the position acquired by the position information acquisition unit 106 and the position acquired by the position information acquisition unit 304 are within a certain range. With this configuration, it is possible to guarantee that the identity verification was performed at the location where the image was taken, and it is possible to provide a communication system characterized by performing authentication process with higher reliability. [Explanation of symbols]

[0072] 100 Portable terminal device 101 Mobile terminal control unit 102 Face authentication information storage unit 103 Face Recognition Judgment Unit 104 Encryption key holding unit 105 Wireless Communication Division 105-1 Communications Department 106 Location information acquisition unit 200 Communication interface device 201 Communication interface control section 202 Encryption key holding unit 203 Wireless Communication Department 203-1 Communications Department 204 Wired LAN communication section 204-1 Wireless / wired LAN communication section 205 Connection destination information storage unit 300 Information processing device 301 Information processing device control unit 302 Imaging unit 303 Wired LAN Communication Section 303-1 Wireless / wired LAN communication section 304 Location information acquisition unit

Claims

1. A mobile terminal device; a communication interface device for communicating with the mobile terminal device; A communication system including an information processing device that transmits and receives data to and from the mobile terminal device via the communication interface device, a face authentication means for acquiring an authentication image captured by an imaging means of an external device in response to a connection request from the portable terminal device using a first communication means via the communication interface device, and performing face authentication based on the acquired image and face authentication information held by the portable terminal device; The communication interface device includes: permitting communication between the mobile terminal device and the information processing device when authentication by the face authentication means is successful; A communication system, characterized in that the mobile terminal device initiates communication with the information processing device by a second communication means different from the first communication means and capable of directly communicating with the information processing device.

2. the first communication means and the second communication means are the same physical communication interface; the face authentication means performs the face authentication when authentication using an encryption key between the mobile terminal device and the communication interface device is completed by the first communication means, The communication system according to claim 1, characterized in that, when the facial authentication is successful, the mobile terminal device communicates using a VPN connection that uses the same communication interface as the first communication means as the second communication means.

3. the first communication means is communication using an open network that does not use authentication, 2. The communication system according to claim 1, wherein said second communication means is a private network for communication between said portable terminal device and said communication interface device.

4. 2. The communication system according to claim 1, wherein the imaging means of the external device is a network camera connected to the communication interface device and the information processing device via a network.

5. The communication system according to claim 1, characterized in that the authentication image that the portable terminal device acquires from the information processing device via the communication interface device is a moving image, and authentication processing is performed by the face authentication means using the streamed moving image.

6. the mobile terminal device includes a face authentication information storage means for storing the face authentication information and the face authentication means; If the face authentication is successful, an authentication success notification is sent to the communication interface device; 2. The communication system according to claim 1, wherein the communication interface device permits communication via the second communication means based on the notification of successful authentication.

7. 2. The communication system according to claim 1, wherein the communication interface device is housed in the same housing as the mobile terminal device.

8. a mobile terminal location information acquisition means for acquiring location information of the mobile terminal device; an imaging unit position information acquisition means for acquiring position information of the imaging means; Equipped with The communication system according to claim 1, characterized in that authentication processing by the face authentication means is enabled when the location information acquired by the mobile terminal location information acquisition means and the location information acquired by the imaging unit location information acquisition means are within a certain range.

Images