Portable electronic device, biometric authentication execution timing control method, and computer-readable storage medium

Abstract

To provide a portable electronic device capable of setting execution timing of fingerprint authentication processing.SOLUTION: A portable electronic device according to an embodiment comprises a memory, a biological sensor, a communication interface, and a processor. The memory stores setting information for setting an execution timing of a biometric authentication process. The biological sensor detects biological information. The communication interface receives a command. The processor determines an execution timing of a biometric authentication process based on the setting information, and executes the biometric authentication process based on the biometric information detected by the biometric sensor and a command process based on the command received by the communication interface according to the execution timing indicated by a determination result.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] FIELD Embodiments of the present invention relate to a portable electronic device, a method for controlling timing of biometric authentication execution, and a computer-readable storage medium. [Background technology]

[0002] Security devices such as IC cards equipped with IC (Integrated Circuit) chips have become widespread and are used as credit cards and IC passports. IC cards are also called portable electronic devices because they are carried by users.

[0003] For many years, PINs (Personal Identification Numbers) have been used to prevent fraudulent use of IC cards, but fingerprint authentication, which is more secure, is now being used. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2006-215699 [Patent Document 2] Japanese Patent Application Laid-Open No. 2007-157002 [Patent Document 3] International Publication No. 2007 / 066480 Summary of the Invention [Problem to be solved by the invention]

[0005] There are two types of IC cards: Native cards and Java cards. In the case of Native cards, fingerprint authentication processing is implemented in a specific command. In the case of Java cards, fingerprint authentication processing is called from the applet side. In IC cards, it is not possible to arbitrarily set the execution timing of fingerprint authentication processing, and improvements are being requested.

[0006] In order to solve the above-mentioned problems, the present invention provides a portable electronic device capable of setting the execution timing of fingerprint authentication processing, a biometric authentication execution timing control method, and a computer-readable storage medium. [Means for solving the problem]

[0007] A portable electronic device according to an embodiment includes a memory, a biometric sensor, a communication interface, and a processor. The memory stores configuration information for setting the execution timing of a biometric authentication process. The biometric sensor detects biometric information. The communication interface receives a command. The processor determines the execution timing of the biometric authentication process based on the configuration information, and executes the biometric authentication process based on the biometric information detected by the biometric sensor and command processing based on the command received by the communication interface according to the execution timing indicated by the determination result. [Brief explanation of the drawings]

[0008] [Figure 1] FIG. 1 is a block diagram showing an example of the configuration of an IC card as a portable electronic device according to an embodiment. [Figure 2] FIG. 2 is a diagram showing an example of setting information stored in a data memory of an IC card as a portable electronic device according to the embodiment. [Figure 3] FIG. 3 is a diagram showing an example of authentication information stored in the RAM of an IC card as a portable electronic device according to the embodiment. [Figure 4] FIG. 4 is a flowchart showing a first example of biometric authentication processing using an IC card according to the embodiment. [Figure 5] FIG. 5 is a sequence diagram including a biometric authentication process executed before a command process (before a collision prevention process) according to the embodiment. [Figure 6] FIG. 6 is a flowchart showing a second example of biometric authentication processing using an IC card according to the embodiment. [Figure 7]FIG. 7 is a sequence diagram including a biometric authentication process executed before a command process (before a select process) according to the embodiment. [Figure 8] FIG. 8 is a sequence diagram including a biometric authentication process executed before a command process (before a setting change process) according to the embodiment. [Figure 9] FIG. 9 is a flowchart showing a third example of the biometric authentication process using the IC card according to the embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0009] Hereinafter, an embodiment will be described with reference to the drawings. First, the configuration of an IC card 1 as a portable electronic device according to the embodiment will be described. FIG. 1 is a block diagram showing an example of the configuration of an IC card as a portable electronic device according to an embodiment. The IC card 1 is an example of a portable electronic device that is activated (made operable) by power supplied from an external device. The IC card 1 executes processing in response to commands from a higher-level device. In this embodiment, the IC card 1 as a portable electronic device has a function of performing authentication using biometric information. For example, the IC card 1 is also called a smart card. The IC card 1 may also be implemented by replacing it with one of the functions provided in a mobile terminal such as a smartphone, which is another example of a portable electronic device.

[0010] An IC card 1 as a portable electronic device according to an embodiment has a biometric authentication function that authenticates a person by biometric matching using biometric information acquired from the person. In the embodiment, the IC card 1 is described as having a biometric (fingerprint) authentication function that authenticates a person by fingerprint matching using a fingerprint as an example of biometric information. However, the biometric authentication function of the IC card 1 as a portable electronic device according to an embodiment is not limited to biometric matching using a fingerprint. For example, the portable electronic device exemplified by the IC card 1 may perform biometric authentication using biometric information other than a fingerprint.

[0011] In the exemplary configuration shown in FIG. 1, the IC card 1 has a main body C. The main body C is formed into a card shape using, for example, plastic. The IC card 1 includes a module M as a control unit 11, a biometric matching unit 12, an LED 13, and the like within the main body C. For example, the module M is integrally formed with one or more IC chips connected to a communication interface. The module M as the control unit 11 is provided in the main body C while connected to the biometric matching unit 12, which has a processor 31 and a biometric sensor 32, and the LED 13.

[0012] In the configuration example shown in FIG. 1, a module M constituting the control unit 11 includes a processor 21, a ROM 22, a RAM 23, a data memory 24, and a communication interface 25.

[0013] The processor 21 includes circuits that execute various processes. The processor 21 is, for example, a CPU (Central Processing Unit). The processor 21 controls the entire IC card 1. The processor 21 realizes various processing functions by executing programs stored in the ROM 22 or the data memory 24. For example, the processor 21 is one of the entities that execute a biometric authentication execution timing control method that determines and controls the execution timing of biometric authentication processing. However, some or all of the various functions executed by the processor 21, which will be described later, may be realized by a hardware circuit.

[0014] The ROM 22 is a non-volatile memory that functions as a program memory. Control programs, control data, etc. are stored in the ROM 22 in advance. The ROM 22 is incorporated into the IC card 1 during the manufacturing stage with the control programs, control data, etc. stored therein. The control programs and control data stored in the ROM 22 are incorporated in advance according to the specifications of the IC card 1. For example, the ROM 22 stores a program that causes the processor 21 to execute processing in response to commands received from an external device (card reader / writer).

[0015] The RAM 23 is a volatile memory that functions as a working memory. The RAM 23 also functions as a buffer that temporarily stores data being processed by the processor 21. For example, the RAM 23 functions as a communication buffer that temporarily stores data to be transmitted and received between the processor 21 and an external device via the communication interface 25.

[0016] The data memory 24 is a non-volatile memory to which data can be written and rewritten. The data memory 24 is configured, for example, with an EEPROM (registered trademark) (Electrically Erasable Programmable Read Only Memory). Programs and various data according to the operational use of the IC card 1 are written to the data memory 24. Program files or data files are defined in the data memory 24, and control programs and various data are written to these files. In addition, some or all of the areas of the data memory 24 are tamper-resistant, allowing data to be stored securely.

[0017] The data memory 24 includes a first memory that stores biometric information (authentication data) of a legitimate user (registered person) and a second memory that stores password registration data for password verification.

[0018] For example, the data memory 24 serving as the first memory stores biometric information (biometric registration data) of the registrant as data for performing biometric authentication. When the IC card 1 performs biometric authentication using a fingerprint, the data memory 24 stores fingerprint data of the registrant (fingerprint registration data). The fingerprint data of the registrant is a fingerprint image or fingerprint feature data for comparison with fingerprint information acquired by a fingerprint sensor serving as the biometric sensor 32. Furthermore, fingerprint data for multiple fingers of one registrant may be registered in the data memory 24. Furthermore, when one IC card 1 is used by multiple users, fingerprint data of multiple registrants who are legitimate users may be registered in the data memory 24.

[0019] The communication interface 25 includes a communication control unit and an interface unit. The communication interface 25 is an interface for communicating with a host device that supplies power and commands to the IC card 1. The communication interface 25 realizes a communication function using a communication method corresponding to the interface of a card reader / writer connected to the host device. The communication interface 25 supports multiple communication methods.

[0020] The communication interface 25 includes a contact communication interface 251 that communicates with an external device through contact therewith. The contact communication interface 251 includes a contact portion that makes physical and electrical contact with a reader / writer contact portion provided in the card reader / writer, and a communication control circuit that controls the transmission and reception of signals via this contact portion.

[0021] The communication interface 25 includes a contactless communication interface 252 that communicates with a card reader / writer in a contactless (wireless) manner. The contactless communication interface 252 includes an antenna that transmits and receives radio waves, a modulation circuit for generating radio waves to be transmitted from the antenna, and a demodulation circuit for generating a signal from the radio waves received by the antenna.

[0022] When the IC card 1 is realized as a contact-type IC card, the contactless communication interface 252 may not be an essential component. Also, when the IC card 1 is realized as a contactless IC card, the contact communication interface 251 may not be necessary.

[0023] The biometric matching unit 12 has a processor 31 and a biometric sensor 32, and is connected to a module M serving as the control unit 11. The biometric matching unit 12 also has a memory that stores an authentication program and the like that the processor 31 uses to perform biometric authentication by biometric (fingerprint) matching.

[0024] The biometric sensor 32 detects biometric information. In this embodiment, the biometric sensor 32 is a fingerprint sensor that reads the user's fingerprint information (fingerprint image). The fingerprint sensor serving as the biometric sensor 32 is provided so that the sensor that reads the fingerprint is exposed on the surface of the main body C of the IC card 1, and reads the fingerprint of a person's finger that is held over the exposed sensor portion. Note that the biometric sensor 32 is not limited to a fingerprint sensor, and may be one that obtains biometric information other than a fingerprint.

[0025] The processor 31 executes a biometric authentication program to perform biometric authentication using fingerprint information as biometric information acquired by the biometric sensor 32. For example, the processor 31 extracts a fingerprint image from an image read by a fingerprint sensor serving as the biometric sensor 32, and performs fingerprint authentication by comparing the fingerprint image extracted from the image read by the fingerprint sensor with the fingerprint image (or fingerprint feature data) of the registrant registered in the data memory 24.

[0026] 1, the processor 31 provided separately from the processor 21 is configured to perform biometric authentication by biometric (fingerprint) matching, but the processor 21 may also perform the biometric authentication. When the processor 21 is made to perform the biometric authentication, biometric information read by the biometric sensor 32 may be supplied to the processor 21. For example, the processor 21 may extract fingerprint information from an image supplied from a fingerprint sensor serving as the biometric sensor 32, and compare the extracted fingerprint information with the fingerprint information of the registrant registered in the data memory 24.

[0027] The LED 13 has a light-emitting element. The light-emitting state of the LED 13 is controlled by the control unit 11. The LED 13 is provided on the main body C in a state where the lit state can be seen on the surface of the main body C, for example.

[0028] FIG. 2 is a diagram showing an example of setting information stored in a data memory of an IC card as a portable electronic device according to the embodiment. The data memory 24 stores setting information for setting the execution timing of the biometric authentication process. The setting information includes, for each communication condition, the execution timing of the authentication process, whether it can be set, whether the setting information can be changed, and the operation to be performed when authentication fails.

[0029] The communication conditions include first and second communication conditions, where the first communication condition is to communicate with an external device via a contact communication interface 251, and the second communication condition is to communicate with an external device via a non-contact communication interface 252.

[0030] The execution timing of the biometric authentication process may be "during processing of the first command," "before executing the first command," "during processing of a specified command," or "before executing a specified command."

[0031] "During processing of the first command" is information that causes biometric authentication processing to be executed while the first command received by the IC card 1 is being processed from the start to the end of communication with the card reader / writer. For example, "during processing of the first command" is information that divides the processing of the first command into a first half and a second half, and causes biometric authentication processing to be executed in the middle of the first half. "Before executing the first command" is information that causes biometric authentication processing to be executed before the first command received is executed.

[0032] "During processing of a specified command" is information that causes biometric authentication processing to be executed while the specified command is being processed. For example, "during processing of a specified command" is information that divides the processing of a specified command into a first half and a second half and executes biometric authentication processing in the middle of the first half. "Before executing a specified command" is information that causes biometric authentication processing to be executed before the specified command is executed. For example, if the specified command is a collision prevention processing command, "before executing a specified command" is information that causes biometric authentication processing to be executed before the collision prevention processing command is executed.

[0033] The data memory 24 stores the life cycle of the IC card 1. The life cycle is "manufacturing," "issuance," or "operation."

[0034] If the setting possibility at the time of manufacture indicates "possible", the execution timing of the authentication process can be set at the time of manufacture of the IC card 1. If the setting possibility at the time of manufacture indicates "not possible", the execution timing of the authentication process cannot be set at the time of manufacture of the IC card 1.

[0035] If the setting possibility is indicated as "possible" when issued, the execution timing of the authentication process can be set when the IC card 1 is issued. If the setting possibility is indicated as "not possible" when issued, the execution timing of the authentication process cannot be set when the IC card 1 is issued.

[0036] If the setting availability during operation indicates "possible", the execution timing of the authentication process can be set during operation of the IC card 1. If the setting availability during operation indicates "not possible", the execution timing of the authentication process cannot be set during operation of the IC card 1.

[0037] If the changeability of the setting information indicates "possible", the settings of the setting information can be changed. If the changeability of the setting information indicates "not possible", the settings of the setting information cannot be changed.

[0038] If the action to be taken when authentication fails indicates "transition to next process," the result of the authentication failure is saved in the data memory 24, and the process proceeds to the next process. If the action to be taken when authentication fails indicates "maintain state," the state is maintained until biometric authentication is successful.

[0039] FIG. 3 is a diagram showing an example of authentication information stored in the RAM of an IC card as a portable electronic device according to the embodiment. The authentication information includes authentication results for each communication condition, such as "not performed," "success," or "failure."

[0040] Next, the operation of the IC card 1 according to this embodiment will be described. The IC card 1 according to the embodiment has a function of operating in accordance with an existing communication protocol used for IC cards standardized by international standards, etc. The IC card 1 also has a biometric authentication function using biometric information acquired by a biometric sensor 32, and an authentication function based on password matching. The IC card 1 stores (holds) at least one password data item used for password matching. In the embodiment, the operation using biometric authentication by the IC card 1 will be described, but authentication based on password matching may also be used, or authentication based on password matching may be applied instead of biometric authentication.

[0041] 4 is a flowchart showing a first example of biometric authentication processing by the IC card according to the embodiment. The first example is a case where the second communication condition for communicating with an external device via the contactless communication interface 252 is satisfied. When the IC card 1 enters the magnetic field of the card reader / writer, the contactless communication interface 252 of the IC card 1 receives radio waves (ST121, YES) and supplies power (ST122). If the IC card 1 does not enter the magnetic field of the card reader / writer, the contactless communication interface 252 of the IC card 1 does not receive radio waves (ST121, NO) and remains in standby mode.

[0042] For example, a card reader / writer, which is an external device, repeatedly transmits an anti-collision processing command at a fixed interval and waits for an anti-collision processing response transmitted from the IC card 1. The contactless communication interface 252 of the IC card 1 receives the anti-collision processing command repeatedly transmitted from the external device.

[0043] In response to receiving the collision prevention processing command, the processor 21 of the IC card 1 starts the program in the data memory 24, determines the execution timing of the biometric authentication processing based on the setting information of the data memory 24 (ST123), and controls the execution timing of the biometric authentication processing. That is, the processors 21 and 31 control the execution timing of the biometric authentication processing based on the biometric information detected by the biometric sensor 32 and the command processing based on the command received by the communication interface 25 in accordance with the execution timing indicated by the determination result, and execute the biometric authentication processing and the command processing at that timing.

[0044] If the execution timing of the biometric authentication process included in the setting information of the data memory 24 indicates "stop operation" (ST124, YES), the processor 21 does not output an execution command for the biometric authentication process, stops the biometric authentication process operation, and executes the collision prevention process based on the collision prevention process command transmitted from the external device (ST131). In this case, the non-contact communication interface 252 transmits a collision prevention process response to the external device that transmitted the collision prevention process command.

[0045] If the execution timing of the biometric authentication process included in the setting information of the data memory 24 does not indicate "stop operation" (ST124, NO) but indicates "before executing a command" (ST125, YES), the processor 21 outputs an instruction to execute the biometric authentication process before executing the command based on the setting information, does not stop the biometric authentication process operation (ST124, NO), and the processor 31 executes the biometric authentication process before executing the command (ST126).

[0046] For example, if the execution timing of the biometric authentication process included in the setting information of the data memory 24 indicates "before the execution of the collision prevention processing command," the processor 21 outputs an execution command of the biometric authentication process before the execution of the collision prevention processing command based on the setting information. Before the execution of the collision prevention processing command, the processor 31 compares the fingerprint information detected by the biometric sensor 32 with the fingerprint image or fingerprint feature data registered in the data memory 24, and determines that the comparison is successful if the comparison result satisfies a criterion (ST127, YES), and determines that the comparison is unsuccessful if the criterion is not satisfied (ST127, NO). Note that in the IC card 1, the roles of the processors 21 and 31 may be performed by a single processor.

[0047] If the matching is successful, the processor 21 executes the collision prevention processing based on the collision prevention processing command sent from the external device (ST131), and the non-contact communication interface 252 sends a collision prevention processing response to the external device that sent the collision prevention processing command.

[0048] If the matching fails and the action to be taken when authentication fails in the biometric authentication process contained in the setting information of the data memory 24 indicates "maintain the state" (ST128, YES), the processor 21 outputs a command to execute the biometric authentication process based on the setting information, and the processor 31 executes the biometric authentication process (ST126).

[0049] If the matching fails and the action to be taken when the biometric authentication process fails, which is included in the setting information of the data memory 24, indicates "transition to the next process" (ST128, NO), the processor 21 stores the authentication failure in the RAM 23 (ST129), executes the next process, which is the collision prevention process (ST112), and the non-contact communication interface 252 transmits a collision prevention process response to the external device that transmitted the collision prevention process command.

[0050] FIG. 5 is a sequence diagram including a biometric authentication process executed before a command process (before a collision prevention process) according to the embodiment. As shown in FIG. 5, the card reader / writer repeatedly transmits an anti-collision processing command at regular intervals (ST111).

[0051] When the IC card 1 enters the magnetic field of the card reader / writer, the contactless communication interface 252 of the IC card 1 receives a collision prevention processing command repeatedly transmitted from the external device. In response to receiving the collision prevention processing command, the processor 21 of the IC card 1 starts the program in the data memory 24, determines the execution timing of the biometric authentication processing based on the setting information in the data memory 24 (ST123), and controls the execution timing of the biometric authentication processing.

[0052] That is, the processors 21 and 31 execute biometric authentication processing at predetermined timing based on the setting information in the data memory 24 (ST124 to ST129), execute command processing based on a command at predetermined timing (ST112), and the non-contact communication interface 252 sends a collision prevention processing response to the external device that sent the collision prevention processing command (ST112a).

[0053] For example, if the execution timing of the biometric authentication process included in the setting information of the data memory 24 indicates "before the execution of the collision prevention process command," the processor 21 outputs an execution command for the biometric authentication process before the execution of the collision prevention process command based on the setting information, and the processor 31 executes the biometric authentication process. After the execution of the biometric authentication process, the processor 21 executes the collision prevention process.

[0054] Furthermore, if the action to be taken when authentication fails in the biometric authentication process included in the setting information of the data memory 24 indicates "maintain the state," the processor 21 outputs a command to execute the biometric authentication process based on the setting information until the biometric authentication is successful, and the processor 31 executes the biometric authentication process.

[0055] 6 is a flowchart showing a second example of biometric authentication processing by the IC card according to the embodiment. The second example is a case where the first communication condition for communicating with an external device via the contact communication interface 251 is satisfied. When the contact portion of the contact communication interface 251 of the IC card 1 comes into physical and electrical contact with the reader / writer contact portion provided in the card reader / writer, which is an external device, the contact portion of the contact communication interface 251 receives power from the reader / writer contact portion and supplies power to each portion of the IC card 1.

[0056] Processor 21 receives power supply from the contact portion of contact communication interface 251 and executes ATR (Answer To Reset) output processing (ST211), and contact communication interface 251 outputs ATR as an initial response to the external device.

[0057] The external device receives the ATR from the IC card 1 and outputs a predetermined command to the IC card 1. For example, the external device outputs a select command or a setting change command to the IC card 1.

[0058] The contact communication interface 251 of the IC card 1 receives a select command or a setting change command from an external device, and the processor 21 executes a command reception process (ST222) and determines the timing to execute the biometric authentication process based on the setting information in the data memory 24 (ST231). The processor 21 identifies the contact communication interface because the select command or the setting change command has been received by the contact communication interface 251. The processor 21 determines the timing to execute the biometric authentication process based on the first communication condition included in the setting information in the data memory 24.

[0059] If the execution timing of the biometric authentication process included in the setting information of the data memory 24 indicates "stop operation" (ST232, YES), the processor 21 does not output an execution command for the biometric authentication process, stops the biometric authentication process operation, executes command processing (select processing or setting change processing) based on the command (select command or setting change command) sent from the external device (ST223), executes response processing (ST224), and the contact communication interface 251 sends a response to the external device that sent the select command or setting change command.

[0060] If the execution timing of the biometric authentication process included in the setting information of the data memory 24 does not indicate "stop of operation" (ST232, NO) but indicates "before execution of a command" (ST233, YES), the processor 21 outputs an instruction to execute the biometric authentication process before execution of the command based on the setting information, and the processor 31 executes the biometric authentication process before execution of the command (ST234).

[0061] For example, if the execution timing of the biometric authentication process included in the setting information of data memory 24 indicates "before execution of a select command" or "before execution of a setting change command," processor 21 outputs an execution command for the biometric authentication process before execution of the select command or the setting change command based on the setting information. Before execution of the select command or the setting change command, processor 31 compares the fingerprint information detected by biometric sensor 32 with the fingerprint image or fingerprint feature data registered in data memory 24, and determines that the comparison is successful if the comparison result meets a criterion (ST235, YES), or determines that the comparison is unsuccessful if the criterion is not met (ST235, NO). Note that in IC card 1, the roles of processors 21 and 31 may be performed by a single processor.

[0062] If the match is successful, the processor 21 executes a select process or a setting change process based on the select command or the setting change command sent from the external device (ST223), executes a response process (ST224), and the contact communication interface 251 sends a select process response or a setting change response to the external device that sent the select command or the setting change command.

[0063] If the matching fails and the action to be taken when authentication fails in the biometric authentication process contained in the setting information of the data memory 24 indicates "maintain the state" (ST236, YES), the processor 21 outputs a command to execute the biometric authentication process based on the setting information, and the processor 31 executes the biometric authentication process (ST234).

[0064] If the matching fails and the action to be taken when the biometric authentication process fails, which is included in the setting information of the data memory 24, indicates "transition to the next process" (ST236, NO), the processor 21 stores the authentication failure in the RAM 323 (ST237), executes the next process, which is the select process or the setting change process (ST223), executes the response process (ST224), and the contact communication interface 251 transmits a select process response or a setting change process response to the external device that transmitted the select command or the setting change command.

[0065] If there is a subsequent command process (ST225, NO), processor 21 executes a command reception process (ST226) and executes the command process (ST223). If there is no subsequent command process (ST225, YES), all processes end.

[0066] FIG. 7 is a sequence diagram including a biometric authentication process executed before a command process (before a select process) according to the embodiment. As shown in FIG. 7, the processor 21 of the IC card 1 receives power supply from the contact portion of the contact communication interface 251 and executes the ATR output process (ST211), and the contact communication interface 251 outputs the ATR as an initial response to the external device (ST211a).

[0067] The external device receives the ATR from the IC card 1 and outputs a predetermined command to the IC card 1. For example, the external device outputs a select command to the IC card 1.

[0068] The IC card 1 receives the select command, performs command reception processing (ST222), execution timing determination processing (ST231), and biometric authentication processing (ST232 to ST237), performs command processing based on the command at a predetermined timing (ST223), performs response processing (ST224), and outputs a select response (ST224a).

[0069] For example, if the execution timing of the biometric authentication process included in the setting information of the data memory 24 indicates "before the execution of the select command," the processor 21 outputs an execution command for the biometric authentication process before the execution of the select command based on the setting information, and the processor 31 executes the biometric authentication process. After the execution of the biometric authentication process, the processor 21 executes the select process.

[0070] Furthermore, if the action to be taken when authentication fails in the biometric authentication process included in the setting information of the data memory 24 indicates "maintain the state," the processor 21 outputs a command to execute the biometric authentication process based on the setting information until the biometric authentication is successful, and the processor 31 executes the biometric authentication process.

[0071] FIG. 8 is a sequence diagram including a biometric authentication process executed before a command process (before a setting change process) according to the embodiment. As shown in FIG. 8, the processor 21 of the IC card 1 receives power supply from the contact portion of the contact communication interface 251 and executes the ATR output process (ST211), and the contact communication interface 251 outputs the ATR as an initial response to the external device (ST211a).

[0072] The external device receives the ATR from the IC card 1 and outputs a predetermined command to the IC card 1. For example, the external device outputs a setting change command to the IC card 1.

[0073] The IC card 1 receives the setting change command, performs command reception processing (ST222), execution timing determination processing (ST231), and biometric authentication processing (ST232 to ST237), performs command processing based on the command at a predetermined timing (ST223), performs response processing (ST224), and outputs a setting change response (ST224a).

[0074] For example, if the execution timing of the biometric authentication process included in the setting information of the data memory 24 indicates "before the execution of a setting change command," the processor 21 outputs an execution command for the biometric authentication process based on the setting information before the execution of the setting change command, and the processor 31 executes the biometric authentication process. After the execution of the biometric authentication process, the processor 21 executes the setting change process.

[0075] Furthermore, if the action to be taken when authentication fails in the biometric authentication process included in the setting information of the data memory 24 indicates "maintain the state," the processor 21 outputs a command to execute the biometric authentication process based on the setting information until the biometric authentication is successful, and the processor 31 executes the biometric authentication process.

[0076] 9 is a flowchart showing a third example of biometric authentication processing by the IC card according to the embodiment. The third example is a case where the first communication condition for communicating with an external device via the contact communication interface 251 is satisfied. When the contact portion of the contact communication interface 251 of the IC card 1 comes into physical and electrical contact with the reader / writer contact portion provided in the card reader / writer, which is an external device, the contact portion of the contact communication interface 251 receives power from the reader / writer contact portion and supplies power to each portion of the IC card 1.

[0077] The processor 21 receives power supply from the contact portion of the contact communication interface 251 and executes the ATR output process (ST211), and the contact communication interface 251 outputs the ATR as an initial response to the external device.

[0078] The external device receives the ATR from the IC card 1 and outputs a predetermined command to the IC card 1. For example, the external device outputs a select command or a setting change command to the IC card 1.

[0079] The contact communication interface 251 of the IC card 1 receives a select command or a setting change command from an external device, and the processor 21 executes a command reception process (ST222) and determines the timing to execute the biometric authentication process based on the setting information in the data memory 24 (ST231). Since the select command or the setting change command has been received by the contact communication interface 251, the processor 21 identifies the contact communication interface through an I / F determination process. The processor 21 determines the timing to execute the biometric authentication process based on the first communication condition included in the setting information in the data memory 24.

[0080] If the execution timing of the biometric authentication processing included in the setting information of the data memory 24 indicates "command processing" and also indicates "operation stopped," the processor 21 executes the first half of the command processing based on the setting information (ST223), does not output an instruction to execute the biometric authentication processing (ST232, YES), stops the biometric authentication processing, executes the second half of the command processing (ST224), executes the response response processing (ST225), and the contact communication interface 251 sends a response to the external device that sent the select command or setting change command.

[0081] If the execution timing of the biometric authentication process included in the setting information of the data memory 24 indicates "command processing" and does not indicate "operation stopped," the processor 21 executes the first half of the command processing based on the setting information (ST223) and outputs an instruction to execute the biometric authentication process (ST232, NO), and the processor 31 executes the biometric authentication process while the command is being executed (ST234, YES) (ST235).

[0082] For example, if the execution timing of the biometric authentication process included in the setting information of data memory 24 indicates "during execution of a select command" or "during execution of a setting change command," processor 21 outputs an execution command for the biometric authentication process while the select command or the setting change command is being executed based on the setting information. While the select command or the setting change command is being executed, processor 31 compares the fingerprint information detected by biometric sensor 32 with the fingerprint image or fingerprint feature data registered in data memory 24, and determines that the comparison is successful if the comparison result meets a criterion (ST236, YES), or determines that the comparison is unsuccessful if the criterion is not met (ST236, NO). Note that in IC card 1, the roles of processors 21 and 31 may be performed by a single processor.

[0083] If the match is successful, the processor 21 executes the second half of the select process or setting change process based on the select command or setting change command sent from the external device (ST224), executes the response process (ST225), and the contact communication interface 251 sends a select process response or setting change response to the external device that sent the select command or setting change command.

[0084] If the matching fails and the action to be taken when authentication fails in the biometric authentication process contained in the setting information of the data memory 24 indicates "maintain the state" (ST237, YES), the processor 21 outputs a command to execute the biometric authentication process based on the setting information, and the processor 31 executes the biometric authentication process (ST235).

[0085] If the matching fails and the action to be taken when the biometric authentication process fails, which is included in the setting information of the data memory 24, indicates "transition to the next process" (ST237, NO), the processor 21 stores the authentication failure in the RAM 323 (ST238), executes the second half of the next process, which is the select process or the setting change process (ST224), executes the response process (ST225), and the contact communication interface 251 transmits a select process response or a setting change process response to the external device that sent the select command or the setting change command.

[0086] The IC card 1 described above enables biometric authentication processing to be performed at any time. In other words, when the IC card 1 is implemented in combination with a secure element, the IC card 1 can perform fingerprint authentication processing at any time without being controlled by a trigger from the secure element. Furthermore, the IC card 1 can perform fingerprint authentication processing at any time, distinguishing between contact communication and contactless communication with a card reader / writer. For example, the IC card 1 can be configured to perform fingerprint authentication before the collision prevention processing, so that fingerprint authentication processing can be performed at a time that suits the environment in which the IC card 1 is used, thereby improving convenience. In this way, the IC card 1 can perform fingerprint authentication processing at any time, which also has the advantage of making it easier to achieve compatibility with IC cards that do not implement fingerprint authentication processing.

[0087] The program according to this embodiment may be transferred in a state where it is stored in an electronic device such as an IC card 1, or may be transferred in a state where it is not stored in an electronic device. In the latter case, the program may be transferred via a network, or may be transferred in a state where it is stored in a storage medium. The storage medium is a non-transitory tangible medium. The storage medium is a computer-readable medium. The storage medium may be an optical disk, a memory card, or any other medium that can store a program and is readable by a computer, and its form is not important. The electronic device downloads the program transferred (provided) via a network and installs it in its memory, or reads the program from the storage medium and installs it in its memory.

[0088] Although several embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included within the scope and spirit of the invention, and are also included in the scope of the invention and its equivalents as defined in the claims. [Explanation of symbols]

[0089] 1. IC card 11...Control unit 12...Biometric matching unit 13...LED 21...Processor 22...ROM 23...RAM 24...Data memory 25...Communication interface 31...Processor 32...Biometric sensor 251...contact communication interface 252...Contactless communication interface

Claims

1. a memory for storing setting information for setting the execution timing of biometric authentication processing; a biosensor for detecting biometric information; a communication interface for receiving commands; a processor that determines the execution timing of biometric authentication processing based on the setting information, and executes biometric authentication processing based on the biometric information detected by the biometric sensor and command processing based on a command received by the communication interface in accordance with the execution timing indicated by the determination result; A portable electronic device comprising:

2. the setting information includes information for executing a biometric authentication process before executing a received command; The portable electronic device of claim 1 , wherein the processor performs a biometric authentication process based on the setting information before executing a received command.

3. the setting information includes information for executing a biometric authentication process before executing a collision prevention process command, The portable electronic device of claim 1 , wherein the processor performs a biometric authentication process based on the setting information before executing the anti-collision process command.

4. the setting information includes information for executing a biometric authentication process before executing a select command, The portable electronic device of claim 1 , wherein the processor performs a biometric authentication process based on the setting information before executing the select command.

5. the setting information includes information for executing a biometric authentication process during command processing based on a received command, The portable electronic device of claim 1 , wherein the processor performs a biometric authentication process during processing of the received command based on the setting information.

6. the communication interface includes a contactless communication interface for communicating with an external device in a contactless manner; the setting information includes information for executing a biometric authentication process before executing a process based on a received command received by the contactless communication interface, The portable electronic device of claim 1 , wherein the processor performs a biometric authentication process based on the setting information before executing the received command.

7. the communication interface includes a contact portion that comes into contact with and communicates with an external device; the setting information includes information for executing a biometric authentication process during execution of a received command when a process based on the received command is executed by the contact unit; The portable electronic device of claim 1 , wherein the processor performs a biometric authentication process during execution of the command based on the setting information.

8. determining the timing of execution of the biometric authentication process based on setting information that sets the timing of execution of the biometric authentication process; According to the execution timing indicated by the determination result, a biometric authentication process based on the biometric information detected by the biometric sensor and a command process based on the command received by the communication interface are executed. A biometric authentication execution timing control method comprising:

9. On the computer, a step of determining the execution timing of the biometric authentication process based on setting information that sets the execution timing of the biometric authentication process; a step of executing a biometric authentication process based on the biometric information detected by the biometric sensor and a command process based on a command received by the communication interface in accordance with the execution timing indicated by the determination result; A computer-readable storage medium storing a program for executing the above.

Images