Authentication program, authentication apparatus, authentication method, recording medium, and service providing system

Abstract

To provide an authentication program capable of easily registering a plurality of users.SOLUTION: According to an aspect of the present disclosure, there is provided a non-transitory computer-readable recording medium storing an authentication program that causes a computer to execute an acquisition procedure, an authentication procedure, and an output procedure, in which the acquisition procedure includes acquiring user identification information capable of identifying a user, the authentication procedure includes determining, when authentication is given to the user on the basis of collation between the user identification information and a database, whether or not the user given the authentication is a representative user having a registration right, and the registration right is a right to register the user identification information in the database, when it is determined that the user who has granted the authentication is the representative user, the user identification information of another user other than the representative user is registered in the database in association with the representative user, and then authentication is granted to the other user on the basis of collation between the user identification information and the database, and in the output procedure, authentication information related to granting of the authentication is output.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present disclosure relates to an authentication program, an authentication device, an authentication method, a recording medium, and a service providing system. [Background technology]

[0002] Patent document 1 discloses an authentication device that includes an acquisition unit that acquires a facial image taken of a user to be authenticated, a determination unit that determines whether or not to perform processing on the facial image based on the result of authentication of the facial image acquired by the acquisition unit by a facial recognition engine, and a processing unit that performs processing on the facial image to generate a processed image when the determination unit determines that processing should be performed. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2024-74632 Summary of the Invention [Problem to be solved by the invention]

[0004] According to the invention of Patent Document 1, it is possible to improve authentication accuracy regardless of the performance of the device used for face authentication. On the other hand, the invention of Patent Document 1 does not allow for easy registration of multiple users.

[0005] Therefore, an object of the present disclosure is to provide an authentication program, an authentication device, an authentication method, a recording medium, and a service providing system that allow for easy registration of multiple users. [Means for solving the problem]

[0006] In order to achieve the above objective, the authentication program of the present disclosure includes: An acquisition procedure, an authentication procedure, and an output procedure are included, the obtaining step obtains user identification information capable of identifying the user; The authentication procedure includes: When the user is authenticated based on the comparison between the user identification information and a database, it is determined whether the user who has been authenticated is a representative user who has the right to register; the registration right is a right to register the user identification information in the database, If it is determined that the user to whom the authentication is granted is the representative user, the user identification information of other users other than the representative user is linked to the representative user and registered in the database, and then authentication is granted to the other users based on a comparison between the user identification information and the database; the output step outputs authentication information regarding the granting of the authentication. This is a program for causing a computer to execute each of the above procedures.

[0007] The authentication device of the present disclosure includes: An acquisition unit, an authentication unit, and an output unit, the acquiring unit acquires user identification information capable of identifying a user; The authentication unit When the user is authenticated based on the comparison between the user identification information and a database, it is determined whether the user who has been authenticated is a representative user who has the right to register; the registration right is a right to register the user identification information in the database, If it is determined that the user to whom the authentication is granted is the representative user, the user identification information of other users other than the representative user is linked to the representative user and registered in the database, and then authentication is granted to the other users based on a comparison between the user identification information and the database; the output unit outputs authentication information regarding the granting of the authentication. It is a device.

[0008] The authentication method of the present disclosure includes: The method includes an acquisition step, an authentication step, and an output step, the acquiring step acquires user identification information that can identify the user; The authentication step includes: When the user is authenticated based on the comparison between the user identification information and a database, it is determined whether the user who has been authenticated is a representative user who has the right to register; the registration right is a right to register the user identification information in the database, If it is determined that the user to whom the authentication is granted is the representative user, the user identification information of other users other than the representative user is linked to the representative user and registered in the database, and then authentication is granted to the other users based on a comparison between the user identification information and the database; The output step outputs authentication information regarding the granting of the authentication. Each of the steps is a computer-implemented method.

[0009] The recording medium of the present disclosure includes: An acquisition procedure, an authentication procedure, and an output procedure are included, the obtaining step obtains user identification information capable of identifying the user; The authentication procedure includes: When the user is authenticated based on the comparison between the user identification information and a database, it is determined whether the user who has been authenticated is a representative user who has the right to register; the registration right is a right to register the user identification information in the database, If it is determined that the user to whom the authentication is granted is the representative user, the user identification information of other users other than the representative user is linked to the representative user and registered in the database, and then authentication is granted to the other users based on a comparison between the user identification information and the database; the output step outputs authentication information regarding the granting of the authentication. A computer-readable recording medium stores an authentication program for causing a computer to execute each of the above procedures. [Effects of the Invention]

[0010] According to the present disclosure, multiple users can be registered easily. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 1 is a block diagram showing an example of the configuration of an authentication device according to the present disclosure. [Figure 2] FIG. 2 is a block diagram illustrating an example of a hardware configuration of the authentication device of the present disclosure. [Figure 3] FIG. 3 is a flowchart showing an example of a procedure according to the authentication program of the present disclosure. [Figure 4] FIG. 4 is a block diagram showing an example of the configuration of the service providing system of the present disclosure. [Figure 5] FIG. 5 is a block diagram illustrating an example of a hardware configuration of a service providing apparatus according to the present disclosure. [Figure 6] Fig. 6(A) and Fig. 6(B) are flowcharts showing an example of a procedure by the service providing program of the present disclosure. Fig. 6(A) is a flowchart showing an example of processing by the program using the authentication device of the present disclosure. Fig. 6(B) is a flowchart showing an example of processing by the program using the service providing device of the present disclosure. [Figure 7] FIG. 7 is a schematic diagram showing an example of a usage form of the service providing system of the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. The present disclosure is not limited to the following embodiments. In the following drawings, identical parts are designated by the same reference numerals. Furthermore, the descriptions of the embodiments can be used interchangeably unless otherwise specified, and the configurations of the embodiments can be combined unless otherwise specified. In the present disclosure, each drawing may apply to one or more embodiments.

[0013] [Embodiment 1] The authentication program of the present disclosure is a program for causing a computer to execute an acquisition procedure, an authentication procedure, and an output procedure. The authentication program of the present disclosure can also be said to be a program for causing a computer to function as the acquisition procedure, the authentication procedure, and the output procedure. Furthermore, the authentication program of the present disclosure can also be said to be a program for causing a computer to execute, for example, each step of an authentication method described below.

[0014] The acquisition procedure acquires user identification information that can identify a user, and the authentication procedure, when granting authentication to the user based on a comparison between the user identification information and a database, determines whether the user who granted the authentication is a representative user who has registration rights, the registration rights being the right to register the user identification information in the database, and if it is determined that the user who granted the authentication is the representative user, the user identification information of other users other than the representative user is linked to the representative user and registered in the database, and then authentication is granted to the other users based on a comparison between the user identification information and the database, and the output procedure outputs authentication information regarding the granting of the authentication.

[0015] For example, the term "procedure" in each of the steps can be read as "processing." The authentication program of the present disclosure may be recorded on a computer-readable recording medium. The recording medium may be, for example, a non-transitory computer-readable storage medium. The recording medium is not particularly limited, and examples thereof include random access memory (RAM), read-only memory (ROM), hard disk (HD), flash memory (e.g., solid state drive (SSD), USB flash memory, SD / SDHC card, etc.), optical disk (e.g., CD-R / CD-RW, DVD-R / DVD-RW, BD-R / BD-RE, etc.), magneto-optical disk (MO), and floppy disk (FD). The authentication program of the present disclosure (also referred to as a programming product or program product) may be distributed from an external computer. The "distribution" may be, for example, via a communication network or a device connected via a wired connection. The authentication program of the present disclosure may be installed and executed on the device to which it is distributed, or may be executed without being installed. An information processing device capable of executing the authentication program of the present disclosure can be referred to as, for example, the authentication device of the present disclosure.

[0016] Next, an example of the configuration of an authentication device according to the present disclosure will be described with reference to FIG. 1. FIG. 1 is a block diagram showing an example of the configuration of an authentication device 10 according to the present disclosure (hereinafter also referred to as the present device 10). As shown in FIG. 1, the present device 10 includes an acquisition unit 11, an authentication unit 12, and an output unit 13. Although not shown, the present device 10 may also include, for example, an input unit, another output unit, a display unit, and / or a storage unit. The acquisition unit 11, the authentication unit 12, and the output unit 13 are capable of executing, for example, an acquisition procedure, an authentication procedure, and an output procedure in the authentication program according to the present disclosure, respectively.

[0017] The device 10 may be, for example, a single device including the above-described units, or a device in which the units can be connected via a communication network. The device 10 can also be connected to an external device (described later) via the communication network. The communication network is not particularly limited and any known network can be used, for example, a wired or wireless network. Examples of the communication network include the Internet, the World Wide Web (WWW), a telephone line, a Local Area Network (LAN), a Storage Area Network (SAN), a Delay Tolerant Networking (DTN), a Low Power Wide Area Network (LPWA), and a Local 5G (L5G). Examples of wireless communication include Wi-Fi (registered trademark), Bluetooth (registered trademark), Local 5G, and LPWA. Examples of the wireless communication include direct communication between devices (Ad Hoc communication), infrastructure communication, and indirect communication via an access point. The device 10 may be incorporated into a server as a system. Furthermore, the present device 10 may be, for example, a personal computer (PC, for example, desktop or notebook type) on which the program of the present disclosure is installed, a smartphone, a tablet terminal, etc. The present device 10 may be in the form of cloud computing or edge computing, for example, in which at least one of the above-mentioned units is located on a server and the other units are located on a terminal.

[0018] 2 shows a block diagram of the hardware configuration of the device 10. The device 10 includes, for example, a central processing unit (CPU, GPU, etc.) 101, a memory 102, a bus 103, a storage device 104, an input device 105, an output device 106, and a communication device 107. The components of the device 10 are connected to each other via the bus 103 and their respective interfaces (I / F).

[0019] The central processing unit 101 operates in cooperation with other components via a controller (such as a system controller or an I / O controller) and is responsible for overall control of the device 10. In the device 10, the central processing unit 101 executes, for example, the program of the present disclosure (authentication program) and other programs, and also reads and writes various types of information. Specifically, for example, the central processing unit 101 functions as an acquisition unit 11, an authentication unit 12, and an output unit 13. The device 10 may include, as a computing device, other computing devices such as a CPU, a GPU (Graphics Processing Unit), an APU (Accelerated Processing Unit), or a combination of these.

[0020] The bus 103 can also be connected to, for example, external devices. Examples of the external devices include an external storage device (such as an external database), a printer, an external input device, an external display device, and an external imaging device. The device 10 can be connected to an external network (the communication line network) by, for example, a communication device 107 connected to the bus 103, and can also be connected to other devices via the external network.

[0021] The memory 102 may be, for example, a main memory (primary storage device). When the central processing unit 101 performs processing, the memory 102 reads various operating programs, such as the program of the present disclosure, stored in the storage device 104 (described later), and the central processing unit 101 receives data from the memory 102 and executes the programs. The main memory may be, for example, a RAM (random access memory). The memory 102 may also be, for example, a ROM (read only memory).

[0022] The storage device 104 is also referred to as an auxiliary storage device, for example, in contrast to the main memory (primary storage device). As described above, the storage device 104 stores an operating program including the program of the present disclosure. The storage device 104 may be, for example, a combination of a recording medium and a drive for reading and writing data from and to the recording medium. The recording medium is not particularly limited and may be, for example, an internal or external type, such as a hard disk (HD), CD-ROM, CD-R, CD-RW, MO, DVD, flash memory, or memory card. The storage device 104 may be, for example, a hard disk drive (HDD) or a solid-state drive (SSD) in which the recording medium and drive are integrated. When the device 10 includes the storage unit, for example, the storage device 104 functions as the storage unit. The storage unit can store, for example, user identification information, user authentication status information, registration right information, user class information, user registration information, authentication information, user validity period information, user registration status information, linked representative user information, and various determination results, which will be described later.

[0023] In the present device 10, the memory 102 and the storage device 104 can also store various information such as log information, information acquired from an external database (not shown) or an external device, information generated by the present device 10, and information used when the present device 10 executes processing. In this case, the memory 102 and the storage device 104 may store, for example, the above-mentioned information on the user of the present device. Note that at least a portion of the information may be stored, for example, in an external server other than the memory 102 and the storage device 104, or may be stored in a distributed manner across multiple terminals using blockchain technology or the like.

[0024] The device 10 further includes, for example, an input device 105 and an output device 106. Examples of the input device 105 include a pointing device such as a touch panel, track pad, or mouse; a keyboard; an imaging device such as a camera or scanner; a card reader such as an IC card reader or a magnetic card reader; and an audio input device such as a microphone. Examples of the output device 106 include a display device such as an LED display or a liquid crystal display; an audio output device such as a speaker; a printer; etc. In the first embodiment, the input device 105 and the output device 106 are configured separately, but the input device 105 and the output device 106 may be configured as an integrated device, such as a touch panel display.

[0025] An example of processing by the authentication program of the present disclosure will be described in more detail with reference to Fig. 3. Fig. 3 is a flowchart showing an example of each procedure of the authentication program of the present disclosure.

[0026] The acquisition unit 11 acquires user identification information that can identify a user (S1, acquisition step).

[0027] The user is a person from whom the user identification information is to be acquired. Preferably, there are two or more users. Preferably, at least one of the users is a representative user with registration rights, as described below. The user may be, for example, a user whose user identification information has already been registered in a database, as described below, or a user whose user identification information has not yet been registered in a database, as described below. The user may be, for example, a representative user with registration rights, as described below, or another user other than a representative user with registration rights, as described below. Examples of relationships between a representative user, as described below, and another user, as described below, include a relationship between a superior and a subordinate, a relationship between a manager and a managed person, a relationship between a leader and a companion, and a parent-child relationship. The user may be, for example, a person who receives a service, as described below.

[0028] The user identification information is information that can identify the user. Examples of the user identification information include biometric identification information that can identify the user based on biometric information and possession identification information that can identify the user based on possessions. The user identification information may be, for example, one piece of user identification information or a combination of two or more pieces of user identification information. In the latter case, the user identification information may be, for example, a combination of the same type of user identification information (e.g., a combination used for multi-step authentication) or a combination of different types of user identification information (e.g., a combination used for multi-factor authentication). The medium for acquiring the user identification information can be appropriately selected, for example, depending on the type of user identification information. The medium for acquiring the user identification information may be, for example, one piece of user identification information or two or more pieces of user identification information. In the latter case, the medium for acquiring the user identification information may be, for example, one for a representative user who has registration rights, which will be described later, and one for other users other than the representative user who has registration rights, which will be described later. Examples of the medium for acquiring the user identification information include a medium for acquiring biometric identification information and a medium for acquiring possession identification information.

[0029] The biometric identification information is, for example, information that can identify the user based on biometric information. The biometric information is, for example, information about the user's biological body. The biometric information may be, for example, feature amounts extracted from the biometric information. The biometric identification information may be, for example, the feature amounts themselves, or information obtained by encrypting the feature amounts (such as information used for cancelable biometric authentication). The biometric information may include, for example, information about a body part or a function of a body part. The biometric information may include, for example, information about the head, information about the eyes, information about fingers, information about sounds, and information about behaviors. Examples of the head include, for example, the face and auricles. Examples of the face include, for example, the eyes, nose, and mouth. Examples of the face information include, for example, information about the shape or arrangement of at least one of the eyes, nose, and mouth. Examples of methods for acquiring the face information include, for example, a visual method and an infrared method. Examples of the eyes include, for example, the retina, iris, and ocular blood vessels. Examples of the fingers include, for example, fingerprints, palm prints, and veins. Examples of the veins include finger veins, back of the hand veins, and palm veins. Examples of the sounds include voiceprints and ear acoustics. Examples of the behaviors include walking style, walking speed, handwriting, writing pressure, and writing speed. The biometric identification information may be, for example, one piece of information or a combination of two or more pieces of information (e.g., a combination used in multimodal biometric authentication). Examples of the combinations used in multimodal biometric authentication include a combination of information about the face and information about the iris, a combination of information about the fingerprint and information about the veins, and a combination of information about the face, information about the iris, and information about the fingerprint. The medium for acquiring the biometric identification information can be appropriately selected depending on the type of biometric information. Specifically, examples of the medium for acquiring the biometric identification information include an imaging unit including a camera. The imaging unit is, for example, a unit for capturing images. Examples of the captured images include still images and videos.

[0030] The possession identification information is, for example, information that can identify the user based on the possession. Examples of the possession identification information include International Mobile Equipment Identity (IMEI), Mobile Equipment IDentifier (MEID), International Mobile Subscriber Identity (IMSI), IC Card IDentifier (ICCID), and Media Access Control address (MAC address). The possession identification information may be, for example, an identifier unique to each operating system installed in the possession. The possession identification information may be, for example, information obtained by encoding the possession identification information. Examples of the encoding format of the possession identification information include Radio Frequency Identification (RFID), one-dimensional code, and two-dimensional code. Examples of the RFID include Near Field Communication (NFC). Examples of the one-dimensional code include a barcode. Examples of the two-dimensional code include a QR Code (registered trademark). Examples of the possession include a smartphone terminal, a tablet terminal, an IC card, and a security token. The medium for acquiring the possession identification information can be appropriately selected depending on, for example, the type of the possession identification information or the encoding format of the possession identification information. The possession identification information may be, for example, one piece of possession identification information or a combination of two or more pieces of possession identification information.

[0031] The acquisition unit 11 may, for example, acquire the user identification information one by one, or may acquire the user identification information of two or more users simultaneously. The acquisition unit 11 may, for example, acquire the user identification information from one user identification information acquisition medium, or from two or more user identification information acquisition media. In the latter case, the acquisition unit 11 may, for example, acquire the user identification information for a representative user who has registration rights, which will be described later, and the user identification information for other users other than the representative user who has registration rights, which will be described later, from separate user identification information acquisition media. For example, if the user identification information is encrypted information, the acquisition unit 11 may decrypt the user identification information and then acquire the user identification information. For example, if the user identification information is encoded information, the acquisition unit 11 may decode the user identification information and then acquire the user identification information.

[0032] The medium for acquiring the user identification information may be provided, for example, in the device of the present disclosure, or in another device other than the device of the present disclosure. In the former case, the device of the present disclosure may acquire the user identification information from the medium for acquiring the user identification information. In the latter case, the device of the present disclosure may connect to the other device via, for example, a wired or wireless communication network and acquire the user identification information from the other device. The acquired user identification information may be stored, for example, in the memory 102 or storage device 104 of the device of the present disclosure, or in the memory or storage device of a device other than the device of the present disclosure.

[0033] When the authentication unit 12 grants authentication to the user based on a comparison between the user identification information and a database, the authentication unit 12 determines whether the user who granted the authentication is a representative user who has the right to register (S2-1, authentication procedure). The authentication procedure of S2-1, for example, determines whether the user who granted the authentication is a representative user who has the right to register, and therefore can also be called a determination procedure. For this reason, the authentication unit 12 may include, for example, a determination unit 12'. In this case, when the authentication is granted to the user based on a comparison between the user identification information and a database, the determination unit 12' may determine whether the user who granted the authentication is a representative user who has the right to register (S2-1', determination procedure).

[0034] The database is a collection of data storing the user identification information linked at least with the presence or absence of registration rights, which will be described later. The database may, for example, set the presence or absence of registration rights, which will be described later, as registration right ownership information. In this case, for example, if the user has registration rights, which will be described later, the database may set the registration right ownership information to "valid." Furthermore, for example, if the user does not have registration rights, which will be described later, the database may set the registration right ownership information to "invalid." For example, if the user has registration rights, which will be described later (i.e., if the registration right ownership information is "valid"), the database may set the user's user class information, which will be described later, to "representative user." For example, if the user is registered linked to a representative user, which will be described later (i.e., if the representative user linking information, which will be described later, is set linked to the representative user, which will be described later), the database may set the user's user class information, which will be described later, to "member user." The database may have, for example, a hierarchical, network, or relational format.

[0035] The database may be a collection of data that stores the user identification information in association with other information, in addition to the presence or absence of registration rights (described later). The other information may include, for example, user registration information regarding the registration of the user, user authentication status information regarding the authentication status of the user, user class information regarding the class of the user, and user attribute information regarding the attributes of the user.

[0036] The user registration information is, for example, information related to the user's registration. Examples of the user registration information include representative user linking information related to a representative user (described later) linked to the user, user registration status information related to the registration status in the database, user validity period information related to the validity period of the registration in the database, the user's identifier in the database, and the time of registration in the database. The representative user linking information may be set by linking the representative user when the authentication unit 12 links the user to the representative user and registers the user in the database. The user registration status information may be set to "valid" when the authentication unit 12 links the user to the representative user and registers the user in the database. The user registration status information may be set to "invalid" when the authentication unit 12 invalidates the user's registration in the database. The user validity period information may be set to a predetermined period when the authentication unit 12 assigns a validity period to the user's registration in the database.

[0037] The user authentication status information is, for example, information about the authentication status of the user. For example, the user authentication status information may be set to "valid" when the authentication unit 12 grants authentication to the user. Furthermore, the user authentication status information may be set to "invalid" when the authentication unit 12 cancels the authentication granted to the user.

[0038] The user class information is, for example, information that classifies the user into classes based on the presence or absence of the registration right. For example, when the authentication unit 12 determines that the user is the representative user (i.e., when the registration right possession information is "valid"), the user class of the user may be set to "representative user." For example, when the authentication unit 12 registers the user by linking it to the representative user (i.e., when the representative user linking information is set by linking the representative user), the user class information may be set to "member user."

[0039] The user attribute information may include, for example, name, title, age, portrait, sex, postal code, address, telephone number, email address, job title, affiliation, and affiliation.

[0040] The database may be stored, for example, in the memory 102 or storage device 104 of the device of the present disclosure, or in the memory or storage device of a device other than the device of the present disclosure.

[0041] The authentication unit 12 authenticates the user based on a comparison between the user identification information and the database. Specifically, the authentication unit 12 first determines, for example, whether the acquired user identification information matches the user identification information registered in the database. If the user identification information is the possession identification information, the determination of whether the user identification information matches is preferably, for example, whether the user identification information matches exactly. If the user identification information is the biometric identification information, the determination of whether the user identification information matches is preferably, for example, whether the user identification information matches to a predetermined extent. The predetermined extent can be appropriately selected, for example, depending on the type of biometric identification information and the performance of the medium from which the biometric identification information is acquired. Next, for example, if the authentication unit 12 determines that the acquired user identification information matches the user identification information registered in the database, the authentication unit 12 authenticates the user. Furthermore, if the authentication unit 12 determines that the acquired user identification information does not match the user identification information registered in the database, the authentication unit 12 does not authenticate the user. For example, when the authentication unit 12 grants authentication to the user, the authentication unit 12 may set the user authentication status information on the database to "valid."

[0042] The authentication unit 12 may, for example, cancel the authentication granted to the user based on a comparison between the user identification information and a database. A service described below may need to cancel the authentication granted to the user, for example, when providing the service. Specifically, for example, if a service described below provides access to a specific location, the authentication unit 12 may allow free entry to the specific location if the authentication is not canceled when the user leaves the specific location. Therefore, for example, if a service described below provides access to a specific location, the authentication unit 12 may cancel the authentication granted to the user based on a comparison between the user identification information and a database. For example, when canceling the authentication granted to the user, the authentication unit 12 may set the user authentication status information in the database to "invalid." Note that the cancellation of the authentication granted to the user by the authentication unit 12 is not limited to the above description and can be implemented appropriately depending on the type of service described below.

[0043] When the authentication unit 12 grants authentication to the user, it determines whether the user who granted the authentication is a representative user who has the right to register. Specifically, the authentication unit 12 determines whether the user who granted the authentication has the right to register, for example, based on comparing the user who granted the authentication with the database. For example, the authentication unit 12 may determine that the user who granted the authentication is a representative user who has the right to register if the registration right holding information in the database is valid. Furthermore, for example, the authentication unit 12 may determine that the user who granted the authentication is a user who does not have the right to register if the registration right holding information in the database is invalid. For example, the authentication unit 12 may determine that the user who granted the authentication is a representative user who has the right to register if the user class information in the database is "representative user." Furthermore, for example, the authentication unit 12 may determine that the user who granted the authentication is a user who does not have the right to register if the user class information in the database is not "representative user." For example, if the registration right holding information in the database is valid and the user class information in the database is "representative user," the authentication unit 12 may determine that the user who granted the authentication is a representative user who has registration rights.

[0044] The registration right is the right to register the user identification information in the database. As described above, the presence or absence of the registration right may be set, for example, as the registration right holding information in the database. In this case, the database may set the registration right holding information to "valid" if the user has the registration right. Furthermore, the database may set the registration right holding information to "invalid" if the user does not have the registration right. The database may set the user class information to "representative user" if the user has the registration right (i.e., the registration right holding information is "valid").

[0045] The registration right may be transferable between the users, for example. When transferring the registration right between the users, the authentication unit 12 may, for example, change the registration right holding information of the transferor user to "invalid" and then change the registration right holding information of the transferee user to "valid." When transferring the registration right between the users, the authentication unit 12 may, for example, change the user class information of the transferor user to "member user" and then change the user class information of the transferee user to "representative user." When transferring the registration right between the users, the authentication unit 12 may, for example, change the representative user linking information linked to the transferor user to the transferee user. The authentication unit 12 may, for example, permit the transfer of the registration right between the users only when the user authentication status information of the representative user is "valid" (i.e., when the authentication unit 12 has granted authentication to the representative user). The authentication unit 12 may permit the transfer of the registration right between the users only when the user authentication status information of both the transfer source user and the transfer destination user is "valid." According to the present disclosure, for example, when it becomes necessary to change the representative user due to a transfer or the like, this can be flexibly handled.

[0046] If the authentication unit 12 determines that the user to whom the authentication has been granted is the representative user, it links the user identification information of other users other than the representative user to the representative user and registers it in the database, and then grants authentication to the other users based on a comparison between the user identification information and the database (S2-2, authentication procedure).

[0047] When the authentication unit 12 determines that the user to whom the authentication is granted is the representative user, it registers the user identification information of other users other than the representative user in the database, linking them to the representative user. Specifically, for example, when the authentication unit 12 registers the other users linked to the representative user, it may set the user registration status information of the other users in the database to "valid." For example, when the authentication unit 12 registers the other users linked to the representative user, it may set the representative user linking information of the other users in the database to the representative user determined by the authentication unit 12. For example, when the authentication unit 12 registers the other users linked to the representative user, it may set the user class information of the other users in the database to "member user."

[0048] The authentication unit 12 may, for example, determine whether a predetermined condition is satisfied, and if it is determined that the predetermined condition is satisfied, may register the user identification information of the other user in the database in association with the representative user. The predetermined condition may be, for example, a registration processing acceptance period. The authentication unit 12 may, for example, determine whether the registration processing acceptance period is within, and if it is determined that the registration processing acceptance period is within, may register the user identification information of the other user in the database in association with the representative user. The registration processing acceptance period is, for example, a period during which the user identification information of the other user can be registered in the database. The registration processing acceptance period may, for example, be a predetermined period or an arbitrary period. At the start of the registration processing acceptance period, the authentication unit 12 may, for example, trigger the granting of the authentication to the representative user. Furthermore, for example, after granting the authentication to the representative user, the authentication unit 12 may start the acceptance period for the registration process, triggered by input of instruction information instructing the start of the acceptance period for the registration process. At the end of the acceptance period for the registration process, the authentication unit 12 may end the acceptance period for the registration process, for example, after the predetermined period or the arbitrary period has elapsed since the start of the acceptance period for the registration process. For example, after starting the acceptance period for the registration process, the authentication unit 12 may end the acceptance period for the registration process, triggered by input of instruction information instructing the end of the acceptance period for the registration process. The input of each piece of instruction information may be performed, for example, by the input device 105 of the device disclosed herein, or by an input device of a device other than the device disclosed herein. The input of each piece of instruction information may be, for example, an operation (e.g., a click operation, a tap operation, etc.) to select information corresponding to each piece of instruction information, using the input device 105 of the device disclosed herein or an input device of a device other than the device disclosed herein. The person inputting each piece of instruction information may be, for example, the person from whom the user identification information is to be obtained (e.g., the representative user, the other users, etc.), or may be a person other than the person from whom the user identification information is to be obtained (e.g., a person involved in providing the service described below).

[0049] For example, when the user identification information includes the biometric identification information and the acquisition medium of the biometric identification information is an imaging means, the authentication unit 12 may determine whether an imaging condition is met. In this case, the authentication unit 12 may, for example, determine whether the imaging condition is met, and if it is determined that the imaging condition is met, may register the user identification information of the other user in the database in association with the representative user. The imaging condition may be, for example, a captured image condition. As described above, the captured image may be, for example, a still image or a video. The captured image condition may be, for example, the presence or absence of the representative user in the captured image, the position of the user in the captured image, at least one of the user's facial expression and the user's movement in the captured image, the imaging area of ​​the captured image, or a combination of these conditions.

[0050] If the condition for the captured image is whether or not the representative user is present, the authentication unit 12 may, for example, determine whether or not the representative user is included in the captured image, and if it determines that the representative user is included in the captured image, determine that the imaging condition is met. In this case, for example, the imaging means may be different between the representative user and the other users.

[0051] When the captured image condition is the user's position, the authentication unit 12 may, for example, determine whether the user is in a predetermined position in the captured image, and if it determines that the user is in the predetermined position in the captured image, determine that the imaging condition is met. The user whose position is to be determined may be, for example, the representative user, the other user, or both the representative user and the other user. The user's position, which is a condition of the captured image, may differ between the representative user and the other user, for example.

[0052] When the captured image condition is at least one of the user's facial expression and the user's movement, the authentication unit 12 may, for example, determine whether the user has at least one of a predetermined facial expression and a predetermined movement, and if it is determined that the user has at least one of the predetermined facial expression and the predetermined movement, determine that the imaging condition is met. The user whose facial expression and / or movement is to be determined may be, for example, the representative user, the other user, or both the representative user and the other user. At least one of the facial expression and / or movement that is a condition of the captured image may differ between the representative user and the other user, for example.

[0053] When the captured image condition is the imaging area of ​​the captured image, the authentication unit 12 may, for example, determine whether the imaging area of ​​the captured image is a predetermined area, and if it determines that the imaging area of ​​the captured image is the predetermined area, determine that the imaging condition is met. The user whose imaging area is to be determined may be, for example, the representative user, the other user, or both the representative user and the other user. The imaging area of ​​the captured image, which is the captured image condition, may be different between the representative user and the other user, for example.

[0054] When the authentication unit 12 associates the user identification information of the other user with the representative user and registers it in the database, it grants authentication to the other user based on a comparison between the user identification information and the database. Specifically, the authentication unit 12, for example, determines whether the acquired user identification information matches the user identification information registered in the database. The determination of whether each piece of user identification information matches can be performed using, for example, the above-mentioned explanation. For example, when the authentication unit 12 determines that the acquired user identification information matches the user identification information registered in the database, it grants authentication to the other user. Furthermore, when the authentication unit 12 determines that the acquired user identification information does not match the user identification information registered in the database, it does not grant authentication to the other user. For example, when the authentication unit 12 grants authentication to the other user, it may set the user authentication status information in the database to "valid."

[0055] Furthermore, the authentication unit 12 may, for example, assign a validity period to the registration of the other user in the database. The validity period may, for example, be a period starting from the time when the authentication unit 12 registers the user identification information of the other user in the database and ending from the time a predetermined period has elapsed since the start time. The validity period may also, for example, be a period starting from the time when the authentication unit 12 grants authentication to the other user and ending from the time a predetermined period has elapsed since the start time. For example, when the authentication unit 12 assigns the validity period to the registration of the other user in the database, the authentication unit 12 may set the predetermined period as the validity period in the user validity period information. For example, the validity period may be reset each time the authentication unit 12 de-authenticates the other user. For example, the validity period may continue to count the predetermined period regardless of the de-authentication of the other user by the authentication unit 12. For example, when the authentication unit 12 cancels the authentication of the representative user, the authentication unit 12 may forcibly expire the validity period of the other user regardless of whether the predetermined period has elapsed. For example, the authentication unit 12 may link the start and expiration of the validity period with a change to the user registration status information. Specifically, for example, when the validity period begins, the authentication unit 12 may change the user registration status information to "valid." Furthermore, for example, when the validity period expires, the authentication unit 12 may change the user registration status information to "invalid." According to the present disclosure, for example, it is possible to limit the period during which other users can be authenticated. Therefore, according to the present disclosure, for example, it is possible to prevent other users from illegally enjoying the services described below outside the validity period.

[0056] For example, the authentication unit 12 may determine whether the validity period has expired, and if it is determined that the validity period has expired, may invalidate the registration of the other user in the database. Specifically, for example, if it is determined that the validity period has expired, the authentication unit 12 may delete the registration of the other user in the database or change the user registration status information of the other user in the database to "invalid."

[0057] The authentication unit 12 may, for example, assign a validity period to the representative user's registration in the database. The validity period of the representative user's registration in the database may be determined by referring to the above-mentioned explanation regarding the validity period of the other users' registration in the database.

[0058] Furthermore, for example, when the authentication unit 12 invalidates the representative user's registration in the database, it may simultaneously invalidate the registrations in the database of the other users linked to the representative user. Invalidating the representative user's registration in the database may be, for example, by deleting the representative user's registration or by changing the user registration status information of the representative user to "invalid." Invalidating the registrations in the database of the other users linked to the representative user may be, for example, by deleting the other users' registration or by changing the user registration status information of the other users to "invalid." For example, when the authentication unit 12 invalidates the representative user's registration, it may simultaneously invalidate the registrations of the other users linked to the representative user, regardless of the expiration of the validity period for the registrations of the other users. For example, the authentication unit 12 may simultaneously invalidate the registrations in the database of the other users who have the representative user whose registration has been invalidated set in the representative user linking information. According to the present disclosure, for example, registration of a representative user and other users can be managed collectively.

[0059] Furthermore, the authentication unit 12 may, for example, determine whether the authentication has been granted to the representative user, and if it determines that the authentication has been granted to the representative user, grant the authentication to the other users. For example, the authentication unit 12 may determine that the authentication has been granted to the representative user if the user authentication status information of the representative user is “valid.” For example, if the authentication unit 12 determines that the authentication has been granted to the representative user, the authentication unit 12 may grant the authentication to the other users by changing the user authentication status information of the other users to “valid.” Furthermore, for example, if the authentication unit 12 has previously granted the authentication to the other users and determines that the authentication has been granted to the representative user, the authentication unit 12 may continue the authentication granted to the other users by maintaining the user authentication status information of the other users as “valid.” According to the present disclosure, for example, authentication can be granted to other users only if authentication has been granted to the representative user. Therefore, according to the present disclosure, for example, the representative user can manage whether or not to grant authentication to other users. Furthermore, according to the present disclosure, only when authentication is granted to the representative user, can the representative user provide the services described below to other users. Therefore, according to the present disclosure, for example, the representative user can manage whether or not to provide the services described below to other users.

[0060] Furthermore, the authentication unit 12 may, for example, determine whether the representative user has been granted the authentication, and if it determines that the representative user has not been granted the authentication, it may not grant the authentication to the other users. For example, if the user authentication status information of the representative user is “invalid,” the authentication unit 12 may determine that the representative user has not been granted the authentication. For example, if it determines that the representative user has not been granted the authentication, the authentication unit 12 may change the user authentication status information of the other users to “invalid” to not grant the authentication to the other users. Furthermore, for example, if the authentication unit 12 has previously granted the authentication to the other users and determines that the authentication has not been granted to the representative user, the authentication unit 12 may change the user authentication status information of the other users to “invalid” to cancel the authentication granted to the other users. According to the present disclosure, for example, if the representative user has not been granted the authentication, it is possible to restrict the granting of authentication to other users. Therefore, according to the present disclosure, for example, the representative user can manage whether or not to grant authentication to other users. Furthermore, according to the present disclosure, if the representative user is not authenticated, provision of the services described below to other users can be restricted. Therefore, according to the present disclosure, for example, the representative user can manage whether or not to provide the services described below to other users.

[0061] The output unit 13 outputs authentication information regarding the granting of the authentication (S3, output step).

[0062] The output unit 13 may output the authentication information to, for example, the transmission unit 14 described below. In this case, the transmission unit 14 described below may transmit the authentication information to, for example, the service providing device 20 described below. The output unit 13 may output the authentication information to, for example, the output device 106 of the device disclosed herein, or an output device of a device other than the device disclosed herein. The output unit 13 may output the authentication information to, for example, at least one of the output unit, display unit, and storage unit of the device disclosed herein, or at least one of the output unit, display unit, and storage unit of a device other than the device disclosed herein. The output unit 13 may output the authentication information to, for example, the external device. The output unit 13 may output the authentication information to, for example, the memory 102 or storage device 104 of the device disclosed herein, or a memory and storage device of a device other than the device disclosed herein.

[0063] The authentication information is information regarding the granting of the authentication. The authentication information may be, for example, information regarding the granting of the authentication to at least one of the representative user and the other user. The authentication information may be, for example, information regarding whether the authentication has been granted to the user. The authentication information may be, for example, information corresponding to the user authentication status information in the database. The authentication information may be, for example, information that serves as a basis for determining whether to provide a service described below.

[0064] The "information serving as a basis for determining whether to provide a service" may include, for example, availability information regarding the usage authority of each service of other users associated with the representative user, which is set in advance by a representative user, a facility manager, or the like. The "information serving as a basis for determining whether to provide a service" may also include, for example, condition information regarding the usage conditions for each service (e.g., when the representative user is currently using the service) set in advance by a representative user, a facility manager, or the like. For example, when linking the user identification information of the other users with the representative user and registering them in the database, the authentication unit 12 may register at least one of the availability information and the condition information in the database. In this case, the authentication unit 12 may, for example, register at least one of the availability information and the condition information for each service providing device, which will be described later.

[0065] The authentication method of the present disclosure (hereinafter also referred to as the method of the present disclosure) is a method implemented by, for example, replacing each "procedure" in the program of the present disclosure with a "process." Specifically, the method of the present disclosure includes an acquisition process, an authentication process, and an output process. The acquisition process acquires user identification information capable of identifying a user. The authentication process, when granting authentication to the user based on a comparison between the user identification information and a database, determines whether the user who granted the authentication is a representative user with registration rights. The registration rights are the right to register the user identification information in the database. If it is determined that the user who granted the authentication is the representative user, the user identification information of other users other than the representative user is linked to the representative user and registered in the database, and then the other users are authenticated based on a comparison between the user identification information and the database. The output process outputs authentication information regarding the granting of the authentication. The method of the present disclosure can be implemented, for example, using the device 10 of the present disclosure shown in FIG. 1 or FIG. 2. Note that the method of the present disclosure is not limited to a method using the device 10 of the present disclosure. The method of the present disclosure can incorporate, for example, the description of the program of the present disclosure and the device of the present disclosure.

[0066] As described above, according to the authentication program disclosed herein, an acquisition procedure acquires user identification information capable of identifying a user, and an authentication procedure grants authentication to the user based on a comparison of the user identification information with a database. The program then determines whether the user who granted the authentication is a representative user with registration rights. The registration rights are the right to register the user identification information in the database. If the program determines that the user who granted the authentication is the representative user, the program links the user identification information of other users other than the representative user to the representative user and registers them in the database. Then, the program grants authentication to the other users based on a comparison of the user identification information with the database. The program then outputs authentication information related to the grant of authentication. Therefore, according to the present disclosure, multiple users can be easily registered. Furthermore, according to the present disclosure, for example, other users do not need to pre-register for authentication, and authentication registration can be easily performed. Furthermore, according to the present disclosure, for example, the representative user only needs to pre-register for authentication of the representative user himself, and authentication registration for other users can be easily performed. Furthermore, according to the present disclosure, for example, a representative user can centrally manage the authentication-related registrations of other users. Therefore, according to the present disclosure, for example, the representative user can prevent other users from fraudulently performing authentication-related registrations.

[0067] [Embodiment 2] An example of a service providing system according to the present disclosure will be described with reference to Fig. 4. As shown in Fig. 4, the service providing system 100 according to the present disclosure includes an authentication device 10A and a service providing device 20. In Fig. 4, the service providing system 100 includes one authentication device 10A and one service providing device 20, but the service providing system according to the present disclosure is not limited to this and may include multiple authentication devices 10A and multiple service providing devices 20. Furthermore, as shown in Fig. 4, the authentication device 10A and the service providing device 20 can communicate with each other, for example, via a communication network 30.

[0068] Fig. 4 is a block diagram showing an example of the configuration of authentication device 10A. As shown in Fig. 4, authentication device 10A (hereinafter also referred to as "this device 10A") includes a transmission unit 14 in addition to the configuration of authentication device 10 of embodiment 1. The hardware configuration of authentication device 10A is the same as that of authentication device 10 of Fig. 2, except that central processing unit 101 has the configuration of authentication device 10A of Fig. 4 instead of the configuration of authentication device 10 of Fig. 1.

[0069] Fig. 4 is a block diagram showing an example of the configuration of the service providing device 20. As shown in Fig. 4, the service providing device 20 (hereinafter also referred to as "this device 20") includes a receiving unit 21 and a providing unit 22. Although not shown, the service providing device 20 may also include, for example, an input unit, another output unit, a display unit, and / or a storage unit. The receiving unit 21 and the providing unit 22 can respectively execute, for example, a receiving procedure and a providing procedure in a service providing program of the present disclosure, which will be described later.

[0070] The device 20 may be, for example, a single device including the above-described units, or a device in which the units can be connected via a communication network. The device 20 can also be connected to an external device (described later) via the communication network. The communication network is not particularly limited, and any known network can be used, for example, wired or wireless. Examples of communication networks include the Internet, the World Wide Web (WWW), a telephone line, a Local Area Network (LAN), a Storage Area Network (SAN), a Delay Tolerant Networking (DTN), a Low Power Wide Area Network (LPWA), and a Local 5G (L5G). Examples of wireless communication include Wi-Fi (registered trademark), Bluetooth (registered trademark), Local 5G, and LPWA. Examples of wireless communication include direct communication between devices (Ad Hoc communication), infrastructure communication, and indirect communication via an access point. The device 20 may be incorporated into a server as a system. The device 20 may be, for example, a personal computer (PC, for example, a desktop or notebook type) on which the program of the present disclosure is installed, a smartphone, a tablet terminal, etc. Furthermore, the device 20 may be in the form of cloud computing or edge computing, for example, in which at least one of the units is located on a server and the other units are located on a terminal.

[0071] 5 shows a block diagram of the hardware configuration of the device 20. The device 20 includes, for example, a central processing unit (CPU, GPU, etc.) 201, a memory 202, a bus 203, a storage device 204, an input device 205, an output device 206, and a communication device 207. The components of the device 20 are connected to each other via the bus 203 and their respective interfaces (I / F).

[0072] The central processing unit 201 operates in cooperation with other components via a controller (such as a system controller or an I / O controller) and is responsible for overall control of the device 20. In the device 20, the central processing unit 201 executes, for example, the program (service provision program) of the present disclosure described below and other programs, and also reads and writes various types of information. Specifically, for example, the central processing unit 201 functions as a receiving unit 21 and a providing unit 22. The device 20 may include other computing devices such as a CPU (Central Processing Unit), a GPU (Graphics Processing Unit), an APU (Accelerated Processing Unit), or a combination of these as a computing device.

[0073] The bus 203 can also be connected to, for example, external devices. Examples of the external devices include an external storage device (such as an external database), a printer, an external input device, an external display device, an audio output device such as a speaker, an external imaging device such as a camera, and devices equipped with various sensors. The device 20 can be connected to an external network (the communication line network) by, for example, a communication device 207 connected to the bus 203, and can also be connected to other devices such as a user terminal via the external network.

[0074] The memory 202 may be, for example, a main memory (primary storage device). When the central processing unit 201 performs processing, the memory 202 reads various operating programs, such as the program of the present disclosure, stored in the storage device 204 (described later), and the central processing unit 201 receives data from the memory 202 and executes the programs. The main memory may be, for example, a RAM (random access memory). The memory 202 may also be, for example, a ROM (read only memory).

[0075] The storage device 204 is also referred to as an auxiliary storage device, for example, in contrast to the main memory (primary storage device). As described above, the storage device 204 stores an operating program including the program of the present disclosure. The storage device 204 may be, for example, a combination of a recording medium and a drive for reading and writing data from and to the recording medium. The recording medium is not particularly limited and may be, for example, an internal or external type, such as a hard disk (HD), CD-ROM, CD-R, CD-RW, MO, DVD, flash memory, or memory card. The storage device 204 may be, for example, a hard disk drive (HDD) or a solid-state drive (SSD) in which the recording medium and drive are integrated. When the device 20 includes the storage unit, for example, the storage device 204 functions as the storage unit. The storage unit can store, for example, authentication information (described later) and the determination results by the providing unit. The storage unit may also function, for example, as a database of various information (described later).

[0076] In the present device 20, the memory 202 and the storage device 204 can also store various information such as log information, information acquired from an external database (not shown) or an external device, information generated by the present device 20, and information used when the present device 20 executes processing. In this case, the memory 202 and the storage device 204 may store, for example, the above-mentioned information on the user of the present device. Note that at least a portion of the information may be stored, for example, in an external server other than the memory 202 and the storage device 204, or may be stored in a distributed manner across multiple terminals using blockchain technology or the like.

[0077] The device 20 further includes, for example, an input device 205 and an output device 206. Examples of the input device 205 include pointing devices such as a touch panel, track pad, and mouse; a keyboard; imaging means such as a camera and scanner; card readers such as an IC card reader and a magnetic card reader; and audio input means such as a microphone. Examples of the output device 206 include display devices such as an LED display and a liquid crystal display; audio output devices such as a speaker; a printer; and the like. In this embodiment, the input device 205 and the output device 206 are configured separately, but the input device 205 and the output device 206 may also be configured as an integrated device, such as a touch panel display.

[0078] An example of processing by the service provision program of the present disclosure will be described with reference to FIG. 6. FIG. 6 is a flowchart showing an example of each procedure of the service provision program of the present disclosure. The service provision program of the present disclosure (hereinafter also referred to as the "program of the present disclosure") can be implemented, for example, using the authentication device 10A shown in FIG. 4 or the authentication device 10A provided in place of the authentication device 10 in the hardware configuration of FIG. 2, and the service provision device 20 shown in FIG. 4 or FIG. 5. FIG. 6(A) shows an example of processing by the program using the authentication device 10A, and FIG. 6(B) shows an example of processing by the program using the service provision device 20. In the example of processing by the program using the authentication device 10A of FIG. 6(A), the processing of the transmission unit 14 can be inserted, for example, at any position in the flowchart of FIG. 3 described in the first embodiment, but is preferably inserted after S3 as shown in FIG. 6(A). Note that the program of the present disclosure is not limited to, for example, a program using the device 10A and the device 20. For example, the program of the present disclosure can refer to the description of the method and device of the present disclosure.

[0079] The acquisition unit 11, authentication unit 12, and output unit 13 included in the authentication device 10A perform steps S1 to S3 in the same manner as S1 to S3 in the first embodiment, for example.

[0080] The transmitting unit 14 included in the authentication device 10A transmits the authentication information to the service providing device 20 (S4, transmission step), for example. The authentication information can be, for example, as described above.

[0081] The receiving unit 21 included in the service providing device 20 receives, for example, the authentication information from the authentication device 10A (S21, receiving step).

[0082] The providing unit 22 included in the service providing device 20 determines, for example, based on the authentication information, whether or not the authentication has been granted to the user (S22, providing step).

[0083] For example, when it is determined that the authentication has been granted to the user, the providing unit 22 included in the service providing device 20 provides the service to the user (S22-Yes, providing procedure).

[0084] For example, when it is determined that the authentication has not been granted to the user, the providing unit 22 included in the service providing device 20 does not provide the service to the user (S22-No, providing procedure).

[0085] Furthermore, the providing unit 22 included in the service providing device 20 may determine, for example, based on the availability information, whether or not the user has the authority to use the service. In this case, for example, when it is determined that the user has the authority to use the service, the providing unit 22 included in the service providing device 20 may provide the service to the user. For example, when it is determined that the user does not have the authority to use the service, the providing unit 22 included in the service providing device 20 may not provide the service to the user. Furthermore, for example, when there are multiple service providing devices, the providing unit 22 included in the service providing device 20 may determine, for each of the service providing devices, whether or not the user has the authority to use the service, based on the availability information.

[0086] Furthermore, the providing unit 22 included in the service providing device 20 may determine, for example, based on the condition information, whether the user satisfies the usage conditions of the service. For example, if the providing unit 22 included in the service providing device 20 determines that the user satisfies the usage conditions of the service, the providing unit 22 may provide the service to the user. For example, if the providing unit 22 included in the service providing device 20 determines that the user does not satisfy the usage conditions of the service, the providing unit 22 may not provide the service to the user. Furthermore, for example, if there are multiple service providing devices, the providing unit 22 included in the service providing device 20 may determine, for each service providing device, whether the user satisfies the usage conditions of the service based on the condition information. Examples of the condition information include information regarding the granting of the authentication to the representative user. For example, if there are multiple service providing devices, the condition information may be different usage conditions for each service.

[0087] Furthermore, in the service providing system of the present disclosure, for example, if there are multiple service providing devices, the processes of the acquisition unit 11, authentication unit 12, output unit 13, and transmission unit 14 provided in the authentication device may be executed for each of the service providing devices. The processes of the acquisition unit 11, authentication unit 12, output unit 13, and transmission unit 14 provided in the authentication device may be, for example, as described above. In the service providing system of the present disclosure, for example, an acquisition medium for the user identification information may be installed for each of the service providing devices. In the service providing system of the present disclosure, for example, registration of the user identification information may be managed for each of the service providing devices in a database provided in the authentication device. In the service providing system of the present disclosure, for example, if there are multiple service providing devices, the number of authentication devices for each of the service providing devices may be set to one or two or more. In the latter case, the service providing system of the present disclosure, for example, may or may not correspond to the number of the service providing devices.

[0088] The service is provided to the user (i.e., enjoyed by the user) using, for example, authentication based on the user identification information. The service may be provided in a real space or a virtual space. Examples of the service include authentication services, entry / exit services, and opening / closing services. Examples of the authentication include authentication for payments, distribution of goods, use of terminals such as personal computers, use of websites, use of application software, use of networks, use of systems, use of directories, and use of files. Examples of the entry / exit include entry / exit to a specific location in a real space (e.g., clocking in and out), and entry / exit to a specific location created in a virtual space (e.g., entry / exit to a specific location created in XR (Cross Reality)). Examples of the opening / closing include opening / closing of a security gate, opening / closing of a locker, and opening / closing of a delivery box.

[0089] The provision of the service may be, for example, the provision of at least one of entering a specific location and leaving a specific location. The specific location may be, for example, a specific location in real space or a specific location in virtual space. When the specific location exists in real space, the service providing device may be, for example, a security gate. Examples of the security gate include a flapper type and an arm type. When the specific location exists in virtual space, the service providing device may be, for example, a server that provides the service. Examples of the server include a web server, an application server, a file server, and a database server. Examples of entering the specific location include entering a room, entering a building, entering a facility, going to the hospital, going to the office, entering a store, coming to work, going to school, going to kindergarten, logging in (logging on), signing in (signing on), etc. Examples of leaving the specific location include leaving a room, leaving a building, leaving a facility, leaving a facility, leaving a hospital, leaving an office, leaving a store, leaving work, going home from school, going home from kindergarten, logging out (logging off), signing out (signing off), etc. Examples of the specific location include a room, a conference room, a train station ticket gate, an airport boarding gate, a venue (e.g., an exhibition hall, an exhibition center, etc.), a factory, a construction site, a museum (e.g., an art museum, a library, a movie theater, etc.), a place (e.g., a research institute, a government office, a prison, an evacuation shelter, etc.), a facility (e.g., an entertainment facility, a public facility, a nursing home, a welfare facility, etc.), a parliament, a store, a company, a school, a garden (e.g., a zoo, an amusement park, a kindergarten, a nursery school, etc.). Examples of the specific location include a website, application software, a network, a system, a directory, a file, a location created in a virtual space, etc. According to the present disclosure, for example, only if the user is authenticated, at least one of entering a specific location and exiting a specific location can be provided to the user as a service. Therefore, according to the present disclosure, for example, entry and exit to a specific location can be managed based on whether the user is authenticated.

[0090] For example, when it is determined that the authentication has been granted to the user, the providing unit 22 included in the service providing device 20 may provide the user with at least one of the permission to enter the specific location and the permission to leave the specific location. Furthermore, when it is determined that the authentication has not been granted to the user, the providing unit 22 included in the service providing device 20 may not provide the user with at least one of the permission to enter the specific location and the permission to leave the specific location.

[0091] A service providing method (hereinafter also referred to as the method of the present disclosure) of the present disclosure is a method implemented, for example, by replacing each "procedure" in the program of the present disclosure with a "step." Specifically, the method of the present disclosure includes a receiving step and a providing step. The receiving step receives authentication information from an authentication device. The providing step determines whether a user is authenticated based on the authentication information. If it is determined that the user is authenticated, the service is provided to the user. If it is determined that the user is not authenticated, the service is not provided to the user. The method of the present disclosure can be implemented, for example, using an authentication device 10A shown in FIG. 4 or an authentication device 10A provided in place of the authentication device 10 in the hardware configuration of FIG. 2, and a service providing device 20 shown in FIG. 4 or FIG. 5. Note that the method of the present disclosure is not limited to a method using the device 10A and the device 20. For example, the description of the program and the device of the present disclosure can be used for the method of the present disclosure.

[0092] As described above, according to the service providing system of the present disclosure, a transmitting unit included in an authentication device transmits the authentication information to a service providing device, a receiving unit included in the service providing device receives the authentication information from the authentication device, and a providing unit included in the service providing device determines whether a user has been authenticated based on the authentication information. If it is determined that the user has been authenticated, the system provides the user with a service, and if it is determined that the user has not been authenticated, the system does not provide the user with the service. Therefore, according to the present disclosure, multiple users can be easily registered. Furthermore, according to the present disclosure, for example, a service can be provided to a user only if the user has been authenticated. Therefore, according to the present disclosure, for example, the appropriateness of providing a service to a user can be managed based on whether the user has been authenticated.

[0093] [Embodiment 3] An example of a usage form of the device of the present disclosure will be described below with reference to Fig. 7. In the following description, a case where the service providing device is a security gate will be described as an example, but the present disclosure is not limited to the following description in any way.

[0094] First, as shown in FIG. 7A, when a primary user (a user corresponding to the aforementioned representative user) visits a customer's company with another user (a user corresponding to the aforementioned other user), the primary user performs a registration procedure for entering and exiting the visited facility. Specifically, the primary user launches application software on, for example, a smartphone terminal and starts the registration procedure for entering and exiting the visited facility. The registration procedure for entering and exiting the facility is a procedure for enjoying the service of "passing through a security gate" at, for example, a security gate, which is a service providing device owned by the customer's company. The primary user, for example, enters necessary information (e.g., name, gender, age, telephone number, email address, postal code, address, corporate affiliation, etc.) into the application software. At this time, the primary user, for example, enters information indicating that he or she wishes to have registration rights to the database of the authentication device owned by the customer's company as the input information using a multiple-choice input form or the like into the application software. The primary user, for example, acquires a facial photograph of the primary user's own face using an imaging device provided in the smartphone terminal. The primary user, for example, extracts features from the facial photograph using the application software, then encrypts the features with an encryption key and transmits the encrypted information along with the input items to an authentication device owned by the customer's company. The authentication device, for example, receives the encrypted information from the smartphone terminal, then decrypts the features from the received information with a decryption key and acquires the features as the primary user's user identification information. The authentication device, for example, registers the acquired user identification information together with the input items in a database. At this time, the authentication device, for example, sets the primary user's registration right information to "valid" in the database based on the input items, thereby setting the primary user's user class information to "representative user." Through these settings, the authentication device, for example, registers that the primary user has registration rights.For example, after carrying out this series of processes, the principal user closes the application software on the smartphone terminal and completes the registration procedure regarding entry and exit of the facility where the visitor is staying.

[0095] Next, the principal user, for example, visits the customer's company with the other user and enters the customer's company by passing through the security gate. Specifically, the principal user, for example, visits the customer's company accompanied by the other user. The customer's company has a security gate, which is a service providing device, and a camera, which is an imaging device capable of capturing images of people passing through the security gate, installed at the front entrance. The authentication device is connected to the security gate and the camera, for example, via a wireless communication network, and is capable of communicating with each other. Here, as shown in FIG. 7(B), the camera captures a facial photograph of the principal user as he or she approaches the security gate and transmits the facial photograph to the authentication device. The authentication device, for example, extracts features from the received facial photograph and acquires the features as user identification information. The authentication device, for example, determines whether the acquired user identification information matches user identification information registered in the database to a predetermined degree. The authentication device grants authentication to the principal user by, for example, determining that the acquired user identification information matches user identification information registered in the database to a predetermined degree. At this time, the authentication device, for example, determines whether the principal user who granted the authentication is a "representative user." For example, the authentication device determines that the principal user who granted the authentication has registration rights because, for example, the registration right ownership information of the principal user in the database is "valid" and the user class information of the principal user is "representative user." The authentication device, for example, triggers the granting of authentication to the principal user who is a "representative user" to start a registration process acceptance period for registering user identification information in the database. As shown in FIG. 7(C), for example, the other user moves in front of the security gate within the acceptance period. For example, the camera captures a facial photograph of the other user who moves in front of the security gate and transmits the facial photograph to the authentication device. For example, the authentication device extracts features from the received facial photograph and acquires the features as user identification information.The authentication device, for example, associates the acquired user identification information with the main user, who is a "representative user," and registers it in the database. Specifically, the authentication device, for example, sets the representative user association information of the other users to the main user in the database and sets the user class information of the other users to "member user" in the database. The authentication device, for example, ends the registration acceptance period after the predetermined period has elapsed since the start of the registration acceptance period. The authentication device, for example, determines whether the acquired user identification information of the other users matches, to a predetermined extent, the user identification information registered in the database. The authentication device, for example, grants authentication to the other users by determining that the acquired user identification information of the other users matches, to a predetermined extent, the user identification information registered in the database. As shown in FIG. 7(D), the authentication device, for example, transmits authentication information regarding the granting of each authentication to a security gate, which is a service providing device. The security gate, for example, determines whether authentication has been granted to the main user and the other users based on the received authentication information. For example, the security gate may open the security gate by determining that the principal user and the other users have been authenticated, and provide the principal user and the other users with a service of "passing through the security gate." The principal user and the other users may then pass through the opened security gate, for example, to enter the customer's company.

[0096] According to the present disclosure, multiple users can be easily registered. Furthermore, according to the present disclosure, for example, other users do not need to pre-register for authentication, and authentication registration can be easily performed. Furthermore, according to the present disclosure, for example, a representative user only needs to pre-register for the representative user's own authentication, and authentication registration for other users can be easily performed. Furthermore, according to the present disclosure, for example, a representative user can centrally manage the authentication registration of other users. Therefore, according to the present disclosure, for example, a representative user can prevent other users from fraudulently performing authentication registration.

[0097] Furthermore, according to the present disclosure, for example, a service can be provided to a user only if the user has been authenticated. Therefore, according to the present disclosure, for example, whether or not to provide a service to a user can be managed based on whether or not the user has been authenticated.

[0098] Although the present disclosure has been described above with reference to the embodiments, the present disclosure is not limited to the above-described embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure. Furthermore, each embodiment can be combined with other embodiments as appropriate.

[0099] <Additional Notes> Some or all of the above embodiments can be described as, but not limited to, the following supplementary notes. (Appendix 1) An acquisition procedure, an authentication procedure, and an output procedure are included, the obtaining step obtains user identification information capable of identifying the user; The authentication procedure includes: When the user is authenticated based on the comparison between the user identification information and a database, it is determined whether the user who has been authenticated is a representative user who has the right to register; the registration right is a right to register the user identification information in the database, If it is determined that the user to whom the authentication is granted is the representative user, the user identification information of other users other than the representative user is linked to the representative user and registered in the database, and then authentication is granted to the other users based on a comparison between the user identification information and the database; the output step outputs authentication information regarding the granting of the authentication. An authentication program for causing a computer to execute each of the above procedures. (Appendix 2) the authentication procedure assigns a validity period to the registration of the other user in the database; The certification program described in Appendix 1. (Appendix 3) When the registration of the representative user in the database is invalidated, the authentication procedure invalidating the registrations of the other users associated with the representative user in the database all at once; Certification programs listed in Appendix 1 or 2. (Appendix 4) The authentication procedure determines whether the representative user has been granted the authentication; If it is determined that the representative user has been granted the authentication, the authentication is granted to the other user; and If it is determined that the representative user has not been granted the authentication, the authentication is not granted to the other users. A certification program as set forth in any of Annexes 1 to 3. (Appendix 5) The registration rights are transferable between the users; A certification program as set forth in any of Annexes 1 to 4. (Appendix 6) An authentication device having the authentication program according to any one of Supplementary Notes 1 to 5, and a service providing device, the authentication device includes a transmission unit; the transmitting unit transmits the authentication information to the service providing device; the service providing device includes a receiving unit and a providing unit; the receiving unit receives the authentication information from the authentication device; The providing unit determines whether the authentication is granted to the user based on the authentication information; providing a service to the user if it is determined that the user has been granted the authentication; and If it is determined that the authentication has not been granted to the user, the service is not provided to the user. Service delivery system. (Appendix 7) The provision of the service is provision of at least one of entry into a specific location and exit from a specific location; A service provision system as described in Appendix 6. (Appendix 8) An acquisition unit, an authentication unit, and an output unit, the acquiring unit acquires user identification information capable of identifying a user; The authentication unit When the user is authenticated based on the comparison between the user identification information and a database, it is determined whether the user who has been authenticated is a representative user who has the right to register; the registration right is a right to register the user identification information in the database, If it is determined that the user to whom the authentication is granted is the representative user, the user identification information of other users other than the representative user is linked to the representative user and registered in the database, and then authentication is granted to the other users based on a comparison between the user identification information and the database; the output unit outputs authentication information regarding the granting of the authentication. Authentication device. (Appendix 9) the authentication unit assigns a validity period to the registration of the other user in the database; 9. The authentication device of claim 8. (Appendix 10) When the authentication unit invalidates the registration of the representative user in the database, invalidating the registrations of the other users associated with the representative user in the database all at once; 10. The authentication device of claim 8 or 9. (Appendix 11) the authentication unit determines whether the representative user has been granted the authentication; If it is determined that the representative user has been granted the authentication, the authentication is granted to the other user; and If it is determined that the representative user has not been granted the authentication, the authentication is not granted to the other users. 11. An authentication device according to any one of appendices 8 to 10. (Appendix 12) The registration rights are transferable between the users; 12. An authentication device according to any one of appendices 8 to 11. (Appendix 13) An authentication device and a service providing device according to any one of Supplementary Notes 8 to 12, the authentication device includes a transmission unit; the transmitting unit transmits the authentication information to the service providing device; the service providing device includes a receiving unit and a providing unit; the receiving unit receives the authentication information from the authentication device; The providing unit determines whether the authentication is granted to the user based on the authentication information; providing a service to the user if it is determined that the user has been granted the authentication; and If it is determined that the authentication has not been granted to the user, the service is not provided to the user. Service delivery system. (Appendix 14) The provision of the service is provision of at least one of entry into a specific location and exit from a specific location; 13. A service provision system as described in Appendix 13. (Appendix 15) The method includes an acquisition step, an authentication step, and an output step, the acquiring step acquires user identification information that can identify the user; The authentication step includes: When the user is authenticated based on the comparison between the user identification information and a database, it is determined whether the user who has been authenticated is a representative user who has the right to register; the registration right is a right to register the user identification information in the database, If it is determined that the user to whom the authentication is granted is the representative user, the user identification information of other users other than the representative user is linked to the representative user and registered in the database, and then authentication is granted to the other users based on a comparison between the user identification information and the database; The output step outputs authentication information regarding the granting of the authentication. An authentication method in which each of the steps is performed by a computer. (Appendix 16) the authentication step includes assigning a validity period to the registration of the other user in the database; The authentication method described in Appendix 15. (Appendix 17) When the registration of the representative user in the database is invalidated, the authentication step invalidating the registrations of the other users associated with the representative user in the database all at once; The authentication method described in Appendix 15 or 16. (Appendix 18) The authentication step determines whether the representative user has been granted the authentication, If it is determined that the representative user has been granted the authentication, the authentication is granted to the other user; and If it is determined that the representative user has not been granted the authentication, the authentication is not granted to the other users. 18. The authentication method according to any one of appendices 15 to 17. (Appendix 19) The registration rights are transferable between the users; 19. The authentication method according to any one of appendices 15 to 18. (Appendix 20) An authentication device that performs the authentication method according to any one of Supplementary Notes 15 to 19, and a service providing device; the authentication device includes a transmission unit; the transmitting unit transmits the authentication information to the service providing device; the service providing device includes a receiving unit and a providing unit; the receiving unit receives the authentication information from the authentication device; The providing unit determines whether the authentication is granted to the user based on the authentication information; providing a service to the user if it is determined that the user has been granted the authentication; and If it is determined that the authentication has not been granted to the user, the service is not provided to the user. Service delivery system. (Appendix 21) The provision of the service is provision of at least one of entry into a specific location and exit from a specific location; 20. A service provision system as described in Appendix 20. (Appendix 22) An acquisition procedure, an authentication procedure, and an output procedure are included, the obtaining step obtains user identification information capable of identifying the user; The authentication procedure includes: When the user is authenticated based on the comparison between the user identification information and a database, it is determined whether the user who has been authenticated is a representative user who has the right to register; the registration right is a right to register the user identification information in the database, If it is determined that the user to whom the authentication is granted is the representative user, the user identification information of other users other than the representative user is linked to the representative user and registered in the database, and then authentication is granted to the other users based on a comparison between the user identification information and the database; the output step outputs authentication information regarding the granting of the authentication. A computer-readable recording medium on which an authentication program for causing a computer to execute each of the above procedures is recorded. (Appendix 23) the authentication procedure assigns a validity period to the registration of the other user in the database; 23. The recording medium according to claim 22. (Appendix 24) When the registration of the representative user in the database is invalidated, the authentication procedure invalidating the registrations of the other users associated with the representative user in the database all at once; 24. A recording medium according to claim 22 or 23. (Appendix 25) The authentication procedure determines whether the representative user has been granted the authentication; If it is determined that the representative user has been granted the authentication, the authentication is granted to the other user; and If it is determined that the representative user has not been granted the authentication, the authentication is not granted to the other users. 25. A recording medium according to any one of appendices 22 to 24. (Appendix 26) The registration rights are transferable between the users; 26. A recording medium according to any one of appendices 22 to 25. (Appendix 27) An authentication device having a recording medium according to any one of Supplementary Notes 22 to 26, and a service providing device, the authentication device includes a transmission unit; the transmitting unit transmits the authentication information to the service providing device; the service providing device includes a receiving unit and a providing unit; the receiving unit receives the authentication information from the authentication device; The providing unit determines whether the authentication is granted to the user based on the authentication information; providing a service to the user if it is determined that the user has been granted the authentication; and If it is determined that the authentication has not been granted to the user, the service is not provided to the user. Service delivery system. (Appendix 28) The provision of the service is provision of at least one of entry into a specific location and exit from a specific location; 2. A service provision system as set forth in Appendix 27. [Industrial Applicability]

[0100] According to the present disclosure, it is possible to easily register multiple users. Therefore, the present disclosure can be widely and usefully applied in various fields that utilize authentication. [Explanation of symbols]

[0101] 10, 10A authentication device 20 Service providing device 11 Acquisition Department 12 Authentication Section 13 Output section 14 Transmitter 21 Receiving unit 22 Providing Department 30 Communication Network 100 Service Delivery System 101, 201 Central processing unit 102, 202 memory Buses 103 and 203 104, 204 Storage device 105, 205 Input device 106, 206 Output device 107, 207 Communication devices

Claims

1. An acquisition procedure, an authentication procedure, and an output procedure are included, the obtaining step obtains user identification information capable of identifying the user; The authentication procedure includes: When the user is authenticated based on the comparison between the user identification information and a database, it is determined whether the user who has been authenticated is a representative user who has the right to register; the registration right is a right to register the user identification information in the database, If it is determined that the user to whom the authentication is granted is the representative user, the user identification information of other users other than the representative user is linked to the representative user and registered in the database, and then authentication is granted to the other users based on a comparison between the user identification information and the database; the output step outputs authentication information regarding the granting of the authentication. An authentication program for causing a computer to execute each of the above procedures.

2. the authentication procedure assigns a validity period to the registration of the other user in the database; The authentication program according to claim 1 .

3. When the registration of the representative user in the database is invalidated, the authentication procedure invalidating the registrations of the other users associated with the representative user in the database all at once; The authentication program according to claim 1 .

4. The authentication procedure determines whether the representative user has been granted the authentication; If it is determined that the representative user has been granted the authentication, the authentication is granted to the other user; and If it is determined that the representative user has not been granted the authentication, the authentication is not granted to the other users. The authentication program according to claim 1 .

5. The registration rights are transferable between the users; The authentication program according to claim 1 .

6. An authentication device having the authentication program according to any one of claims 1 to 5, and a service providing device, the authentication device includes a transmission unit; the transmitting unit transmits the authentication information to the service providing device; the service providing device includes a receiving unit and a providing unit; the receiving unit receives the authentication information from the authentication device; The providing unit determines whether the authentication is granted to the user based on the authentication information; providing a service to the user if it is determined that the user has been granted the authentication; and If it is determined that the authentication has not been granted to the user, the service is not provided to the user. Service delivery system.

7. The provision of the service is provision of at least one of entry into a specific location and exit from a specific location; The service providing system according to claim 6.

8. An acquisition unit, an authentication unit, and an output unit, the acquiring unit acquires user identification information capable of identifying a user; The authentication unit When the user is authenticated based on the comparison between the user identification information and a database, it is determined whether the user who has been authenticated is a representative user who has the right to register; the registration right is a right to register the user identification information in the database, If it is determined that the user to whom the authentication is granted is the representative user, the user identification information of other users other than the representative user is linked to the representative user and registered in the database, and then authentication is granted to the other users based on a comparison between the user identification information and the database; the output unit outputs authentication information regarding the granting of the authentication. Authentication device.

9. The method includes an acquisition step, an authentication step, and an output step, the acquiring step acquires user identification information that can identify the user; The authentication step includes: When the user is authenticated based on the comparison between the user identification information and a database, it is determined whether the user who has been authenticated is a representative user who has the right to register; the registration right is a right to register the user identification information in the database, If it is determined that the user to whom the authentication is granted is the representative user, the user identification information of other users other than the representative user is linked to the representative user and registered in the database, and then authentication is granted to the other users based on a comparison between the user identification information and the database; The output step outputs authentication information regarding the granting of the authentication. An authentication method in which each of the steps is performed by a computer.

10. An acquisition procedure, an authentication procedure, and an output procedure are included, the obtaining step obtains user identification information capable of identifying the user; The authentication procedure includes: When the user is authenticated based on the comparison between the user identification information and a database, it is determined whether the user who has been authenticated is a representative user who has the right to register; the registration right is a right to register the user identification information in the database, If it is determined that the user to whom the authentication is granted is the representative user, the user identification information of other users other than the representative user is linked to the representative user and registered in the database, and then authentication is granted to the other users based on a comparison between the user identification information and the database; the output step outputs authentication information regarding the granting of the authentication. A computer-readable recording medium on which an authentication program for causing a computer to execute each of the above procedures is recorded.

Images