Information processing device, information processing method, and program

Abstract

To provide technology that can prevent user registration and authentication from becoming cumbersome. [Solution] An information processing device is provided, comprising: a storage unit that stores management information associated with user identification information generated from the user's biometric information and the user information of the user; an acquisition unit that acquires the biometric information of a first user; a generation unit that generates first user identification information from the biometric information of the first user; a verification unit that checks whether the first user identification information corresponds to the user identification information included in the management information; and a processing unit that, if the first user identification information corresponds to the user identification information, acquires the user information associated with the user identification information from the management information and performs processing based on the user information.

Description

Technical Field

[0001] The present invention relates to an information processing apparatus, an information processing method, and a program.

Background Art

[0002] Currently, systems using biometric authentication are widely used. In biometric authentication, two methods are known: one is called one-to-one authentication, which requires input of a user ID; the other is called one-to-N authentication, which does not require input of a user ID and allows the server side to identify the user ID based on biometric information. For example, Patent Document 1 discloses a high-speed one-to-N authentication system and one-to-N authentication method with few errors.

Prior Art Literature

Patent Literature

[0003]

Patent Document 1

Summary of the Invention

Problem to be Solved by the Invention

[0004] However, when performing biometric authentication, it is necessary to either have the user input a user ID or identify the user ID based on biometric information. Furthermore, since user IDs are consciously used by users, it is necessary to limit the number of digits to a certain range in consideration of the balance with convenience. Therefore, there is a problem that the number of users that can be registered in the system is limited to the number of possible user IDs.

[0005] Therefore, an object of the present invention is to provide a technology capable of suppressing complication of user registration and authentication.

Means for Solving the Problem

[0006] An information processing device according to one aspect of the present invention includes: a storage unit that stores management information in which user identification information generated from the user's biometric information is associated with the user information of the user; an acquisition unit that acquires the biometric information of a first user; a generation unit that generates first user identification information from the biometric information of the first user; a verification unit that checks whether the first user identification information corresponds to the user identification information included in the management information; and a processing unit that, if the first user identification information corresponds to the user identification information, acquires the user information associated with the user identification information from the management information and performs processing based on the user information. [Effects of the Invention]

[0007] According to the present invention, it is possible to suppress the complexity of user registration and authentication. [Brief explanation of the drawing]

[0008] [Figure 1] This figure shows an example configuration of the information processing system according to this embodiment. [Figure 2] This figure shows an example of the hardware configuration of an information processing device, a user terminal, a service reception device, and a service provision device. [Figure 3] This figure shows an example of the functional block configuration of an information processing device. [Figure 4] This figure shows an example of management information. [Figure 5] This figure shows an example of the functional block configuration of a user terminal. [Figure 6] This figure shows an example of the functional block configuration of a service reception device. [Figure 7] This is a sequence diagram showing an example of the processing steps involved in user registration. [Figure 8] This is a sequence diagram showing an example of the processing procedure when using a registered service. [Modes for carrying out the invention]

[0009] Embodiments of the present invention will be described with reference to the attached drawings. In each drawing, components with the same reference numerals have the same or similar configurations.

[0010] <System Configuration> Figure 1 shows an example configuration of an information processing system according to this embodiment. As shown in Figure 1, the information processing system 1 includes an information processing device 10, one or more user terminals 20, one or more service reception devices 30, and one or more service provision devices 40. The information processing device 10 provides an authentication infrastructure using biometric information for various services provided by the service provision devices 40.

[0011] The information processing device 10 calculates user identification information from the user's biometric information and uses the calculated user identification information as the user ID (Identifier). It also identifies the services used by the user and stores the necessary information for using those services (hereinafter referred to as "service usage information") in a database. The user identification information may also be called a template. The information processing device 10 may consist of one or more physical servers, or it may be configured using a virtual server operating on a hypervisor, or it may be configured using a cloud server.

[0012] User terminal 20 is a device used by the user, such as a smartphone, tablet, or personal computer.

[0013] The service reception device 30 is a device that accepts requests for services provided by the service provision device 40. Examples of the service reception device 30 include, but are not limited to, a POS (Point of Sales) terminal installed in a store, a parking fee collection system, a public power supply spot, a toll collection system for toll roads, an information terminal in the city or facility, etc. Any device that accepts requests for services provided by the service provision device 40 may be used.

[0014] The service providing device 40 is a device that provides services to a user. The services provided by the service providing device 40 include any type of service, and examples thereof include a payment service, a point service, a parking service, a charging service, an information providing service, and the like.

[0015] When the information processing device 10 acquires a user's biometric information from a user terminal 20 or a service reception device 30, the information processing device 10 generates user identification information from the acquired biometric information, and collates the generated user identification information with one or more pieces of user identification information registered in a database. As a result of the collation, when there is one matching user identification information, the information processing device 10 provides the user with a service associated with the user identification information.

[0016] In the conventional art, a user ID and a template used for biometric authentication are managed in association with each other, and it has been common to have a user input the user ID before performing biometric authentication, or to provide a service after specifying the user ID from biometric information acquired from the user. On the other hand, in the present embodiment, since the information processing device 10 uses the user identification information as a user ID as it is, there is no need to have the user input the user ID or specify the user ID when collating (authenticating) biometric information. This makes it possible to suppress complication of user registration and authentication.

[0017] <Hardware Configuration> FIG. 2 is a diagram showing an example hardware configuration of an information processing apparatus 10, a user terminal 20, a service reception apparatus 30, and a service providing apparatus 40. The information processing apparatus 10, the user terminal 20, the service reception apparatus 30, and the service providing apparatus 40 each include a processor 11 such as a CPU (Central Processing Unit) or a GPU (Graphics Processing Unit), a memory (e.g., RAM (Random Access Memory) or ROM (Read Only Memory)), a storage device 12 such as an HDD (Hard Disk Drive) and / or an SSD (Solid State Drive), a communication IF (Interface) 13 for performing wired or wireless communication, an input device 14 for receiving an input operation, and an output device 15 for outputting information. The input device 14 is, for example, a keyboard, a touch panel, a mouse and / or a microphone. The output device 15 is, for example, a display, a touch panel and / or a speaker.

[0018] <Functional Block Configuration> (Information Processing Apparatus) FIG. 3 is a diagram showing an example functional block configuration of the information processing apparatus 10. The information processing apparatus 10 includes a storage unit 100, an acquisition unit 101, a generation unit 102, a management unit 103, a collation unit 104, and a processing unit 105. The storage unit 100 can be implemented using the storage device 12 included in the information processing apparatus 10. Further, the acquisition unit 101, the generation unit 102, the management unit 103, the collation unit 104, and the processing unit 105 can be implemented by the processor 11 of the information processing apparatus 10 executing a program stored in the storage device 12. Furthermore, the program can be stored in a storage medium. The storage medium storing the program may be a non-transitory computer-readable medium. The non-transitory storage medium is not particularly limited, and may be, for example, a storage medium such as a USB (Universal Serial Bus) memory or a CD-ROM (Compact Disc Read-Only Memory).

[0019] The storage unit 100 stores management information 100a, in which user identification information generated from the user's biometric information is associated with user information. The user information may also include service usage information related to the services used by the user.

[0020] Figure 4 shows an example of management information 100a. Management information 100a manages user identification information and user information in association. User information includes "user-specific information," which is the user's name, address, age, and / or various data about the user, and "service usage information," which is information necessary to uniquely identify the services used by the user and to use those services. Service usage information may include, for example, the service name, information necessary to access the service provider 40 (address information, protocol information, etc.), and information used by the service provider 40 to provide the service (for example, the user's account number, etc.). User information may also include multiple service usage information. For example, in the example in Figure 4, the service usage information for Ichiro Sato includes service usage information for service A and service usage information for service B. Return to Figure 3 and continue the explanation.

[0021] The acquisition unit 101 acquires the biometric information and user information of the user performing user registration. The acquisition unit 101 also acquires the biometric information of the user (first user). For example, the acquisition unit 101 may acquire the biometric information of the user to be matched (first user) from another information processing device (e.g., user terminal 20 or service reception device 30) that requests verification of user identification information.

[0022] The generation unit 102 generates user identification information from the biometric information of the user performing user registration. The generation unit 102 also generates user identification information (first user identification information) from the biometric information of the user to be matched.

[0023] The management unit 103 associates the user identification information and user information of the user registering, which were generated by the generation unit 102, and stores them in the management information 100a.

[0024] The matching unit 104 checks whether the user identification information of the user to be matched, generated by the generation unit 102, corresponds to the user identification information contained in the management information 100a.

[0025] If the user identification information of the user to be matched corresponds to the user identification information contained in the management information 100a, the processing unit 105 retrieves the user information associated with that user identification information from the management information 100a and performs various processes based on the retrieved user information. Furthermore, if the user identification information of the user to be matched corresponds to the user identification information contained in the management information 100a, the processing unit 105 performs various processes related to the services used by the user based on the service usage information associated with that user identification information.

[0026] (User terminal) Figure 5 shows an example of the functional block configuration of a user terminal 20. The user terminal 20 includes a storage unit 200, an acquisition unit 201, a transmission unit 202, and a reception unit 203. The storage unit 200 can be implemented using a storage device 12 provided by the user terminal 20. The acquisition unit 201, the transmission unit 202, and the reception unit 203 can be implemented by the processor 11 of the user terminal 20 executing a program stored in the storage device 12. This program can be stored in a storage medium. The storage medium on which the program is stored may be a computer-readable non-temporary storage medium. The non-temporary storage medium is not particularly limited, but may be, for example, a USB memory or a CD-ROM.

[0027] The storage unit 200 stores various information necessary for the user terminal 20 to perform the processing according to this embodiment.

[0028] The acquisition unit 201 acquires biometric information and user information from the user performing user registration. The acquisition unit 201 also acquires biometric information from the user to be matched.

[0029] The transmission unit 202 transmits the biometric information and user information of the user performing user registration to the information processing device 10. The transmission unit 202 also transmits the biometric information of the user to be matched to the information processing device 10.

[0030] The receiving unit 203 receives various types of data from the information processing device 10. For example, the receiving unit 203 receives information from the information processing device 10 such as the results of verifying the user's biometric information and information regarding whether or not the service is available.

[0031] The generation unit 204 generates user identification information from the user's biometric information. Note that if the user identification information is generated on the information processing device 10 side, the user terminal 20 does not need to be equipped with the generation unit 204.

[0032] (Service reception device) Figure 6 shows an example of the functional block configuration of the service reception device 30. The service reception device 30 includes a storage unit 300, an acquisition unit 301, a transmission unit 302, and a receiving unit 303. The storage unit 300 can be implemented using a storage device 12 provided by the service reception device 30. The acquisition unit 301, the transmission unit 302, and the receiving unit 303 can be implemented by the processor 11 of the user terminal 20 executing a program stored in the storage device 12. This program can be stored in a storage medium. The storage medium on which the program is stored may be a computer-readable non-temporary storage medium. The non-temporary storage medium is not particularly limited, but may be, for example, a USB memory or a CD-ROM.

[0033] The storage unit 300 stores various information necessary for the service reception device 30 to perform the processing according to this embodiment.

[0034] The acquisition unit 301 acquires biometric information and user information from the user performing user registration. The acquisition unit 301 also acquires biometric information from the user to be matched.

[0035] The transmission unit 302 transmits the biometric information and user information of the user performing user registration to the information processing device 10. The transmission unit 302 also transmits the biometric information of the user to be matched to the information processing device 10.

[0036] The receiving unit 303 receives various types of data from the information processing device 10. For example, the receiving unit 303 receives information from the information processing device 10 such as the results of verifying the user's biometric information and information regarding whether or not the service is available.

[0037] The generation unit 304 generates user identification information from the user's biometric information. Note that if the user identification information is generated on the information processing device 10 side, the service reception device 30 does not need to have the generation unit 304.

[0038] <Processing Procedure> (User registration) Figure 7 is a sequence diagram showing an example of the processing steps involved in user registration. In step S10, the acquisition unit 201 of the user terminal 20 acquires the biometric information of the user performing user registration. Examples of biometric information include the user's appearance, facial image, fingerprints, palm print, vein patterns, voice, behavior, iris, ocular blood vessels, ear shape, and DNA. The acquisition unit 201 also acquires user-specific information (name, age, address, gender, etc.) from the user. Furthermore, the acquisition unit 201 acquires service usage information for the service the user wishes to use, including the service name, information necessary to access the service provider 40 (address information, protocol information, etc.), and information used by the service provider 40 to provide the service (e.g., the user's account number, etc.). Note that inputting the information necessary to access the service provider 40 is not mandatory. This information may be pre-configured for each service in the information processing device 10.

[0039] In step S11, the transmission unit 202 of the user terminal 20 sends a registration request message to the information processing device 10. The registration request message includes the user's biometric information, user-specific information, and service usage information entered in the processing procedure of step S10.

[0040] In step S12, the acquisition unit 101 of the information processing device 10 receives a registration request message from the user terminal 20. The generation unit 102 generates user identification information from the biometric information contained in the registration request message. The user identification information (and the first user identification information as well) may be, for example, the feature quantities generated from the biometric information themselves, or data obtained by processing the generated feature quantities according to a predetermined method. The generation unit 102 may also generate user identification information using an API (Application Programming Interface) provided by a third party. The user identification information may be represented as numerical data or as text data. Furthermore, the user identification information may be all or part of the data obtained by converting the text data or binary data according to a predetermined method (e.g., encryption or hashing).

[0041] In step S13, the management unit 103 sends a message to the user terminal 20 requesting identity verification data.

[0042] In step S14, the acquisition unit 201 of the user terminal 20 acquires identity verification data from the user. The transmission unit 202 then transmits the acquired identity verification data to the information processing device 10. The identity verification data may be, for example, an image of a driver's license, student ID, or employee ID that contains the user's facial photograph and user-specific information (name and address, etc.).

[0043] In step S15, the management unit 103 verifies the user's identity based on the identity verification data received from the user terminal 20. Note that when user registration as shown in Figure 7 is performed at a store, the processing steps in steps S14 and S15 may be performed by a store employee or other person verifying the user's identity using a driver's license or similar document. Furthermore, when user registration as shown in Figure 7 is performed online, the processing steps in steps S14 and S15 may be performed automatically or by an administrator or other person in accordance with a method called eKYC (electronic Know Your Customer). User identity verification may also be performed using public personal authentication, verification of certificates using a digital identity wallet (DIW), electronic certificate data, digital driver's license, digital student ID, digital employee ID, etc., or verification of user attribute information or user employment with financial institutions or other organizations.

[0044] In step S16, if the user's identity verification is completed, the management unit 103 stores the user identification information, user-specific information, and service usage information in the management information 100a. On the other hand, if the user's identity verification is not completed, the management unit 103 terminates the process without storing the user identification information, etc., in the management information 100a.

[0045] In step S17, the management unit 103 sends a registration completion message to the user terminal 20.

[0046] Furthermore, if user registration is performed at a store counter or similar location, the processing procedure described above may be performed by the service reception device 30 instead of the user terminal 20.

[0047] Alternatively, the process of generating user identification information from the user's biometric information may be performed by the generation unit 204 of the user terminal 20. The method for generating user identification information may be the same as the method described in the processing procedure of step S12. In this case, the transmission unit 202 may transmit user identification information to the information processing device 10 instead of biometric information in the processing procedure of step S11.

[0048] Furthermore, if the user's identity verification data includes biometric information, in the processing procedure of step S11, the user terminal 20 may transmit identity verification data including biometric information (or biometric information and user-specific information). Also, the acquisition unit 101 of the information processing device 10 may acquire the user's biometric information (or biometric information and user-specific information) included in the identity verification data. Also, in the processing procedure of step S12, the generation unit 102 may generate user identification information from the biometric information included in the identity verification data. Also, in the processing procedure of step S16, the management unit 103 may store the user identification information, user-specific information, and service usage information generated from the biometric information included in the identity verification data in the management information 100a. Also, the processing procedures of steps S13 and S14 may be omitted. The generated information included in the identity verification data is arbitrary, but examples include facial photographs on official documents (driver's license, My Number card, etc.), biometric information recorded on an IC chip, and biometric information obtainable from DIW.

[0049] Furthermore, in this embodiment, in addition to verifying biometric information, user possession authentication and knowledge authentication may also be performed. In this case, the acquisition unit 101 of the user terminal 20 may acquire information from the user regarding the device used for possession authentication (for example, the phone number and email address of the user terminal 20) and information used for knowledge authentication (for example, a PIN or password) and transmit it to the information processing device 10. The management unit 103 of the information processing device 10 may also register the acquired information regarding the device used for possession authentication and the information used for knowledge authentication in the "user information" of the management information 100a.

[0050] (Service usage) Figure 8 is a sequence diagram showing an example of the processing procedure when using a registered service. The processing procedure shown in Figure 8 assumes that a user is using a service registered during user registration at a store or similar location, but it is not necessarily limited to this. For example, it can also be applied when using a service remotely using a user terminal 20. In this case, it can be achieved by replacing the service reception device 30 with the user terminal 20 in the sequence shown in Figure 8.

[0051] In step S20, the acquisition unit 301 of the service reception device 30 acquires the biometric information of the user who wishes to use the service (the user to be verified). The biometric information acquired is the same as the biometric information used by the user to be verified when registering as a user.

[0052] In step S21, the transmission unit 302 transmits the acquired biological information to the information processing device 10.

[0053] In step S22, the generation unit 102 of the information processing device 10 generates user identification information from the biometric information acquired from the service reception device 30. The method for generating user identification information is the same as the processing procedure in step S12 of Figure 7, so an explanation is omitted.

[0054] In step S23, the matching unit 104 compares the user identification information of the user to be matched, generated in step S22, with the "user identification information" contained in the management information 100a. Specifically, the matching unit 104 sequentially checks whether there is "user identification information" corresponding to the user identification information of the user to be matched among the one or more "user identification information" contained in the management information 100a. Existing algorithms may be used for matching the user identification information. For example, the matching unit 104 may perform the matching of the user identification information by checking whether the range of fluctuations appearing in the user identification information generated from biometric information is within a predetermined range.

[0055] Furthermore, the matching unit 104 may perform the matching using a learning model that has been trained to have the ability to match the user identification information of the user to be matched with the user identification information contained in the management information 100a. For example, the matching unit 104 may perform the matching by inputting the user identification information of the user to be matched and each user identification information registered in the management information 100a into the learning model. Alternatively, the matching unit 104 may perform the matching of user identification information using an API provided by a third party.

[0056] The matching unit 104 determines that the matching is successful if there is one or more "user identification information" in the management information 100a that corresponds to the user identification information of the user being matched. On the other hand, if there is no "user identification information" in the management information 100a that corresponds to the user identification information of the user being matched, or if there are multiple such "user identification information", the matching is deemed to have failed.

[0057] In step S24, the matching unit 104 transmits the user identification information matching result to the service reception device 30.

[0058] In step S25, if the user identification information is successfully verified, the processing unit 105 executes processing related to the service specified in the "service usage information" associated with the verified "user identification information". For example, if the specified service is a payment service, the processing unit 105 may request the payment service provider's service provider device 40 to verify the validity of the user's account information and to deduct the payment amount from the user's account. On the other hand, if the user identification information verification fails, no processing related to the service is executed.

[0059] In the processing procedure described above, if the information processing device 10 succeeds in verifying the biometric information, it may further perform user possession authentication or knowledge authentication. For example, when performing possession authentication, the verification unit 104 may, after the processing procedure in step S23, use information about the device used for possession authentication to transmit authentication information (passcode) to the device. Alternatively, if the authentication information entered by the user into the service reception device 30 matches the authentication information transmitted to the device used for possession authentication, the verification unit 104 may consider the verification of user identification information to be successful and proceed to the processing procedure in step S24.

[0060] Furthermore, when performing knowledge authentication, the matching unit 104 may, after the processing procedure in step S23, inquire from the user via the service reception device 30 about the information to be used for knowledge authentication. Alternatively, if the information to be used for knowledge authentication entered by the user into the service reception device 30 matches the information to be used for knowledge authentication stored in the management information 100a, the matching unit 104 may consider the user identification information to have been successfully verified and proceed to the processing procedure in step S24.

[0061] (modified version) If the user identification information of the user to be matched corresponds to the user identification information contained in the management information 100a, the processing unit 105 of the information processing device 10 may query the service reception device 30 (another information processing device) to select which service to process from among the multiple "service usage information" contained in the user information obtained from the management information 100a. Alternatively, the processing unit 105 may perform processing related to the service selected by the user at the service reception device 30. This makes it possible to associate multiple services with user identification information and allow the user to select which service to use.

[0062] <Summary> According to the embodiment described above, the information processing device 10 uses user identification information generated from the user's biometric information as a user ID. This makes it possible to provide a technology that can suppress the complexity of user registration and authentication.

[0063] The embodiments described above are provided to facilitate understanding of the present invention and are not intended to limit its interpretation. The flowcharts, sequences, elements, and their arrangement, materials, conditions, shapes, and sizes described in the embodiments are not limited to those exemplified and can be modified as appropriate. Furthermore, configurations shown in different embodiments can be partially substituted or combined. [Explanation of Symbols]

[0064] 1 Information processing system, 10 Information processing device, 11 Processor, 12 Storage device, 13 Communication interface, 14 Input device, 15 Output device, 20 User terminal, 30 Service reception device, 40 Service provision device, 100 Storage unit, 101 Acquisition unit, 102 Generation unit, 103 Management unit, 104 Verification unit, 105 Processing unit, 200 Storage unit, 201 Acquisition unit, 202 Transmission unit, 203 Receiving unit, 300 Storage unit, 301 Acquisition unit, 302 Transmission unit, 303 Receiving unit

Claims

1. A storage unit that stores management information in which user identification information generated from the user's biometric information is associated with the user information of the said user, An acquisition unit that acquires the biometric information of the first user, A generation unit that generates first user identification information from the first user's biometric information, A matching unit that checks whether the first user identification information corresponds to the user identification information included in the management information, When the first user identification information corresponds to the user identification information, a processing unit obtains the user information associated with the user identification information from the management information and performs processing based on the user information, An information processing device having

2. The acquisition unit acquires the user's biometric information and the user's user information. The generation unit generates user identification information for the user from the user's biometric information. A management unit that stores the user identification information and the user information in association with each other in the management information, The information processing apparatus according to claim 1.

3. The user information includes service usage information relating to the services used by the user, When the first user identification information corresponds to the user identification information included in the management information, the processing unit performs processing related to the services used by the user based on the service usage information included in the user information. The information processing apparatus according to claim 1.

4. The user information includes multiple service usage information relating to the services used by the first user, The aforementioned processing unit, If the first user identification information of the first user corresponds to the user identification information included in the management information, the process involves querying another information processing device for the selection of the service to be processed from among the multiple service usage information included in the user information. The other information processing device performs processing related to the service selected by the aforementioned information processing device. The information processing apparatus according to claim 1.

5. The user identification information and the first user identification information are feature quantities generated from the user's biometric information, or data obtained by processing the generated feature quantities according to a predetermined method. The information processing apparatus according to claim 1.

6. When the user's identity verification is completed based on the user's identity verification data, the management unit stores the user identification information and the user information in the management information. The information processing apparatus according to claim 2.

7. The user's identity verification data includes the user's biometric information. The acquisition unit acquires the user's biometric information included in the identity verification data. The information processing apparatus according to claim 2.

8. An information processing method performed by an information processing device, A step of storing management information in a storage unit, in which user identification information generated from the user's biometric information and the user information of the said user are associated; Steps include acquiring the biometric information of the first user, The steps include generating first user identification information from the first user's biometric information, A step of verifying whether the first user identification information corresponds to the user identification information included in the management information, If the first user identification information corresponds to the user identification information, the steps include obtaining the user information associated with the user identification information from the management information and performing processing based on the user information, Information processing methods including

9. On the computer, A step of storing management information in a storage unit, in which user identification information generated from the user's biometric information and the user information of the said user are associated; Steps include acquiring the biometric information of the first user, The steps include generating first user identification information from the first user's biometric information, A step of verifying whether the first user identification information corresponds to the user identification information included in the management information, If the first user identification information corresponds to the user identification information, the steps include obtaining the user information associated with the user identification information from the management information and performing processing based on the user information, A program to execute.

Images