Server device, system, server device control method and computer program

Abstract

To provide a server device that can detect the occurrence of wrong authentication in biometric authentication.SOLUTION: A server device receives an authentication request including biological information on a person to be authenticated from, of a plurality of terminals, a terminal that acquires the biological information on the person to be authenticated, and performs biometric authentication using the biological information on the person to be authenticated and biological information on a plurality of users registered in advance. The server device outputs, for an authentication successful person who has been authenticated successfully in biometric authentication, the biological information on the users registered in advance and authentication result detail information for every terminal including the biological information acquired by a terminal that has transmitted the authentication request, in association with each other.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a server device, a system, a control method for a server device, and a storage medium. [Background technology]

[0002] Immigration inspections are carried out at airports, ports, etc. The immigration officer in charge of the inspection compares the face photograph affixed to the passport with the face of the person in front of them, and if the facial image in the passport matches the face of the person in front of them, he or she is allowed to enter or leave the country.

[0003] Technological development is underway to use biometric authentication for the above-mentioned immigration procedures.

[0004] For example, the movement monitoring method described in U.S. Pat. No. 6,399,633 acquires biometric data and associated identification data of an individual at a first point in a person's movement path from a public area to a secure area. The movement monitoring method acquires biometric data and associated identification data of the individual at a second point in the secure area. The movement monitoring method compares the identification data acquired at the second point with that acquired at the first point. Furthermore, the movement monitoring method compares, if there is a match, an associated image acquired at the first point with an associated image acquired at the second point for the matching identification data.

[0005] Patent Document 2 describes that it provides a technology that can estimate the effect of measures to improve accuracy in advance and present it to managers. [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Special Publication No. 2007-506159 [Patent Document 2] JP 2014-081796 A Summary of the Invention [Problem to be solved by the invention]

[0007] As disclosed in Patent Documents 1 and 2, various technologies related to biometric authentication have been developed. However, there is a limit to the accuracy of biometric authentication, and a certain percentage of erroneous authentication (acceptance of a false person, rejection of the person in question) may occur. If an erroneous authentication occurs during procedures at an airport, it may take time to correct the erroneous authentication, or the user may leave the country on the wrong plane.

[0008] A primary object of the present invention is to provide a server device, a system, a method for controlling a server device, and a storage medium that contribute to making it possible to detect the occurrence of erroneous authentication (particularly false acceptance) in biometric authentication. [Means for solving the problem]

[0009] According to a first aspect of the present invention, there is provided a server device comprising: a receiving unit that receives an authentication request including biometric information of a person to be authenticated from a terminal among a plurality of terminals that has acquired the biometric information of the person to be authenticated; an authentication unit that performs biometric authentication using the biometric information of the person to be authenticated and the biometric information of each of a plurality of users that have been pre-registered; and a storage unit that, for a person who has succeeded in the biometric authentication, corresponds and stores the pre-registered biometric information and authentication result detail information including details when the authentication request was processed, the information including the biometric information acquired by the terminal that is the sender of the authentication request.

[0010] According to a second aspect of the present invention, there is provided a system including a plurality of terminals and a server device connected to the plurality of terminals, wherein the server device comprises: a receiving unit that receives an authentication request including the biometric information of a person to be authenticated from a terminal among the plurality of terminals that has acquired the biometric information of the person to be authenticated; an authentication unit that performs biometric authentication using the biometric information of the person to be authenticated and the biometric information of each of a plurality of users that have been registered in advance; and a memory unit that, for a person who has succeeded in the biometric authentication, corresponds and stores the pre-registered biometric information and authentication result detail information including details of when the authentication request was processed, the information including the biometric information acquired by the terminal that is the sender of the authentication request.

[0011] According to a third aspect of the present invention, there is provided a method for controlling a server device, in which a server device receives an authentication request including biometric information of a person to be authenticated from a terminal among a plurality of terminals which has acquired the biometric information of the person to be authenticated, performs biometric authentication using the biometric information of the person to be authenticated and the biometric information of each of a plurality of users which have been pre-registered, and for a person who has succeeded in the biometric authentication, stores in association with the pre-registered biometric information and authentication result detail information which includes details of when the authentication request was processed and which includes the biometric information acquired by the terminal which sent the authentication request.

[0012] According to a fourth aspect of the present invention, there is provided a computer-readable storage medium storing a program for causing a computer mounted on a server device to execute the following processes: receiving an authentication request including biometric information of a person to be authenticated from a terminal among a plurality of terminals that has acquired the biometric information of the person to be authenticated; performing biometric authentication using the biometric information of the person to be authenticated and the biometric information of each of a plurality of pre-registered users; and storing, for a person who has succeeded in the biometric authentication, the pre-registered biometric information in association with authentication result detail information including details when the authentication request was processed and including biometric information acquired by a terminal that is the sender of the authentication request. Effect of the Invention

[0013] According to each aspect of the present invention, a server device, a system, a control method for a server device, and a storage medium are provided that contribute to making it possible to detect the occurrence of erroneous authentication (particularly false acceptance) in biometric authentication. Note that the effects of the present invention are not limited to the above. The present invention may achieve other effects instead of or in addition to the effects. [Brief description of the drawings]

[0014] [Figure 1] FIG. 1 is a diagram for explaining an overview of an embodiment. [Diagram 2] 1 is a diagram showing an example of a schematic configuration of a check-in system according to a first embodiment. [Diagram 3] FIG. 2 is a diagram illustrating an example of a processing configuration of a check-in terminal according to the first embodiment. [Figure 4] FIG. 4 is a diagram for explaining the operation of a system registration unit according to the first embodiment. [Diagram 5] FIG. 2 is a diagram illustrating an example of a processing configuration of a system registration unit according to the first embodiment. [Figure 6] 2 is a diagram illustrating an example of a processing configuration of a boarding gate apparatus according to the first embodiment. FIG. [Figure 7] FIG. 4 is a diagram illustrating an example of an authentication request according to the first embodiment. [Figure 8] FIG. 2 is a diagram illustrating an example of a processing configuration of a server device according to the first embodiment. [Figure 9] FIG. 4 is a diagram illustrating an example of a token ID information database according to the first embodiment. [Figure 10] FIG. 2 is a diagram illustrating an example of a business information database according to the first embodiment. [Figure 11] FIG. 4 is a diagram illustrating an example of an authentication result database according to the first embodiment. [Figure 12] 4 is a diagram for explaining an operation of a verification information generating unit according to the first embodiment; FIG. [Figure 13] 4 is a diagram for explaining an operation of a verification information generating unit according to the first embodiment; FIG. [Figure 14]FIG. 2 is a sequence diagram showing an example of the operation of the check-in system according to the first embodiment. [Figure 15] 13 is a diagram for explaining an operation of a verification information generating unit according to the second embodiment. FIG. [Figure 16] FIG. 2 illustrates an example of a hardware configuration of a server device. [Figure 17] 13 is a diagram for explaining the operation of a server device according to a modified example of the present disclosure. FIG. [Figure 18] 13 is a diagram for explaining the operation of the staff terminal according to the modified example disclosed in the present application. FIG. [Figure 19] 13 is a diagram for explaining the operation of the staff terminal according to the modified example disclosed in the present application. FIG. [Figure 20] 13 is a diagram for explaining the operation of the staff terminal according to the modified example disclosed in the present application. FIG. [Figure 21] FIG. 13 is a diagram illustrating an example of a processing configuration of a server device according to a modified example of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0015] First, an outline of one embodiment will be described. The reference numerals in the drawings are added to each element for convenience as an example to aid in understanding, and the description of the outline is not intended to be limiting. Furthermore, unless otherwise specified, the blocks shown in each drawing represent functional units rather than hardware units. The connection lines between the blocks in each drawing include both bidirectional and unidirectional. The unidirectional arrows are used to diagrammatically indicate the flow of the main signal (data) and do not exclude bidirectionality. In this specification and the drawings, elements that can be similarly described may be given the same reference numerals to avoid redundant description.

[0016] A server device 100 according to an embodiment includes a receiving unit 101, an authentication unit 102, and a storage unit 103 (see FIG. 1). The receiving unit 101 receives an authentication request including biometric information of a person to be authenticated from a terminal among a plurality of terminals that has acquired the biometric information of the person to be authenticated. The authentication unit 102 performs biometric authentication using the biometric information of the person to be authenticated and the biometric information of each of a plurality of users that have been registered in advance. The storage unit 103 stores, for a person who has been successfully authenticated through biometric authentication, the biometric information registered in advance and authentication result detailed information in association with each other. The authentication result detailed information includes the biometric information acquired by the terminal that is the sender of the authentication request.

[0017] The server device 100 stores details of the result (history) each time it processes an authentication request from a terminal. By using the history information, the server device 100 can generate authentication result verification information for airport staff or the like to verify whether the authentication result includes any erroneous authentication (particularly, any erroneous authentication related to false acceptance). The information is provided to the staff or the like, and the staff can detect the occurrence of false acceptance by checking the display generated based on the information. Here, the authentication result verification information can include the ID of the terminal that acquired the acquired face image in addition to the two types of biometric information used for authentication (e.g., the registered face image and the acquired face image). The staff or the like can identify the terminal where the erroneous authentication occurred based on the ID of the terminal, so that problems and inconsistencies associated with the occurrence of false acceptance can be quickly solved.

[0018] Specific embodiments will be described in more detail below with reference to the drawings.

[0019] [First embodiment] The first embodiment will be described in more detail with reference to the drawings.

[0020] [System configuration] Fig. 2 is a diagram showing an example of a schematic configuration of a check-in system according to the first embodiment. The check-in system according to the first embodiment is a system that realizes a series of procedures at an airport (baggage check, security check, etc.) by biometric authentication. The check-in system shown in Fig. 2 is operated, for example, by a public institution such as an immigration control bureau or a contractor entrusted with the business by the public institution.

[0021] In this disclosure, "boarding procedure" refers to a series of procedures carried out from check-in to boarding an aircraft.

[0022] Referring to FIG. 2, the boarding procedure system includes a check-in terminal 10, a baggage drop machine 11, a passenger passage system 12, a gate device 13, a boarding gate device 14, a server device 20, and an employee terminal 30.

[0023] The check-in terminal 10, the baggage drop machine 11, the passenger passage system 12, the gate device 13, and the boarding gate device 14 are terminals (touch points) installed at the airport. These terminals are connected to a server device 20 via a network. The network shown in Fig. 2 is composed of a LAN (Local Area Network) including an airport's in-house communication network, a WAN (Wide Area Network), a mobile communication network, etc. The connection method is not limited to a wired method, and may be a wireless method.

[0024] The server device 20 is installed within the facilities of an airport company, etc. Alternatively, the server device 20 may be a server installed in a cloud on a network.

[0025] The staff terminal 30 is a terminal used by airport or airline staff, etc. The check-in system may include one staff terminal 30, or may include multiple staff terminals 30.

[0026] The staff terminal 30 may be a stationary computer as shown in Fig. 2, or may be a portable terminal such as a mobile phone, smartphone, tablet, or laptop. The staff terminal 30 may be of any type or form as long as it is a terminal used by a staff member.

[0027] 2 is merely an example and is not intended to limit the configuration of the check-in system. The check-in system may include devices not shown.

[0028] The boarding procedure for users is carried out at each terminal shown in Figure 2. Specifically, a series of procedures when a user departs the country is carried out sequentially at terminals installed at five locations. In the boarding procedure system shown in Figure 2, the boarding procedure for users is realized by authentication using biometric information (biometric authentication).

[0029] Biometric information in the present disclosure includes face images, fingerprint images, iris images, finger vein images, palm print images, palm vein images, etc. Alternatively, biometric information may be voice data (voiceprint) that stores a person's voice. There may be one or more pieces of biometric information. Note that the term "biometric information" in the present disclosure refers to image data including all or a part of a living body, voice data, and features extracted from the images.

[0030] When a user (system user) who wishes to check in using biometric authentication arrives at the airport, he or she operates the check-in terminal 10 to carry out the "check-in procedure." The system user presents the check-in terminal 10 with a paper airline ticket, a two-dimensional barcode containing boarding information, a mobile device displaying a copy of the e-ticket, or the like. When the check-in procedure is complete, the check-in terminal 10 outputs a boarding pass. The boarding pass includes both paper and electronic boarding passes.

[0031] A system user who has completed the check-in procedure and wishes to carry out the boarding procedure using biometric authentication performs system registration using the check-in terminal 10. Specifically, the system user causes the check-in terminal 10 to read the acquired boarding pass and passport. The check-in terminal 10 also acquires the system user's biometric information (e.g., a facial image).

[0032] The check-in terminal 10 transmits information regarding these items (boarding pass, passport, and biometric information) to the server device 20.

[0033] The server device 20 checks the validity of the information acquired from the check-in terminal 10. Specifically, the server device 20 checks the validity of the presented passport. After completing the check, the server device 20 registers the system user. Specifically, the server device 20 issues a token to be used for the boarding procedure of the user registered in the system.

[0034] The issued token is identified by a token ID (identifier). Information required for boarding procedures (e.g., biometric information, business information required for boarding procedures, etc.) is associated via the token ID. In other words, a "token" is issued together with the registration of a system user, and is identification information for the registered system user to undergo boarding procedures using biometric information. Once a token (token ID) is issued, the system user can use boarding procedures that use biometric authentication.

[0035] In response to the generation of the token, the server device 20 adds an entry to each of the token ID information database and the transaction information database.

[0036] The token ID information database is a database that stores detailed information of generated tokens. The database stores at least the token ID and biometric information (face image, feature amount) in association with each other. The server device 20 refers to the token ID information database and performs biometric authentication.

[0037] The business information database is a database that stores business information. The business information database stores a token ID and business information in association with each other. Business information is information that is required when a terminal proceeds with a procedure (business).

[0038] When a system user to whom a token has been issued arrives at a terminal, biometric information (for example, a facial image) is acquired at the terminal. The terminal transmits an authentication request including the facial image to the server device 20.

[0039] In the present disclosure, the term "terminal" refers to an apparatus, device, etc. that transmits an authentication request including biometric information to the server apparatus 20. In the example of Fig. 2, the baggage drop machine 11, the passenger passage system 12, the gate apparatus 13, and the boarding gate apparatus 14 correspond to the "terminal". Alternatively, if the check-in procedure is also performed by biometric authentication, the check-in terminal 10 also corresponds to the "terminal".

[0040] The server device 20 performs biometric authentication using the biometric information acquired from the terminal and the biometric information registered in the system. If the biometric authentication is successful, the server device 20 transmits a positive response indicating that to the terminal. The positive response includes business information that is required for the terminal to proceed with the procedure. If the biometric authentication fails, the server device 20 transmits a negative response indicating that to the terminal.

[0041] The server device 20 stores and manages detailed information when processing an authentication request received from each terminal. Specifically, the server device 20 uses an authentication result database to store the above details. The authentication result database will be described in detail later.

[0042] The terminal that receives the successful authentication performs the boarding procedure for the user based on the acquired business information. For example, the terminal opens the gate, etc. as necessary, and allows the user to pass through. The terminal that receives the unsuccessful authentication notifies the authenticatee of that fact.

[0043] The server device 20 analyzes the results (detailed information) of the authentication process stored in the authentication result database, and generates authentication result verification information for airport or airline staff to verify whether the biometric authentication results include any erroneous authentications (particularly, erroneous authentications related to false acceptance). The server device 20 provides the generated authentication result verification information to the staff terminal 30.

[0044] The staff member verifies whether false acceptance has occurred based on the display generated based on the authentication result verification information. If false acceptance has occurred, the staff member resolves any inconsistencies or the like that arise due to the occurrence of false acceptance.

[0045] Next, the schematic configuration and functions of each device will be described.

[0046] The check-in terminal 10 is installed in the check-in lobby in the airport. As described above, a user uses the check-in terminal 10 to register with the system in order to carry out the boarding procedure using biometric authentication. The system user also operates the check-in terminal 10 to carry out the check-in procedure. That is, the check-in terminal 10 is also a self-service terminal that is operated by the user to carry out the check-in procedure. The check-in terminal 10 is also called a CUSS (Common Use Self Service) terminal. After completing the check-in procedure, the user moves to the baggage drop-off area or security checkpoint.

[0047] The baggage drop machine 11 is installed in an area adjacent to the baggage counter (manned counter) in the airport or in an area near the check-in terminal 10. The baggage drop machine 11 is a self-service terminal that is operated by a user to carry out the procedure (baggage drop procedure) of dropping off baggage that is not to be carried on board the aircraft. The baggage drop machine 11 is also called a CUBD (Common Use Bag Drop) terminal. After completing the baggage drop procedure, the user proceeds to the security inspection area. Note that if the user does not check in baggage, the baggage drop procedure is omitted.

[0048] The passenger passage system 12 is a gate device installed at the entrance to the security checkpoint in the airport. The passenger passage system 12 is also called a PRS (Passenger Reconciliation System), and is a system that determines whether or not a user can pass through the security checkpoint at the entrance. After passing through the passenger passage system 12 and completing the security check procedure, the user moves to the departure inspection area.

[0049] Gate device 13 is installed at the immigration area in the airport. Gate device 13 is a device that automatically performs immigration procedures for users. After completing the immigration procedures, the user moves to the departure area where duty-free shops and boarding gates are located.

[0050] The boarding gate device 14 is a passage control device installed at each boarding gate in the departure area. The boarding gate device 14 is the final gate device in a series of procedures for departure inspection (inspection using biometric information). The boarding gate device 14 is also called an ABG (Automated Boarding Gates) terminal. The boarding gate device 14 verifies that the user is a passenger of an aircraft that can be boarded through the boarding gate. After passing through the boarding gate device 14, the user boards the aircraft and departs for a second country.

[0051] 2 (check-in terminal 10, baggage drop machine 11, passenger passage system 12, gate device 13, boarding gate device 14) is merely an example, and is not intended to limit the devices used in the procedure. For example, devices other than the above devices may be used for the boarding procedure, or some of the above devices may not be used for the procedure. For example, gate device 13 may not be included in the boarding procedure system.

[0052] The server device 20 is a server device for supporting and managing the above-mentioned boarding procedure. The server device 20 manages token IDs. Specifically, the server device 20 issues and invalidates token IDs. The server device 20 also processes authentication requests from various terminals in the airport.

[0053] Next, details of each device included in the boarding procedure system according to the first embodiment will be described. In the following description, the biometric information will be described by taking the user's "face image" and "feature amount generated from the face image" as examples.

[0054] [Check-in terminal] As described above, the check-in terminal 10 is a device that provides system users with operations related to check-in procedures and system registration.

[0055] Fig. 3 is a diagram showing an example of a processing configuration (processing module) of the check-in terminal 10 according to the first embodiment. Referring to Fig. 3, the check-in terminal 10 includes a communication control unit 201, a system registration unit 202, a token issuance request unit 203, a message output unit 204, a check-in execution unit 205, and a storage unit 206.

[0056] The communication control unit 201 is a means for controlling communication with other devices. For example, the communication control unit 201 receives data (packets) from the server device 20. The communication control unit 201 also transmits data to the server device 20. The communication control unit 201 passes the data received from the other devices to the other processing modules. The communication control unit 201 transmits the data acquired from the other processing modules to the other devices. In this way, the other processing modules transmit and receive data to and from the other devices via the communication control unit 201.

[0057] The system registration unit 202 is a means for performing system registration of a user who wishes to undergo boarding procedures using biometric authentication. For example, after the check-in procedures are completed, the system registration unit 202 provides the user with a GUI (Graphical User Interface) for confirming whether or not the user wishes to undergo "boarding procedures using a face image" (see FIG. 4).

[0058] When a user requests boarding procedures using a face image, the system registration unit 202 acquires three pieces of information (information written on the boarding pass, information written on the passport, and biometric information) using a GUI.

[0059] The system registration unit 202 includes three sub-modules. Fig. 5 is a diagram showing an example of a processing configuration (processing modules) of the system registration unit 202 according to the first embodiment. As shown in Fig. 5, the system registration unit 202 includes a boarding pass information acquisition unit 211, a passport information acquisition unit 212, and a biometric information acquisition unit 213.

[0060] The boarding pass information acquisition unit 211 is a means for acquiring information (hereinafter referred to as boarding pass information) written on a boarding pass held by a system user. The boarding pass information acquisition unit 211 controls a reader (not shown) such as a scanner to acquire the boarding pass information.

[0061] The boarding pass information includes name (first name, last name), airline code, flight number, boarding date, departure airport (boarding airport), destination airport (arrival airport), seat number, boarding time, arrival time, etc.

[0062] The passport information acquisition unit 212 is a means for acquiring information (hereinafter referred to as passport information) written on a passport held by a system user. The passport information acquisition unit 212 controls a reader such as a scanner to acquire the passport information.

[0063] The passport information includes a facial image (hereinafter referred to as a passport facial image), name, gender, nationality, passport number, passport issuing country, etc.

[0064] The biometric information acquisition unit 213 is a means for acquiring biometric information of a system user. The biometric information acquisition unit 213 controls a camera to acquire a facial image of the system user. For example, when the biometric information acquisition unit 213 detects a face in an image captured constantly or periodically, it captures the user's face and acquires the facial image.

[0065] Before capturing a facial image, the biometric information acquisition unit 213 preferably displays a guidance message regarding capturing a facial image via the message output unit 204. For example, the biometric information acquisition unit 213 displays a message such as "We will capture a facial image of the customer and register it in the system. The registered facial image will be deleted from the system after boarding is completed."

[0066] The system registration unit 202 passes the acquired three pieces of information (boarding pass information, passport information, and biometric information) to the token issuance request unit 203.

[0067] 3 is a means for requesting the server device 20 to issue a token. The token issuance request unit 203 generates a token issuance request including boarding pass information, passport information, and biometric information (face image). The token issuance request unit 203 transmits the generated token issuance request to the server device 20.

[0068] The token issuance request unit 203 passes the response (response to the token issuance request) acquired from the server device 20 to the message output unit 204.

[0069] The message output unit 204 is a unit for outputting various messages. For example, the message output unit 204 outputs a message in response to a response obtained from the server device 20.

[0070] When a response (positive response) to the effect that the token issuance was successful is received, the message output unit 204 outputs that effect. For example, the message output unit 204 outputs a message such as "Future procedures can be performed by face authentication."

[0071] When a response (negative response) to the effect that the token issuance has failed is received, the message output unit 204 outputs that effect. For example, the message output unit 204 outputs a message such as "I'm sorry. We cannot perform the procedure using face authentication. Please go to a manned booth."

[0072] The check-in execution unit 205 is a means for carrying out the check-in procedure for a user. The check-in execution unit 205 executes the check-in procedure, such as seat selection, based on the airline ticket presented by the user. For example, the check-in execution unit 205 transmits the information written on the airline ticket to a DCS (Departure Control System) and obtains the information to be written on the boarding pass from the DCS. Note that the operation of the check-in execution unit 205 can be the same as the operation of existing check-in terminals, and therefore a detailed description thereof will be omitted.

[0073] The storage unit 206 is a means for storing information necessary for the operation of the check-in terminal 10 .

[0074] [Boarding gate equipment] 6 is a diagram showing an example of a processing configuration (processing module) of the boarding gate device 14 according to the first embodiment. Referring to FIG. 6, the boarding gate device 14 includes a communication control unit 301, a biometric information acquisition unit 302, an authentication request unit 303, a message output unit 304, a function realization unit 305, and a storage unit 306.

[0075] The communication control unit 301 is a means for controlling communication with other devices. For example, the communication control unit 301 receives data (packets) from the server device 20. The communication control unit 301 also transmits data to the server device 20. The communication control unit 301 passes the data received from the other devices to the other processing modules. The communication control unit 301 transmits the data acquired from the other processing modules to the other devices. In this way, the other processing modules transmit and receive data to and from the other devices via the communication control unit 301.

[0076] The biometric information acquisition unit 302 is a means for controlling a camera (not shown) and acquiring biometric information of a user. The biometric information acquisition unit 302 captures an image in front of the device periodically or at a predetermined timing. The biometric information acquisition unit 302 determines whether or not the acquired image contains a human face image, and if a face image is included, extracts the face image from the acquired image data.

[0077] Note that since existing technologies can be used for the facial image detection process and facial image extraction process by the biometric information acquisition unit 302, detailed explanations will be omitted. For example, the biometric information acquisition unit 302 may extract a facial image (face region) from image data using a learning model learned by a CNN (Convolutional Neural Network). Alternatively, the biometric information acquisition unit 302 may extract a facial image using a method such as template matching.

[0078] The biometric information acquiring unit 302 passes the extracted face image to the authentication requesting unit 303 .

[0079] The authentication request unit 303 is a means for requesting the server device 20 to authenticate the user in front of the server device 20. The authentication request unit 303 generates an authentication request including an identifier of the device itself (hereinafter, referred to as a terminal ID), the acquired face image, and the like (see FIG. 7). The terminal ID may be a media access control (MAC) address, an internet protocol (IP) address, or the like. The authentication request unit 303 transmits the generated authentication request to the server device 20.

[0080] The server device 20 can uniquely identify the terminal that is the sender of the authentication request by checking the terminal ID included in the authentication request. The server device 20 can also identify the type of terminal (baggage drop machine 11, passenger passage system 12, gate device 13, boarding gate device 14) based on the terminal ID. The terminal ID is shared between each terminal included in the system and the server device 20. For example, a system administrator or the like may determine the terminal ID and input the determined terminal ID to each terminal. The system administrator may also input table information or the like that associates terminal IDs with terminal types to the server device 20.

[0081] The authentication request unit 303 receives a response to the authentication request from the server device 20. The authentication request unit 303 passes the response acquired from the server device 20 to the message output unit 304 and the function realization unit 305.

[0082] The message output unit 304 is a unit that outputs various messages. For example, the message output unit 304 outputs a message according to the authentication result (authentication success, authentication failure) acquired from the server device 20.

[0083] The function realization unit 305 is a means for realizing the functions of the boarding gate device 14. The function realization unit 305 realizes procedures related to a person who has been successfully authenticated (a person who has been determined to have been successfully authenticated). The function realization unit 305 identifies the flight number of an aircraft that the user (person who has been successfully authenticated) can board from the acquired business information. If the identified flight number matches the flight number assigned to the function realization unit 305, the function realization unit 305 allows the person who has been successfully authenticated to pass through the gate. Note that the operation of the function realization unit 305 can be the same as that of an existing boarding gate device, and therefore a detailed description thereof will be omitted. Also, an employee working for the airline of the aircraft to be boarded through the boarding gate device 14 may assign (input) the necessary flight number to the boarding gate device 14.

[0084] When the function realization unit 305 permits the successfully authenticated person to pass through the gate, it notifies the server device 20 to that effect.

[0085] The memory unit 306 is a means for storing information necessary for the operation of the boarding gate device 14 .

[0086] [Other devices] The basic processing configuration of the other terminals included in the boarding check-in system (baggage drop machine 11, passenger passage system 12, gate device 13) can be the same as the processing configuration of boarding gate device 14 shown in Fig. 6, so detailed explanation will be omitted. Each terminal acquires biometric information (facial image) of the system user and requests authentication using the acquired biometric information from server device 20. If authentication is successful, the function assigned to each terminal is executed. In addition, each terminal outputs a display (message) according to the authentication result (authentication successful, authentication failed).

[0087] [Server device] Fig. 8 is a diagram showing an example of a processing configuration (processing module) of the server device 20 according to the first embodiment. Referring to Fig. 8, the server device 20 includes a communication control unit 401, a token generating unit 402, a database management unit 403, an authentication unit 404, a verification information generating unit 405, and a storage unit 406.

[0088] The communication control unit 401 is a means for controlling communication with other devices. For example, the communication control unit 401 receives data (packets) from the check-in terminal 10. The communication control unit 401 also transmits data to the check-in terminal 10. The communication control unit 401 passes data received from other devices to other processing modules. The communication control unit 401 transmits data acquired from other processing modules to other devices. In this way, other processing modules transmit and receive data to and from other devices via the communication control unit 401. The communication control unit 401 has a function as an "acquisition unit" that acquires biometric information of a person to be authenticated from a terminal. Alternatively, the communication control unit 401 has a function as a "reception unit" that receives an authentication request including biometric information of a person to be authenticated, and a "transmission unit" that transmits a response to the authentication request.

[0089] The token generating unit 402 is a means for generating a token in response to a token generation request from the check-in terminal 10. At that time, the token generating unit 402 judges the validity of the passport presented by the user.

[0090] Specifically, the token generating unit 402 judges whether the person who presented the passport to the check-in terminal 10 and the person who was issued the passport are the same person. To perform this judgment, the token generating unit 402 extracts a face image (a face image of the system user) included in the token generation request and a passport face image included in the passport information. The token generating unit 402 judges whether these two face images substantially match.

[0091] The token generating unit 402 performs matching (one-to-one matching) of the two face images. The token generating unit 402 calculates a feature vector from each of the two images. The token generating unit 402 calculates the similarity (e.g., Euclidean distance) between the two images, and determines whether the two images are face images of the same person based on the result of threshold processing on the calculated similarity. For example, if the similarity is greater than a predetermined value (if the distance is shorter than a predetermined value), the token generating unit 402 determines that the two face images are of the same person.

[0092] If the validity of the passport is successfully determined using the biometric information, the token generating unit 402 issues a token. For example, the token generating unit 402 generates a unique value as a token ID based on the date and time of processing, a sequence number, etc.

[0093] When the token generating unit 402 generates a token (token ID), it transmits a positive response (token issuance) to the check-in terminal 10. When the token generating unit 402 fails to generate a token ID, it transmits a negative response (token not issued) to the check-in terminal 10.

[0094] When the token generation unit 402 succeeds in generating (issuing) a token ID, it passes the generated token ID, boarding pass information, passport information, and face image (face image of the system user) to the database management unit 403.

[0095] The database management unit 403 is a means (management unit) for managing the database constructed in the server device 20 .

[0096] The server device 20 includes a token ID information database, a business information database, and an authentication result database.

[0097] The token ID information database stores at least a token ID and a user's biometric information in association with each other. Fig. 9 is a diagram showing an example of the token ID information database. Referring to Fig. 9, the token ID information database has fields for storing a token ID, a registered face image, a feature amount, a token issuance time, a token issuing device name, and the like.

[0098] As described above, the token ID is a temporarily issued identifier. When the user completes the procedure at the boarding gate device 14, the token ID is invalidated. In other words, the token ID is not an identifier that is used permanently, but a one-time ID that has a validity period (life cycle).

[0099] The registered face image is a face image of a system user. For example, the registered face image may be a face image of the user captured by the check-in terminal 10, or a passport face image. The feature amount is a feature vector generated from the face image. The token issue time is the time when the server device 20 issues the token ID. The device name is the name of the device (e.g., the check-in terminal 10) from which the registered face image that triggered the issuance of the token ID was acquired.

[0100] The business information database is a database that manages information (business information) required when a user performs boarding procedures. FIG. 10 is a diagram showing an example of the business information database. Referring to FIG. 10, the business information database has fields for storing a token ID, passenger name, departure point, destination, airline code, flight number, operation date, etc. In addition to the above fields, the business information database may have fields for storing a seat number, nationality, passport number, surname, first name, date of birth, gender, etc. The business information database stores business information required for a specific task (procedure tasks performed at each touch point) for each token ID.

[0101] The above information stored in the transaction information database is obtained from boarding pass information and passport information.

[0102] When the database management unit 403 acquires a token ID from the token generation unit 402 (when a token ID is issued), it adds a new entry to the two databases. The database management unit 403 sets a setting value in a field of each database. For example, the database management unit 403 generates a feature amount from a registered face image, and registers the generated feature amount in the token ID information database. For a field in which a setting value cannot be set, the database management unit 403 may set an initial value (default value).

[0103] The authentication unit 404 is a means for performing biometric authentication. The authentication unit 404 processes an authentication request acquired from a terminal. The authentication unit 404 performs biometric authentication using the biometric information of the person to be authenticated and the biometric information of each of a plurality of users registered in advance in a token ID information database.

[0104] Specifically, the authentication unit 404 processes an authentication request from a terminal that has acquired biometric information of the person to be authenticated among multiple terminals, by referring to the token ID information database. The authentication request includes the biometric information of the person to be authenticated. The authentication unit 404 executes a matching process (1:N matching) using the biometric information included in the authentication request and the biometric information registered in the token ID information database.

[0105] The authentication unit 404 generates feature amounts from face images acquired from terminals (baggage drop machine 11, passenger passage system 12, gate device 13, boarding gate device 14). Since existing technology can be used for the feature amount generation process, a detailed description thereof will be omitted. For example, the authentication unit 404 extracts the eyes, nose, mouth, etc. as feature points from the face image. After that, the authentication unit 404 calculates the position of each feature point and the distance between each feature point as feature amounts, and generates a feature vector consisting of multiple feature amounts.

[0106] The authentication unit 404 sets the generated feature amount (feature vector) as the feature amount on the matching side, and sets the feature amount stored in the token ID information database as the feature amount on the registration side.

[0107] The authentication unit 404 calculates the similarity (score) between the feature on the matching side and each of the multiple feature on the registration side. The similarity can be calculated using chi-square distance, Euclidean distance, or the like. Note that the greater the distance, the lower the similarity, and the closer the distance, the higher the similarity.

[0108] The authentication unit 404 determines that the authentication is successful if there is a feature whose similarity with the feature to be matched is equal to or greater than a predetermined value among a plurality of feature amounts (valid feature amounts) registered in the token ID information database.

[0109] If the authentication is successful, the authentication unit 404 identifies the token ID corresponding to the feature quantity with the highest similarity. The authentication unit 404 searches the business information database using the identified token ID as a key to identify the corresponding entry.

[0110] The authentication unit 404 transmits the authentication result to the terminal (responds to the authentication request).

[0111] If the authentication is successful, the authentication unit 404 transmits an affirmative response including the entry (token ID, business information) identified from the business information database to the terminal.

[0112] If the authentication fails, the authentication unit 404 transmits a negative response indicating the authentication failure to the terminal.

[0113] Next, the authentication result database will be described. As described above, detailed information when an authentication request from each terminal is processed is stored in the authentication result database. The authentication result database stores, for each person who has been successfully authenticated through biometric authentication, pre-registered biometric information and information including details when the authentication request was processed (hereinafter referred to as authentication result detailed information) in association with each other.

[0114] Fig. 11 is a diagram showing an example of the authentication result database. As shown in Fig. 11, the authentication result database stores a registered face image and at least one or more pieces of authentication result detail information for each token ID (each person who has been successfully authenticated). The authentication result detail information includes a terminal ID for identifying the sender of the authentication request, an acquired face image (a face image acquired by a terminal) included in the authentication request, a similarity (score) when it is determined that the authentication is successful, and the like.

[0115] For ease of understanding, Fig. 11 uses the symbols assigned to each terminal shown in Fig. 2 as terminal IDs. Also, the authentication result database shown in Fig. 11 is merely an example, and is not intended to limit the items stored therein. For example, the authentication result database may store the date and time when authentication was successful (authentication time), etc.

[0116] If the authentication is successful, the authentication unit 404 updates the authentication result database. Specifically, if the token ID of the person to be authenticated is not registered in the authentication result database, the authentication unit 404 adds a new entry to the database and writes details of the authentication process. If the token ID of the person to be authenticated is registered in the authentication result database, the authentication unit 404 writes the result of the authentication process in the authentication result detail information field of the corresponding entry.

[0117] Since the order of check-in procedures at an airport is predetermined, there is also an order to the terminal IDs stored in the authentication result database. For example, in the example of Fig. 2, the normal procedure is carried out in the order of baggage drop machine 11, passenger passage system 12, gate device 13, and boarding gate device 14. Therefore, details of the authentication process are stored in the authentication result database in the order of each of the above terminals. Since the procedure at baggage drop machine 11 is not essential, the authentication result by that terminal may not be stored in the authentication result database.

[0118] The verification information generating unit 405 is a means for generating the above-mentioned authentication result verification information. The verification information generating unit 405 generates the authentication result verification information including at least a registered face image, a terminal ID, and an acquired face image acquired by the terminal. The authentication result verification information generated by the verification information generating unit 405 is provided to airport or airline staff, etc.

[0119] For example, the verification information generating unit 405 transmits the generated authentication result verification information to the staff terminal 30. The staff terminal 30 generates a display (GUI) as shown in Fig. 12 based on the received authentication result verification information. The staff terminal 30 displays a registered face image of an entry (person who was successfully authenticated) stored in the authentication result database and at least one acquired face image at the same time. The staff terminal 30 also displays the name of the terminal that acquired the acquired face image, etc., based on the terminal ID.

[0120] The verification information generating unit 405 generates authentication result verification information in response to a request from a staff member (staff terminal 30) and transmits it to the staff terminal 30. The staff member checks the display as shown in Fig. 12, and if it is determined that no erroneous authentication due to false acceptance has occurred, the staff member presses the next button. In response to detecting the pressing of the next button, the staff terminal 30 requests the server device 20 to transmit new authentication result verification information.

[0121] When a new request is received, the verification information generating unit 405 generates authentication result verification information from the next entry in the authentication result database and transmits it to the staff terminal 30 .

[0122] If the registered face image and the acquired face image are compared and it is believed that these face images are taken of different persons, the staff member or the like determines that a false positive has occurred. In this case, the staff member or the like inputs the token ID into the server device 20 to obtain detailed information (e.g., name, airline, flight number, etc.) about the person who made the erroneous authentication. Based on the obtained detailed information, the staff member or the like visits the person who made the erroneous authentication and takes appropriate action. Specifically, the staff member or the like checks the passport or the like held by the person who made the erroneous authentication and corrects any inconsistencies that have arisen due to the erroneous authentication.

[0123] Alternatively, the staff terminal 30 may display a button or the like for obtaining detailed information about the erroneously authenticated party (see FIG. 13). When the staff member or the like requests detailed information (when the detailed information button is pressed), the staff terminal 30 notifies the server device 20 of that fact. In response to the notification, the verification information generation unit 405 of the server device searches the business information database using the token ID as a key. The verification information generation unit 405 transmits the name, airline code, flight number, etc. of the entry identified by the search result to the staff terminal 30. The staff terminal 30 displays the obtained information. Alternatively, the verification information generation unit 405 may generate a passage history of the terminal related to the erroneously authenticated party (passenger selected by the staff member or the like) by referring to the authentication result database, and transmit the passage history to the staff terminal 30. The staff terminal 30 may display the passage history.

[0124] If multiple pieces of authentication result detailed information are stored for the same successful authentication person, the verification information generating unit 405 generates authentication result verification information including a terminal ID and an acquired face image corresponding to each of the multiple pieces of authentication result detailed information. The staff terminal 30 can generate displays (GUI) such as those shown in Figs. 12 and 13 using such authentication result verification information.

[0125] The storage unit 406 stores various information necessary for the operation of the server device 20. In the storage unit 406, a token ID information database, a business information database, and an authentication result database are constructed.

[0126] [Staff terminal] The staff terminal 30 may be equipped with a display device such as a liquid crystal panel, an operating device such as a touch panel, and an information output function and an information input function. The staff terminal 30 may be realized by a commercially available computer, and the internal processing configuration, etc. will be clear to those skilled in the art, so a description thereof will be omitted.

[0127] [System Operation] Next, the operation of the check-in system according to the first embodiment will be described. Fig. 14 is a sequence diagram showing an example of the operation of the check-in system according to the first embodiment. The operation when performing the authentication process of the user and the operation thereafter will be described with reference to Fig. 14. The explanation of the operation related to the system registration will be omitted.

[0128] A terminal (any of the baggage drop machine 11, passenger passage system 12, gate device 13, and boarding gate device 14) acquires a face image of a user (person to be authenticated) and transmits an authentication request to the server device 20 (step S01).

[0129] The server device 20 generates features from the face image included in the authentication request, and executes authentication processing using the token ID information database (step S02).

[0130] If the authentication is successful (step S03, Yes branch), the server device 20 searches the business information database using the token ID obtained by the matching process as a key (step S04).

[0131] If the authentication fails (step S03, No branch), the server device 20 executes the processes from step S05 onwards.

[0132] The server device 20 transmits the authentication result (authentication success, authentication failure) to the terminal (touch point) (step S05).

[0133] The terminal performs a display according to the authentication result acquired from the server device 20 (step S06). The terminal also executes the boarding procedure for the user according to the authentication result. A description of this operation is omitted. Each terminal only needs to execute the function assigned to it.

[0134] The staff terminal 30 requests the server device 20 to provide information for verifying the occurrence of erroneous authentication (acceptance of a false person) (step S11).

[0135] The server device 20 references the authentication result database to generate authentication result verification information, and transmits the generated authentication result verification information to the staff terminal 30 (step S12).

[0136] The staff terminal 30 displays a GUI for verifying the occurrence of an authentication error based on the authentication result verification information (step S13).

[0137] As described above, when the boarding check-in system according to the first embodiment succeeds in authenticating the authenticated person, it stores details of the authentication process (authentication result) in an authentication result database. The server device 20 refers to the database in response to a request from a staff member or the like, and generates authentication result verification information for the staff member or the like to verify the occurrence of erroneous authentication (acceptance of a false person). The authentication result verification information includes the registered face image and the acquired face image, as well as the terminal ID of the terminal that triggered the occurrence of the authentication process. Therefore, the staff terminal 30 can identify which of the multiple terminals (terminals such as the baggage drop machine 11) has caused the false acceptance. In addition, the staff terminal 30 can present detailed information (e.g., flight number, airline, etc.) about the party involved in the false acceptance to the staff member, so that the staff member can quickly take appropriate measures.

[0138] [Second embodiment] Next, the second embodiment will be described in detail with reference to the drawings.

[0139] In the first embodiment, each entry stored in the authentication result database is treated as an information provision target (authentication result verification information is generated target). However, in this case, if the authentication result database contains a large number of entries, it will require a lot of effort for staff members to verify the acceptance of other people.

[0140] In the second embodiment, a case will be described in which entries for which authentication result verification information is to be generated are narrowed down in order to reduce the labor of staff.

[0141] The schematic configuration of the check-in system according to the second embodiment can be the same as that of the first embodiment, and therefore the explanation corresponding to Fig. 2 will be omitted. Similarly, the processing configuration of the server device 20 and the terminal according to the second embodiment can be the same as that of the first embodiment, and therefore the explanation will be omitted.

[0142] The differences between the first and second embodiments will be described below.

[0143] The verification information generating unit 405 according to the second embodiment generates authentication result verification information for authentication results that are highly likely to have false acceptance among biometric authentication results. The verification information generating unit 405 excludes authentication results (entries in the authentication result database) that are unlikely to have false acceptance from targets for generating authentication result verification information.

[0144] The verification information generating unit 405 judges whether or not to generate authentication result verification information for each entry (authenticated successfully) in the authentication result database when providing information or in advance in preparation for providing information. More specifically, the verification information generating unit 405 analyzes the authentication result detailed information and judges whether or not each entry in the authentication result database is to be a target for generating authentication result verification information.

[0145] For example, when at least one or more pieces of authentication result detail information included in each entry contains information that is highly likely to be an erroneous authentication (acceptance of a false identity), the verification information generating unit 405 sets the entry containing the information as a target for providing information. In other words, the verification information generating unit 405 does not generate authentication result verification information for an entry that contains only authentication result detail information that is low in possibility of an erroneous authentication.

[0146] For example, the verification information generating unit 405 determines whether or not each entry is to be a target for generating authentication result verification information based on the similarity used when processing an authentication request from a terminal. If the similarity included in the authentication result detailed information is smaller than a predetermined threshold, the verification information generating unit 405 generates authentication result verification information for the entry including the authentication result detailed information.

[0147] In the example of Fig. 11, when the similarity S11 of the authentication result detailed information 1 for the successfully authenticated person with the token ID "ID11" is smaller than the threshold value TH1, the authentication result verification information for the successfully authenticated person is generated. In this case, although the authentication is successful, the accuracy is low, and the authentication result for the successfully authenticated person is likely to be a false authentication.

[0148] Alternatively, the verification information generating unit 405 may determine whether to generate authentication result verification information based on time-series data that includes the similarity described in each entry of the authentication result database (the similarity included in each of the multiple authentication result detailed information). More specifically, the verification information generating unit 405 may make the above determination based on the result of statistical processing of the above time-series data.

[0149] For example, when the rate of change in similarity between before and after is greater than a predetermined threshold, the verification information generating unit 405 sets the corresponding entry as a target for generating authentication result verification information.

[0150] For example, the similarity obtained as a result of the authentication process for successfully authenticated person A is graphed as shown in Figure 15(a). The similarity for successfully authenticated person B is graphed as shown in Figure 15(b). The dotted line in Figure 15 indicates the value of threshold TH2 at which authentication is determined to be successful. In other words, each similarity plotted in Figure 15 is greater than threshold TH2 at which authentication is determined to be successful.

[0151] Comparing the two graphs in Fig. 15, the similarity (score) in Fig. 15(a) is stable at a high value (the rate of change between similarities is small). This fact indicates that the similarities calculated in the four authentication processes are about the same, and indicates that it is highly likely that the facial images of the same person were obtained on each terminal.

[0152] 15(b), the rate of change in similarity is large from the third to the fourth authentication results. This fact suggests that although the similarity between the registered face image and the acquired face image used in the fourth authentication process is greater than the threshold TH2 for determining successful authentication, the acquired face image used in the third authentication process and the acquired face image used in the fourth authentication process are face images of different people. Therefore, the verification information generating unit 405 determines that there is a high probability that false acceptance has occurred in the authentication of the successfully authenticated person B, and sets this as a target for generating authentication result detailed information.

[0153] Alternatively, the verification information generating unit 405 may determine whether or not to generate authentication result detailed information based on the "variation" of the time-series data of the feature amount described in each entry. Specifically, the verification information generating unit 405 calculates an index (variance, standard deviation) indicating the variation of the time-series data. If the calculated index (variance, standard deviation) indicating the variation is greater than a predetermined threshold, the verification information generating unit 405 sets the corresponding entry as a target for generating authentication result detailed information.

[0154] Alternatively, the verification information generating unit 405 may determine whether or not to generate authentication result detailed information using the largest similarity (first similarity) and the second largest similarity (second similarity; first similarity>second similarity) among the multiple similarities calculated during the authentication process. In this case, the authentication unit 404 stores the above two similarities in the authentication result database.

[0155] When the difference between the first similarity and the second similarity is smaller than a threshold value TH3 for the authentication result detailed information of each entry in the authentication result database, the verification information generating unit 405 sets the entry as a target for generating authentication result verification information.

[0156] Here, the fact that the difference between the first similarity and the second similarity is large indicates that the face of the person determined to be second most similar to the person to be authenticated does not resemble the face of the person to be authenticated (the person himself / herself). In contrast, the fact that the difference between the first similarity and the second similarity is small indicates that the face of the person determined to be second most similar to the person to be authenticated resembles the face of the person to be authenticated. For example, if the people to be authenticated are twins and both facial images are registered, the difference between the similarity based on the person's facial image (first similarity) and the similarity based on the other facial image of the twin (second similarity) will be small.

[0157] Using the above fact, the verification information generating unit 405 determines that an authentication in which the difference between the two similarities is smaller than a predetermined threshold is a result in which the probability of false acceptance occurring is high.

[0158] Alternatively, the verification information generating unit 405 may determine whether or not to generate authentication result detailed information based on an index or the like other than the similarity between face images based on a feature amount generated from a face image. In biometric authentication, erroneous authentication (acceptance of a different person) occurs because the "faces" of the matching side and the registration side are similar. More precisely, if the positions of the eyes and nose and the distance between these feature points are similar, erroneous authentication (acceptance of a different person) may occur even if the faces of different people are different. Here, in a boarding procedure system at an airport, a registered face image is input to the server device 20 at the time of check-in, and then a terminal (boarding gate device 14, etc.) requests biometric authentication from the server device 20 in a relatively short time. It is difficult to imagine that the subject's hairstyle, whether or not he / she wears glasses, his / her clothes, etc. will change in such a short period of time. The verification information generating unit 405 may determine whether or not to generate authentication result detailed information by utilizing the features and characteristics of such biometric authentication at an airport.

[0159] More specifically, the verification information generating unit 405 calculates the similarity between the two images by a method different from the method using the feature amount. For example, the verification information generating unit 405 sets a low value to the similarity if the hairstyles of the people in the two face images are different. Alternatively, the verification information generating unit 405 sets a low value to the similarity if one face image shows glasses and the other face image shows no glasses. Alternatively, the verification information generating unit 405 sets a low value to the similarity if the clothes of the people in the two face images are different. If the similarity calculated by the above method is lower than the threshold value TH4, the verification information generating unit 405 determines that the probability of false acceptance is high. That is, the verification information generating unit 405 may determine whether or not to generate authentication result detailed information based on the similarity between images calculated by a method different from the similarity based on the feature amount.

[0160] Regarding the determination of the similarity of hairstyles, the verification information generating unit 405 may compare the area of ​​the upper face region or may use the shape of the region. Regarding the presence or absence of glasses, the verification information generating unit 405 may use a method such as template matching. Regarding the determination of the identity of clothes, the verification information generating unit 405 may use the frequency analysis results of the region other than the face region. The server device may determine the identity of clothes depending on whether the pattern or texture of the region other than the face region is different.

[0161] The verification information generating unit 405 generates authentication result verification information for authentication results (entries) that are highly likely to have caused an erroneous authentication by the above method or other methods. That is, for authentication results that are determined to have a low probability of causing an erroneous authentication (acceptance of a false person), the display shown in Fig. 12 or 13 is not performed. In other words, the staff, etc., need only verify authentication results (registered face images, acquired face images) that are highly likely to have caused an erroneous authentication.

[0162] As described above, when providing information to staff etc., the server device 20 according to the second embodiment generates authentication result verification information from authentication results (authentication result detailed information) that are highly likely to have involved false acceptance. In this way, the server device 20 provides information to staff etc. by narrowing down information related to authentication results that are highly likely to have involved erroneous authentication, thereby reducing the burden on staff who check the provided information.

[0163] Next, the hardware of each device constituting the check-in system will be described. FIG 16 is a diagram showing an example of the hardware configuration of server device 20.

[0164] The server device 20 can be configured by an information processing device (so-called a computer), and has the configuration exemplified in Fig. 16. For example, the server device 20 has a processor 311, a memory 312, an input / output interface 313, and a communication interface 314. The components such as the processor 311 are connected by an internal bus or the like, and are configured to be able to communicate with each other.

[0165] However, the configuration shown in Fig. 16 is not intended to limit the hardware configuration of the server device 20. The server device 20 may include hardware not shown, and may not include the input / output interface 313 as necessary. In addition, the number of processors 311 and the like included in the server device 20 is not intended to be limited to the example shown in Fig. 16, and for example, the server device 20 may include multiple processors 311.

[0166] The processor 311 is, for example, a programmable device such as a central processing unit (CPU), a micro processing unit (MPU), or a digital signal processor (DSP). Alternatively, the processor 311 may be a device such as a field programmable gate array (FPGA), or an application specific integrated circuit (ASIC). The processor 311 executes various programs including an operating system (OS).

[0167] The memory 312 is a random access memory (RAM), a read only memory (ROM), a hard disk drive (HDD), a solid state drive (SSD), etc. The memory 312 stores an OS program, application programs, and various data.

[0168] The input / output interface 313 is an interface for a display device and an input device (not shown). The display device is, for example, a liquid crystal display, etc. The input device is, for example, a keyboard, a mouse, etc. that accepts user operations.

[0169] The communication interface 314 is a circuit, a module, etc. that communicates with other devices. For example, the communication interface 314 includes a network interface card (NIC).

[0170] The functions of the server device 20 are realized by various processing modules. For example, the processing modules are realized by the processor 311 executing a program stored in the memory 312. The program can be recorded in a computer-readable storage medium. The storage medium can be a non-transitory medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. That is, the present invention can also be embodied as a computer program product. The program can be downloaded via a network or updated using a storage medium storing the program. The processing modules may also be realized by a semiconductor chip.

[0171] The check-in terminal 10, boarding gate device 14, staff terminal 30, etc. can also be configured by information processing devices like the server device 20, and their basic hardware configurations are no different from that of the server device 20, so a description thereof will be omitted. The check-in terminal 10, etc. may be provided with a camera, etc.

[0172] The server device 20 is equipped with a computer, and the computer executes a program to realize the functions of the server device 20. The server device 20 also executes a control method for the server device by the program.

[0173] [Variations] The configuration, operation, etc. of the boarding system described in the above embodiment are merely examples and are not intended to limit the system configuration, etc.

[0174] In the above embodiment, it has been described that system registration is performed after the user checks in, but system registration may be performed before the user checks in. In this case, since a boarding pass is not issued before the user checks in, the server device 20 may perform system registration using airline ticket information instead of a boarding pass.

[0175] In the above embodiment, a case has been described in which system registration (registration for implementing boarding procedures using biometric authentication) is performed at the check-in terminal 10. However, system registration may be performed at a device or terminal other than the check-in terminal 10. For example, a device dedicated to system registration may be installed at the airport, or system registration may be performed at a terminal (touch point) such as the baggage drop machine 11 or the passenger passage system 12.

[0176] In the above embodiment, a case has been described in which a series of boarding procedures are performed using biometric authentication, but some of the procedures may be performed using biometric authentication. For example, in Fig. 2, system registration may be performed at the baggage drop-off machine 11, and procedures after baggage drop-off (security check, etc.) may be performed using biometric authentication. In other words, some of the procedures in the series of boarding procedures may be performed at a manned booth, etc.

[0177] In the above embodiment, the case where the server device 20 includes three databases has been described. However, the token ID information database, the business information database, and the authentication result database constructed in the server device 20 may be constructed in a database server different from the server device 20. In other words, the boarding procedure system only needs to include the various means (e.g., token generation means) and the like described in the above embodiment.

[0178] In the above embodiment, the authentication request includes a face image, but the authentication request may include features generated from the face image. In this case, the server device 20 processes the authentication request using the features extracted from the authentication request and the features registered in the token ID information database.

[0179] In the second embodiment, the server device 20 selects authentication results based on similarity and the like, and narrows down the verification targets for false acceptance occurrence. The above-described selection method is an example, and the server device 20 (verification information generating unit 405) may narrow down the verification targets based on other conditions and the like. For example, the server device 20 may narrow down the generation targets of authentication result verification information based on the seat class (highest class passenger seat, superior cabin, normal passenger seat) of the successfully authenticated person. For example, the server device 20 may limit the passengers with a first class seat class to the verification targets for false acceptance occurrence. In this case, staff can carefully monitor the occurrence of erroneous authentication regarding first class passengers (passengers with whom airlines and the like want to avoid trouble).

[0180] Alternatively, the server device 20 may determine whether or not to generate authentication result verification information based on the order of the terminal IDs stored in the authentication result database. As described above, the order of procedures at an airport is predetermined. Therefore, the server device 20 may determine that an entry in which biometric authentication has been performed in an order different from the predetermined order is highly likely to have been erroneous, and may generate authentication result verification information for that entry. For example, the verification information generating unit 405 may determine that an entry in which authentication has been performed (recorded) in the baggage drop machine 11 after authentication in the gate device 13 is to be generated as authentication result verification information. This is because it is usually not expected that authentication will be performed in the baggage drop machine 11 after the gate device 13.

[0181] As described in the second embodiment, the server device 20 may not only provide information based on the authentication result verification information based on an instruction from a staff member or the like, but may also provide the information voluntarily periodically or at a predetermined timing. For example, the server device 20 (verification information generating unit 405) analyzes the authentication result (authentication result detailed information) stored in the authentication result database periodically or at a predetermined timing, and determines whether or not the authentication result verification information needs to be transmitted. Specifically, the server device 20 determines whether or not the transmission is necessary by the method described in the second embodiment or other methods. When the server device 20 determines that it is necessary to transmit the authentication result verification information, it notifies (notifies, warns) the staff terminal 30 of that effect. At that time, the server device 20 may notify the staff terminal 30 of the name of the person involved in the false reception occurrence and information about the flight. Specifically, the server device 20 may transmit data to the staff terminal 30 that can generate a display as shown in FIG. 17.

[0182] A staff member who sees a display such as that shown in FIG. 17 approaches the displayed passenger and verifies whether or not a false authentication (acceptance of a false passenger) has really occurred. If false authentication has occurred, the staff member corrects the inconsistency caused by the false authentication. For example, the staff member corrects the data stored in the server device 20. Note that, as shown in FIG. 17, the staff member can compare the facial images acquired at each terminal, and therefore can identify which terminal has caused the false authentication. For example, if the facial image acquired at the boarding gate device 14 is different from the other acquired facial images, the staff member can determine that false authentication has occurred at the boarding gate device 14.

[0183] In this way, the verification information generating unit 405 of the server device 20 may analyze the authentication result detailed information periodically or at a predetermined timing, and determine whether or not to transmit the authentication result verification information. The verification information generating unit 405 may transmit, together with the authentication result verification information determined to be required to be generated, information regarding the flight of the corresponding successfully authenticated person to the staff terminal.

[0184] The server device 20 may identify the terminal that acquired the face image used in the authentication from the authentication result that is determined to have a high probability of false acceptance, and notify staff, etc. of the information of the identified terminal. For example, in the example of Fig. 15(b), it is determined that the probability of false acceptance is high in the fourth authentication process (e.g., the process related to the authentication request from the boarding gate device 14). Therefore, the server device 20 notifies staff that there is a high probability that false acceptance occurred during authentication at the boarding gate device 14.

[0185] In the above embodiment, it has been described that the server device 20 transmits the authentication result verification information of one passenger (authenticated successfully) to the staff terminal 30. However, the server device 20 may transmit the authentication result verification information of multiple passengers collectively to the staff terminal 30. For example, the server device 20 may generate authentication result verification information corresponding to each of multiple entries among the entries described in the authentication database shown in Fig. 11 and transmit it to the staff terminal 30. The staff terminal 30 may display a list as shown in Fig. 18 from the acquired information.

[0186] Alternatively, the server device 20 may transmit to the staff terminal 30 authentication result verification information with a flag indicating whether or not the probability of false acceptance occurring is high, based on the similarity used during authentication, etc. The staff terminal 30 may refer to the flag and display results that are likely to have false acceptance occurring, emphasizing the results, as shown in Fig. 19. In Fig. 19, entries colored gray indicate entries that are likely to have false acceptance occurring.

[0187] Alternatively, when a staff member who sees the display shown in Fig. 18 or 19 selects an entry, the staff terminal 30 may display a display (including a facial image) as shown in Fig. 12 or 13. Alternatively, the staff terminal 30 may display the name, airline code, flight number, etc. of the person who has been successfully authenticated in addition to the facial image.

[0188] In the above embodiment, the case where the authentication result verification target for one entry is displayed on one screen has been described with reference to Fig. 12 and Fig. 13. However, the authentication result verification targets (authentication results of successful authenticatees) for multiple entries may be displayed on one screen (see Fig. 20).

[0189] In the above embodiment, a case has been described in which an authentication result with a high probability of false acceptance is specified based on similarity or the like. However, the specification may be performed using a learning model generated by machine learning. Specifically, a system administrator or the like collects data (acquired face images, registered face images) when a large number of false acceptances occur. The system administrator or the like generates training data by attaching a label related to authentication failure to the collected data. The system administrator or the like inputs the training data into a learning device to generate a learning model (classification model). The learning model is implemented in the server device 20. The server device 20 inputs two face images into the learning model and obtains a judgment result (false acceptance occurs, does not occur). When the judgment result is "false acceptance occurs," the server device 20 may provide information on the corresponding entry or issue an alert to a staff member. Note that any algorithm such as a support vector machine, boosting, or neural network can be used to generate the learning model. Note that the algorithm such as the support vector machine can be a known technology, and therefore a description thereof will be omitted.

[0190] In the above embodiment, the system operation and the like have been described by treating the face image and the feature amount generated from the face image as "biometric information". However, other information may be used as "biometric information" instead of the face image, etc. For example, when voiceprint authentication is used, the occurrence of false acceptance may be detected by playing back voiceprint information (audio data) registered in advance.

[0191] In the above embodiment, a case has been described in which it is determined whether or not to generate authentication result verification information based on similarity or time-series data that includes similarity as an element. The server device 20 may determine whether or not to generate authentication result verification information by combining the above-described multiple methods. For example, the server device 20 determines whether or not to generate authentication result verification information for each of the multiple determination methods. If at least one of the multiple obtained determination results is "generation required", the server device 20 may generate authentication result verification information from the corresponding entry. Alternatively, the server device 20 may determine whether or not to generate authentication result verification information based on the result of statistical processing of the multiple determination results. For example, the server device 20 may generate authentication result verification information from the corresponding entry if the number of determinations that "generation is required" is greater than a predetermined threshold value.

[0192] In the above embodiment, the server device 20 provides the authentication result verification information to the staff, etc. via the staff terminal 30. However, the server device 20 may provide the information using a display device or the like of its own device. Alternatively, the server device 20 may provide the information via a dashboard or the like installed in a management office or the like where the staff, etc. are stationed.

[0193] Although there are no particular limitations on the format of data transmission and reception between the check-in terminal 10 and the server device 20, data transmitted and received between these devices may be encrypted. Boarding pass information and passport information contain personal information, and in order to appropriately protect the personal information, it is desirable to transmit and receive encrypted data.

[0194] The server device 20 may provide staff or the like with a search function of the authentication result database. For example, the server device 20 may be equipped with a "search unit 407" that searches for authentication results that are highly likely to have involved false acceptance (see FIG. 21). The search unit 407 acquires search conditions from the staff terminal 30 or the like. The search unit 407 searches for authentication results that match the conditions and returns the search results. For example, based on information input from staff or the like, the search unit 407 searches for entries (authentication results) in which the difference in similarity between successfully authenticated persons (the difference between the first similarity and the second similarity) is equal to or less than a predetermined threshold.

[0195] In the flow charts (flow charts, sequence diagrams) used in the above description, multiple steps (processes) are described in order, but the order of execution of the steps executed in the embodiments is not limited to the order described. In the embodiments, the order of the steps shown in the figures can be changed to a degree that does not interfere with the content, such as executing each process in parallel.

[0196] The above-mentioned embodiments have been described in detail to facilitate understanding of the present disclosure, and it is not intended that all of the configurations described above are necessary. In addition, when a plurality of embodiments are described, each embodiment may be used alone or in combination. For example, it is possible to replace a part of the configuration of an embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of an embodiment. Furthermore, it is possible to add, delete, or replace a part of the configuration of an embodiment with another configuration.

[0197] The above explanation makes it clear that the present invention has industrial applicability, and the present invention is suitably applicable to boarding procedures at airports and the like. However, the application of the present disclosure is not limited to airport procedures, and the present disclosure is applicable to systems requiring multiple procedures. For example, the present disclosure can also be applied to entrance and exit control at an event venue and the like. For example, the server device 20 may analyze the authentication history at the event venue, and notify the event organizer or the like of any results that are strongly suspected to be erroneous authentication.

[0198] A part or all of the above-described embodiments may be described as, but is not limited to, the following supplementary notes. [Appendix 1] a receiving unit that receives an authentication request including biometric information of a person to be authenticated from a terminal that has acquired the biometric information of the person to be authenticated, among a plurality of terminals; an authentication unit that performs biometric authentication using biometric information of the person to be authenticated and biometric information of each of a plurality of users registered in advance; a storage unit that stores, for a person who has been successfully authenticated by the biometric authentication, the pre-registered biometric information and authentication result detail information including details of processing the authentication request and including the biometric information acquired by a terminal that is a sender of the authentication request, in association with each other; A server device comprising: [Appendix 2] The authentication result detailed information stored in the storage unit further includes a terminal ID for identifying a source of the authentication request, The server device according to claim 1, further comprising a generation unit configured to generate authentication result verification information including at least the pre-registered biometric information, the terminal ID, and the biometric information acquired by the terminal. [Appendix 3] The server device according to claim 2, wherein the authentication result detailed information includes a similarity degree when the authentication is determined to be successful by the biometric authentication. [Appendix 4] The server device according to claim 3, wherein the generation unit analyzes the authentication result detailed information and determines whether to generate the authentication result verification information. [Appendix 5] The server device according to claim 4, wherein the generation unit determines whether or not to generate the authentication result verification information based on the similarity. [Appendix 6] The server device according to claim 5, wherein the generation unit generates the authentication result verification information when the similarity included in the authentication result detailed information is smaller than a first threshold value. [Appendix 7] The server device according to claim 5 or 6, wherein the generation unit generates the authentication result verification information when a difference between the largest first similarity and the second largest second similarity is smaller than a second threshold value. [Appendix 8] The generation unit is When multiple pieces of authentication result detail information are stored for the same authenticated person, The server device according to any one of appendix 5 to 7, which determines whether to generate the authentication result detailed information based on a result of statistical processing on time-series data having similarity included in each of the plurality of authentication result detailed information as an element. [Appendix 9] The server device according to any one of appendices 2 to 8, wherein the generation unit transmits the authentication result verification information to a staff terminal used by an airport or airline staff member. [Appendix 10] The generation unit analyzes the authentication result detailed information periodically or at a predetermined timing, and transmits information regarding the flight of the corresponding successfully authenticated person together with the authentication result verification information that is determined to need to be generated to the staff terminal. [Appendix 11] The server device according to any one of Supplementary Notes 1 to 10, wherein the biometric information is a face image or a feature extracted from the face image. [Appendix 12] Multiple devices and A server device connected to the plurality of terminals; Including, The server device includes: a receiving unit that receives an authentication request including biometric information of a person to be authenticated from a terminal that has acquired the biometric information of the person to be authenticated among the plurality of terminals; an authentication unit that performs biometric authentication using biometric information of the person to be authenticated and biometric information of each of a plurality of users registered in advance; a storage unit that stores, for a person who has been successfully authenticated by the biometric authentication, the pre-registered biometric information and authentication result detail information including details of processing the authentication request and including the biometric information acquired by a terminal that is a sender of the authentication request, in association with each other; A system comprising: [Appendix 13] In the server device, receiving an authentication request including biometric information of a person to be authenticated from a terminal that has acquired the biometric information of the person to be authenticated among the plurality of terminals; performing biometric authentication using the biometric information of the person to be authenticated and the biometric information of each of a plurality of users registered in advance; A control method for a server device, which stores, in association with each other, the pre-registered biometric information for a person who has successfully passed the biometric authentication, and authentication result detailed information including details of when the authentication request was processed, the biometric information being acquired by a terminal that sent the authentication request. [Appendix 14] A computer installed in the server device receiving an authentication request including biometric information of a person to be authenticated from a terminal that has acquired the biometric information of the person to be authenticated among a plurality of terminals; A process of performing biometric authentication using biometric information of the person to be authenticated and biometric information of each of a plurality of users registered in advance; a process of storing, for a person who has been successfully authenticated by the biometric authentication, the pre-registered biometric information in association with detailed authentication result information including details of processing the authentication request and including the biometric information acquired by a terminal that is a sender of the authentication request; A computer-readable storage medium that stores a program for executing the above.

[0199] The disclosures of the above cited prior art documents are incorporated herein by reference. Although the embodiments of the present invention have been described above, the present invention is not limited to these embodiments. It will be understood by those skilled in the art that these embodiments are merely illustrative and that various modifications are possible without departing from the scope and spirit of the present invention. In other words, the present invention naturally includes various modifications and amendments that a person skilled in the art can make in accordance with the entire disclosure, including the scope of the claims, and the technical ideas. [Explanation of symbols]

[0200] 10 Check-in terminal 11 Baggage drop machine 12 Passenger Passage System 13 Gate device 14 Boarding gate equipment 20, 100 Server equipment 30 Staff terminals 101 Receiving unit 102, 404 Authentication Department 103, 206, 306, 406 Storage section 201, 301, 401 Communication control unit 202 System Registration Department 203 Token issuance request part 204, 304 Message output section 205 Check-in Execution Department 211 Boarding pass information acquisition unit 212 Passport Information Acquisition Department 213, 302 Biometric information acquisition unit 303 Authentication Request Section 305 Functional Realization Department 311 Processor 312 Memory 313 Input / Output Interface 314 Communication Interface 402 Token Generator 403 Database Management Department 405 Verification Information Generation Unit 407 Search Department

Claims

1. a receiving unit that receives an authentication request including biometric information of a person to be authenticated from a terminal that has acquired the biometric information of the person to be authenticated, among a plurality of terminals; an authentication unit that performs biometric authentication using biometric information of the person to be authenticated and biometric information of each of a plurality of users registered in advance; a generation unit that generates data that associates pre-registered biometric information of a user who has been successfully authenticated and authentication result detail information for each terminal, the data including biometric information acquired by a terminal that is a transmission source of the authentication request, with a successful authentication subject who has been successfully authenticated by the biometric authentication; Equipped with The authentication result detail information includes information regarding a similarity when the authentication is determined to be successful by the biometric authentication, The generation unit is a server device that outputs, based on the analysis results of the authentication result detailed information, authentication result verification information including the biometric information and the authentication result detailed information associated with the successfully authenticated person to an employee terminal as information for verifying false acceptance, which is one type of incorrect authentication.

2. The server device according to claim 1 , wherein the generation unit generates the authentication result verification information based on a similarity when it is determined that the authentication is successful.

3. The server device according to claim 2 , wherein the generation unit outputs the authentication result verification information when the similarity included in the authentication result detailed information is smaller than a first threshold value.

4. The authentication result detail information for the authenticated person is generated for each terminal that has transmitted the authentication request when it is determined that the authentication is successful by the biometric authentication using the biometric information acquired by the terminal, and includes information on the similarity when it is determined that the authentication is successful by the biometric authentication, The server device according to claim 2, wherein the generation unit outputs the authentication result verification information when a difference between the largest first similarity and the second largest second similarity among the similarities contained in the authentication result detailed information is smaller than a second threshold value when multiple authentication result detailed information are generated for a successful authentication person.

5. The authentication result detail information for the authenticated person is output for each terminal that has transmitted the authentication request when it is determined that the authentication is successful by the biometric authentication using the biometric information acquired by the terminal, and includes information on the similarity when it is determined that the authentication is successful by the biometric authentication, The server device according to claim 2, wherein when a plurality of the authentication result detailed information pieces are generated for a successful authentication person, the generation unit determines whether or not to output the authentication result detailed information based on a result of statistical processing of time-series data having similarity included in the authentication result detailed information pieces as an element.

6. The server device according to claim 1 , wherein the generation unit outputs information about a flight of the corresponding successfully authenticated person together with the authentication result detailed information to the staff terminal.

7. Multiple devices and A system comprising: the server device according to claim 1 connected to a plurality of the terminals.

8. The server device receiving an authentication request including biometric information of a person to be authenticated from a terminal that has acquired the biometric information of the person to be authenticated among the plurality of terminals; performing biometric authentication using the biometric information of the person to be authenticated and the biometric information of each of a plurality of users registered in advance; generating data correlating the preregistered biometric information of the user with authentication result detail information for each terminal, the data including the biometric information acquired by the terminal that is the transmission source of the authentication request, for a successful authentication subject who has succeeded in the biometric authentication; The authentication result detail information includes information regarding a similarity when the authentication is determined to be successful by the biometric authentication, A method for controlling a server device, which outputs authentication result verification information including the biometric information and the authentication result detailed information associated with the successfully authenticated person based on an analysis result of the authentication result detailed information to an employee terminal as information for verifying false acceptance, which is one type of erroneous authentication.

9. A computer installed in the server device receiving an authentication request including biometric information of a person to be authenticated from a terminal that has acquired the biometric information of the person to be authenticated among a plurality of terminals; A process of performing biometric authentication using biometric information of the person to be authenticated and biometric information of each of a plurality of users registered in advance; A process of generating data associating pre-registered biometric information of a user who has been successfully authenticated and authentication result detailed information for each terminal including biometric information acquired by a terminal that is a sender of the authentication request, for a successful authentication subject who has been successfully authenticated by the biometric authentication; The authentication result detailed information includes information regarding a similarity when the authentication is determined to be successful by the biometric authentication, and based on an analysis result of the authentication result detailed information, the authentication result verification information including the biometric information associated with the person who has been successfully authenticated and the authentication result detailed information is output to an employee terminal as information for verifying false acceptance, which is one type of erroneous authentication. A computer program for executing the above.

Images