Authentication server, facial image update recommendation method and computer program

Abstract

Provided is an authentication server that maintains authentication accuracy. The authentication server comprises a first database, an authentication unit, and a recommendation unit. The first database stores biological information related to the face of each of a plurality of users. The authentication unit refers to the first database to authenticate a person subject to authentication. If authentication of the person subject to authentication fails, the recommendation unit makes a recommendation to a user, out of the plurality of users, who is estimated to be the person subject to authentication, and recommends an update of the biological information stored in the first database.

Description

[Technical field]

[0001] The present invention relates to an authentication server, a facial image update recommendation method, and a storage medium. [Background technology]

[0002] In recent years, various services using biometric information have become widespread. For example, face recognition is used for various procedures at airports (check-in, baggage drop-off, etc.) and hotel check-in.

[0003] Services that use facial recognition are processed in the following manner: First, a terminal (installed at an airport or hotel) captures a facial image of the customer and generates a feature vector that characterizes the facial image. The generated feature vector is then sent to a server on the network.

[0004] The server has a database that stores the biometric information and personal information (such as name and address) of users who receive services using face recognition. When the server receives a matching request from the terminal, it searches (matches) the database and identifies the biometric information and personal information that correspond to the matching request from the terminal. The server transmits the identified personal information to the terminal, and the terminal installed at the airport or other location performs operations based on the acquired personal information.

[0005] Technological development is progressing regarding authentication using biometric information.

[0006] For example, Patent Document 1 states that a mobile information terminal device capable of improving the authentication success rate is provided. In the technology disclosed in Patent Document 1, when authentication is successful, on the premise that a certain condition is satisfied, feature information when authentication failed in an authentication process performed prior to the authentication process (failure feature information) is added to a feature information storage unit as new registered feature information. In subsequent authentication processes, the authentication process is performed using the failure feature information in addition to the registered feature information already stored in the feature information storage unit.

[0007] Patent Document 2 describes that the authentication error caused by the habit of reading the user's biometric information or the change of the user's biometric body over time is reduced. The authentication device of Patent Document 2 includes a user table, a fingerprint image receiving unit, an authentication unit, a temporary storage unit, a comparison unit, and a replacement unit. The user table stores a fingerprint image as an authentication image. The fingerprint image receiving unit receives a fingerprint image. The authentication unit compares the fingerprint image with the authentication image and performs authentication. The temporary storage unit temporarily stores the fingerprint images received before the authentication is successful as a temporarily stored image. If the authentication is successful, the comparison unit compares the temporarily stored image with a failure image associated with the authentication image, and if it is determined that they match, counts up the number of matches corresponding to the failure image. If it is determined that they do not match, the comparison unit stores the temporarily stored image as a failure image in association with the authentication image. The replacement unit replaces the authentication image with a failure image whose corresponding number of matches is equal to or greater than a predetermined value. [Prior art documents] [Patent documents]

[0008] [Patent Document 1] JP 2007-047931 A [Patent Document 2] JP 2008-217442 A Summary of the Invention [Problem to be solved by the invention]

[0009] As described above, face authentication is performed based on the similarity between the face image acquired by the terminal and the face image registered in the server. In other words, face authentication fails if the face image sent by the terminal to the server and the face image registered in the server are not judged to substantially match (the same person). Here, if a long time has passed since the face image was registered, the match between the two face images weakens due to changes in appearance, etc., and authentication often fails. Note that Patent Documents 1 and 2 do not disclose any technology to prevent deterioration of authentication accuracy due to changes in appearance.

[0010] A primary object of the present invention is to provide an authentication server, a facial image update recommendation method, and a storage medium that contribute to maintaining authentication accuracy. [Means for solving the problem]

[0011] According to a first aspect of the present invention, there is provided an authentication server comprising: a first database that stores biometric information relating to the faces of each of a plurality of users; an authentication unit that authenticates a person to be authenticated by referring to the first database; and a recommendation unit that, if authentication of the person to be authenticated fails, recommends to a user among the plurality of users who is presumed to be the person to be authenticated to update the biometric information stored in the first database.

[0012] According to a second aspect of the present invention, there is provided a facial image update recommendation method in an authentication server having a first database that stores biometric information regarding the faces of each of a plurality of users, which authenticates a person to be authenticated by referring to the first database, and, if authentication of the person to be authenticated fails, recommends an individual among the plurality of users who is presumed to be the person to be authenticated to update the biometric information stored in the first database.

[0013] According to a third aspect of the present invention, there is provided a computer-readable storage medium storing a program for causing a computer mounted on an authentication server having a first database storing biometric information relating to the faces of each of a plurality of users to execute a process of authenticating a person to be authenticated by referring to the first database, and a process of recommending to a user among the plurality of users who is presumed to be the person to be authenticated that the biometric information stored in the first database be updated if authentication of the person to be authenticated fails. Effect of the Invention

[0014] According to each aspect of the present invention, an authentication server, a face image update recommendation method, and a storage medium are provided that contribute to maintaining authentication accuracy. Note that the effects of the present invention are not limited to the above. The present invention may achieve other effects instead of or in addition to the above effects. [Brief description of the drawings]

[0015] [Figure 1] FIG. 1 is a diagram for explaining an overview of an embodiment. [Diagram 2] 1 is a diagram illustrating an example of a schematic configuration of an authentication system according to a first embodiment. [Diagram 3] FIG. 2 is a diagram for explaining the operation in a user registration phase of the authentication system according to the first embodiment. [Figure 4] FIG. 2 is a diagram for explaining an operation in a service registration phase of the authentication system according to the first embodiment. [Diagram 5] FIG. 2 is a diagram for explaining an operation in a service provision phase of the authentication system according to the first embodiment. [Figure 6] FIG. 2 is a diagram illustrating an example of a processing configuration of an authentication server according to the first embodiment. [Figure 7] 4 is a diagram for explaining the operation of a user management unit of the authentication server according to the first embodiment; FIG. [Figure 8] 4 is a diagram for explaining the operation of a user management unit of the authentication server according to the first embodiment; FIG. [Figure 9] 4 is a diagram for explaining the operation of a user management unit of the authentication server according to the first embodiment; FIG. [Figure 10] 4 is a diagram for explaining the operation of a user management unit of the authentication server according to the first embodiment; FIG. [Figure 11] 4 is a diagram for explaining the operation of a user management unit of the authentication server according to the first embodiment; FIG. [Figure 12] 10 is a flowchart showing an example of an operation related to updating a face image of a user management unit according to the first embodiment. [Figure 13] 4 is a diagram for explaining the operation of a user management unit of the authentication server according to the first embodiment; FIG. [Figure 14] 4 is a diagram for explaining the operation of a user management unit of the authentication server according to the first embodiment; FIG. [Figure 15]4 is a diagram for explaining the operation of a user management unit of the authentication server according to the first embodiment; FIG. [Figure 16] 4 is a diagram for explaining the operation of a user management unit of the authentication server according to the first embodiment; FIG. [Figure 17] 4 is a diagram for explaining the operation of a user management unit of the authentication server according to the first embodiment; FIG. [Figure 18] 4 is a diagram for explaining the operation of a user management unit of the authentication server according to the first embodiment; FIG. [Figure 19] FIG. 4 is a diagram illustrating an example of an authentication information database according to the first embodiment. [Figure 20] FIG. 4 is a diagram illustrating an example of an authentication information database according to the first embodiment. [Figure 21] FIG. 4 is a diagram illustrating an example of an authentication information database according to the first embodiment. [Figure 22] 6 is a flowchart showing an example of the operation of an authentication unit according to the first embodiment. [Diagram 23] FIG. 4 is a diagram illustrating an example of an authentication failure database according to the first embodiment. [Figure 24] FIG. 4 is a diagram showing an example of a screen displayed on a terminal according to the first embodiment. [Diagram 25] FIG. 4 is a diagram showing an example of a screen displayed on a terminal according to the first embodiment. [Figure 26] 10 is a flowchart showing an example of the operation of a face image update recommendation unit according to the first embodiment. [Figure 27] FIG. 2 is a diagram illustrating an example of a processing configuration of a management server according to the first embodiment. [Figure 28] 4 is a diagram for explaining the operation of a personal information acquisition unit of the management server according to the first embodiment; FIG. [Figure 29] FIG. 2 is a diagram illustrating an example of a user information database according to the first embodiment. [Diagram 30] FIG. 2 is a diagram illustrating an example of a processing configuration of an authentication terminal according to the first embodiment. [Diagram 31]FIG. 4 is a sequence diagram showing an example of an operation related to a service registration phase of the authentication system according to the first embodiment. [Diagram 32] FIG. 4 is a sequence diagram showing an example of an operation related to a service provision phase of the authentication system according to the first embodiment. [Diagram 33] FIG. 11 is a diagram illustrating an example of an authentication failure database according to the second embodiment. [Diagram 34] 10 is a flowchart showing an example of an operation of an authentication unit according to the second embodiment. [Diagram 35] FIG. 2 illustrates an example of a hardware configuration of an authentication server. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0016] First, an outline of one embodiment will be described. The reference numerals in the drawings are added to each element for convenience as an example to aid in understanding, and the description of the outline is not intended to be limiting. Furthermore, unless otherwise specified, the blocks shown in each drawing represent functional units rather than hardware units. The connection lines between the blocks in each drawing include both bidirectional and unidirectional. The unidirectional arrows are used to diagrammatically indicate the flow of the main signal (data) and do not exclude bidirectionality. In this specification and the drawings, elements that can be similarly described may be given the same reference numerals to avoid redundant description.

[0017] An authentication server 100 according to an embodiment includes a first database 101, an authentication unit 102, and a recommendation unit 103 (see FIG. 1). The first database 101 stores biometric information relating to the faces of each of a plurality of users. The authentication unit 102 refers to the first database 101 to authenticate the person to be authenticated. When authentication of the person to be authenticated fails, the recommendation unit 103 recommends an individual among the plurality of users who is presumed to be the person to be authenticated to update the biometric information stored in the first database 101.

[0018] For example, when it is determined that authentication has failed due to a change in the appearance of the person to be authenticated, the authentication server 100 prompts the user who is presumed to be the person to be authenticated to update the face image. As a result, the user can update the face image registered in the authentication server 100 at an appropriate time, reducing the possibility of authentication failure. In other words, authentication accuracy can be maintained for a long period of time.

[0019] Specific embodiments will be described in more detail below with reference to the drawings.

[0020] [First embodiment] The first embodiment will be described in more detail with reference to the drawings.

[0021] [System configuration] Fig. 2 is a diagram showing an example of a schematic configuration of an authentication system according to the first embodiment. As shown in Fig. 2, the authentication system includes an authentication center and a plurality of service providers.

[0022] Each service provider participating in the authentication system provides a service using biometric authentication. Examples of services provided by a service provider include payment services at retail stores and accommodation services at hotels. Alternatively, a service provided by a service provider may be immigration inspection at an airport or a seaport. The service provider disclosed in the present application may provide any service that can be provided using biometric authentication.

[0023] An authentication server 10 is installed in the authentication center. The authentication server 10 is an information processing device that operates as an authentication authority for authentication using biometric information. The authentication server 10 may be a server installed on the premises of the authentication center, or may be a server installed on the cloud.

[0024] Examples of the biometric information of a user include data (feature amounts) calculated from physical characteristics unique to an individual, such as a face, fingerprint, voiceprint, veins, retina, and iris pattern. Alternatively, the biometric information of a user may be image data such as a face image or fingerprint image. The biometric information of a user may include information on the physical characteristics of the user.

[0025] The authentication server 10 is a server device for implementing services based on biometric authentication. The authentication server 10 processes an "authentication request" sent from each service provider, and sends the result of the authentication process to the service provider.

[0026] Each service provider has a management server and an authentication terminal.

[0027] For example, a service provider S1 is provided with a management server 20 and a plurality of authentication terminals 30. A service provider S2 is provided with a management server 20 and a plurality of authentication terminals 31.

[0028] In the following description, when it is necessary to distinguish between the components, the reference numerals to the right of the hyphens will be used. The operation of each device included in the service provider S1 and the service provider S2 can be the same, so the following description will focus on the service provider S1.

[0029] The devices shown in Fig. 2 are connected to each other. For example, the authentication server 10 and the management server 20 are connected to each other by a wired or wireless communication means and are configured to be able to communicate with each other.

[0030] The management server 20 is a server that controls and manages the overall business of the service provider. For example, if the service provider is a retail store, the management server 20 performs inventory management of products. Alternatively, if the service provider is a hotel operator, the management server 20 performs management of reservation information of guests.

[0031] The management server 20 has a control function and a management function related to the biometric authentication of users, in addition to the functions related to providing the above services.

[0032] The authentication terminal 30 is a device that serves as an interface for users (customers) who visit a service provider. The users receive various services via the authentication terminal 30. For example, if the service provider is a retail store, the users use the authentication terminal 30 to make payments. Alternatively, if the service provider is a hotel operator, the users use the authentication terminal 30 to carry out check-in procedures.

[0033] FIG. 2 is an example and is not intended to limit the configuration of the authentication system disclosed herein. For example, the authentication center may include two or more authentication servers 10. Alternatively, the service provider may include at least one authentication terminal 30. Alternatively, the functions of the management server 20 and the authentication terminal 30 may be integrated, and a service using biometric authentication may be provided by the integrated single device. Alternatively, in each service provider, multiple authentication terminals 30 may be connected to one management server 20 as shown in FIG. 2, or one authentication terminal 30 may be connected to one management server 20.

[0034] [System operation overview] Next, the general operation of the authentication system according to the first embodiment will be described.

[0035] The operation of the authentication system involves three phases.

[0036] The first phase is a phase in which the user is registered in the system (user registration phase).

[0037] The second phase is a phase for registering a service (service registration phase).

[0038] The third phase is the phase in which services using biometric authentication are provided to users (service provision phase).

[0039] [User registration phase] FIG. 3 is a diagram for explaining the operation in the user registration phase of the authentication system according to the first embodiment.

[0040] A user who wishes to use a service that uses biometric authentication must register in advance. The user must determine information to identify the user in the authentication system (user ID (identifier) ​​and password (PW)) and register it in the system. In the drawings including Figure 3, the user ID is represented as "uID."

[0041] In addition, the user registers his / her biometric information (e.g., face image), identity document (e.g., passport, etc.), and contact information (e.g., email address, etc.) in the system. The user registers the above five pieces of information (user ID, password, biometric information, identity document, contact information) in the system using any means.

[0042] For example, a user may operate a terminal 40 owned by the user to input a captured image of the user's face, a user ID, a password, an identification document, and contact information to the authentication server 10. Examples of the terminal 40 include a mobile terminal device such as a smartphone, a mobile phone, a game machine, or a tablet, or a computer (personal computer, notebook computer), etc.

[0043] The authentication server 10 performs identity verification of the user using the acquired face image and the identity document. Specifically, when the acquired face image and the face image recorded on the identity document are face images of the same person, the authentication server 10 determines that the system registration application is made by the user himself / herself.

[0044] After that, the authentication server 10 generates a feature amount (a feature vector consisting of a plurality of feature amounts) from the acquired face image, and stores the feature amount, face image, user ID, password, and contact information in the authentication information database in association with each other. The identification document acquired by the authentication server 10 may be discarded after the completion of the identity verification, or may be stored in association with the user ID, etc.

[0045] A system user can update the facial image registered in the system. If a long time has passed since the user started using the system, the user may wish to register the current face (facial image) in the system. In this case, the authentication server determines whether the facial image can be updated and changes the registered facial image according to the result.

[0046] Furthermore, when the authentication server 10 determines based on the result of the biometric authentication that it is better to update the registered face image, it notifies the user (terminal 40) to that effect. The authentication server 10 prompts the user to update the registered face image.

[0047] A detailed description of the recommendation to update a facial image and whether or not the facial image can be updated will be given later.

[0048] In the first embodiment, an example is described in which a user ID and password are used as an identifier to uniquely define a system user. However, if there is no overlap in user IDs between users, it is also possible to use the user ID as the above identifier.

[0049] [Service registration phase] FIG. 4 is a diagram for explaining the operation in the service registration phase of the authentication system according to the first embodiment.

[0050] After completing user registration, the user selects a service provider from which he or she wishes to receive services through biometric authentication, and registers the selected service provider in the system.

[0051] The user registers personal information (e.g., name, etc.) required to receive services from the selected service provider in the system. Examples of the above personal information include name, age, and gender. In addition to the above personal information, the user also registers the user ID and password determined in the user registration phase in the system.

[0052] In the present disclosure, personal information is defined as information that does not include biometric information of a user (person to be authenticated). In other words, biometric information and features generated from the biometric information are excluded from "personal information" in the present disclosure.

[0053] The user inputs the above three pieces of information (personal information, user ID, and password) to the service provider using any means. For example, as shown in Fig. 4, the user may operate a terminal 40 to input the above three pieces of information to the management server 20.

[0054] Upon acquiring the above three pieces of information (personal information, user ID, and password), the management server 20 transmits a "service registration request" to the authentication server 10. Specifically, the management server 20 transmits a service registration request including the service provider ID, the user ID, and the password to the authentication server 10.

[0055] The service provider ID is identification information for uniquely identifying a service provider (such as a retailer participating in an authentication infrastructure that uses biometric authentication) included in the authentication system. In the example of Figure 2, different service provider IDs are assigned to service providers S1 and S2.

[0056] Note that the service provider ID is an ID assigned to each service provider, not to each service. For example, in FIG. 2, even if the service providers S1 and S2 are businesses that provide the same type of service (e.g., accommodation service), if the management entities are different, these service providers are assigned different IDs.

[0057] The authentication server 10 and the management server 20 share the service provider ID by any method. For example, when a service provider participates in the authentication infrastructure, the authentication server 10 generates a service provider ID and distributes (notifies) the generated service provider ID to the service provider. In the drawings including FIG. 4, the service provider ID is represented as "spID".

[0058] When receiving a service registration request, the authentication server 10 searches the authentication information database using the user ID and password included in the request as keys to identify the corresponding user. The authentication server 10 then generates a "service user ID."

[0059] The service user ID is identification information that uniquely defines a correspondence relationship (combination) between a user and a service provider. In the example of Fig. 2, a service user ID determined from a combination of a user U1 and a service provider S1 and a service user ID determined from a combination of a user U1 and a service provider S2 are set to different values.

[0060] The authentication server 10 stores the user ID, password, feature amount, face image, contact information, service provider ID, and the generated service user ID in association with each other. In the drawings including FIG. 4, the service user ID is represented as "suID".

[0061] The authentication server 10 transmits the generated service user ID to the sender of the service registration request.

[0062] The management server 20 associates and stores the service user ID and the personal information of the user acquired from the authentication server 10. The management server 20 adds a new entry to the user information database and stores the above information (personal information, service user ID).

[0063] The user repeats the above-described registration operation for each service provider from which the user wishes to receive a service using biometric authentication.

[0064] [Service provision phase] FIG. 5 is a diagram for explaining the operation in the service providing phase of the authentication system according to the first embodiment.

[0065] After completing the service registration (service registration phase), the user visits the service provider. The user moves to the authentication terminal 30.

[0066] The authentication terminal 30 acquires biometric information from a user in front of the authentication terminal 30. Specifically, the authentication terminal 30 captures an image of the user and acquires a facial image. The authentication terminal 30 transmits the acquired facial image to the management server 20.

[0067] The management server 20 generates features from the acquired face image, and transmits an authentication request including the generated features and the service provider ID to the authentication server 10.

[0068] The authentication server 10 extracts a feature from the authentication request, and executes a matching process (1:N matching; N is a positive integer, the same applies below) using the extracted feature and a feature registered in the authentication information database.

[0069] The authentication server 10 identifies the user through a matching process, and identifies a service user ID corresponding to the service provider ID included in the authentication request from among a plurality of service user IDs associated with the identified user.

[0070] The authentication server 10 transmits the identified service user ID to the sender of the authentication request. The authentication server 10 transmits a response (response to the authentication request) including the identified service user ID to the management server 20.

[0071] The management server 20 searches the user information database using the acquired service user ID as a key, and identifies the personal information corresponding to the service user ID. The service provider (management server 20, authentication terminal 30) provides the user with a service (e.g., payment settlement, check-in procedure, etc.) based on the identified personal information.

[0072] Next, each device included in the authentication system according to the first embodiment will be described in detail.

[0073] [Authentication Server] Fig. 6 is a diagram showing an example of a processing configuration (processing module) of the authentication server 10 according to the first embodiment. Referring to Fig. 6, the authentication server 10 includes a communication control unit 201, a user management unit 202, a database management unit 203, a service registration unit 204, an authentication unit 205, a facial image update recommendation unit 206, and a storage unit 207.

[0074] The communication control unit 201 is a means for controlling communication with other devices. For example, the communication control unit 201 receives data (packets) from the management server 20. The communication control unit 201 also transmits data to the management server 20. The communication control unit 201 passes data received from other devices to other processing modules. The communication control unit 201 transmits data acquired from other processing modules to other devices. In this way, the other processing modules transmit and receive data to and from other devices via the communication control unit 201.

[0075] The user management unit 202 is a means for realizing the above-mentioned user registration and face image update. The user management unit 202 has a function as a registration unit that registers a user and a function as an update unit that updates the registered face image.

[0076] When the terminal 40 accesses the authentication server 10, the user management unit 202 displays a menu as shown in FIG.

[0077] When a user wishes to register, the user management unit 202 obtains the user ID, password, biometric information (facial image), identification documents, and contact information of the user (a user who wishes to receive services using biometric authentication; a system user).

[0078] The user management unit 202 acquires the above five pieces of information (user ID, password, biometric information, identification document, and contact information) using any means. For example, the user management unit 202 displays a GUI (Graphical User Interface) and an input form for determining a user ID and password on the terminal 40. For example, the user management unit 202 displays a GUI such as that shown in FIG. 8 on the terminal 40.

[0079] The user management unit 202 verifies that the user ID and password acquired through the GUI or the like are not the same as those already registered. If there is no duplication, the user management unit 202 displays on the terminal 40 a GUI for acquiring the user's biometric information, identification document, and contact information.

[0080] For example, the user management unit 202 displays a GUI as shown in FIG. 9 on the terminal 40. For example, the user presses a "File Selection" button shown in FIG. 9 to specify image data of a face image to be registered in the system. The specified face image is displayed in the preview area (displayed as a selected face image in FIG. 9). When registering the previewed face image, the user presses a "Confirm" button. In addition, regarding inputting a face image into the system, the user may operate the terminal 40 to attach the face image to an e-mail or the like. Alternatively, the user management unit 202 may transmit information including a destination of the face image to the terminal 40, and the terminal 40 may transmit the face image to the destination of the face image. Alternatively, the user management unit 202 and the terminal 40 may transmit and receive face images using a communication tool such as a chat. The user management unit 202 may acquire (receive) a face image by any means.

[0081] When the face image is acquired, the user management unit 202 acquires the identification document. For example, the user management unit 202 displays a GUI as shown in FIG. 10 on the terminal 40. For example, the user captures an image of the identification document using the camera of the terminal 40. The user presses the "Select File" button and specifies the image of the captured identification document. The user then presses the "Enter" button to register the identification document.

[0082] Examples of identity verification documents that can be registered in the system include documents with a facial image such as a passport or a driver's license (documents issued by public institutions that contribute to identity verification). Identity verification documents include not only paper documents but also electronic documents.

[0083] When the identity verification document is acquired, the user management unit 202 acquires contact information. For example, the user management unit 202 displays a GUI as shown in Fig. 11 on the terminal 40. The user inputs contact information (for example, an email address of an account that can be received on the terminal 40) and presses the "Enter" button.

[0084] The user management unit 202 performs identity verification of the user when it acquires a user ID, password, biometric information (face image), an identification document, and contact information, for example, through a GUI such as those shown in Fig. 8 to Fig. 11. Specifically, the user management unit 202 acquires a face image for identity verification (hereinafter, referred to as a verification face image) from the identification document. The user management unit 202 extracts the verification face image from a predetermined area of ​​the identification document using a technique such as template matching.

[0085] When verifying the identity of a user, the user management unit 202 generates features (feature vectors consisting of multiple features) from each of the acquired face image and the verification face image. Note that existing technology can be used for the feature point extraction process, so detailed explanations are omitted. For example, the user management unit 202 extracts the eyes, nose, mouth, etc. as feature points from the face image. After that, the user management unit 202 calculates the positions of each feature point and the distance between each feature point as feature amounts, and generates a feature vector (vector information characterizing the face image) consisting of multiple feature amounts.

[0086] Next, the user management unit 202 calculates the similarity between the two images. The similarity can be calculated using chi-square distance, Euclidean distance, or the like. The greater the distance, the lower the similarity, and the closer the distance, the higher the similarity. The user management unit 202 performs threshold processing on the similarity and determines whether or not identity verification has been successful based on the result.

[0087] If the similarity is higher than the threshold TH1, the user management unit 202 determines that the identity verification is successful. On the other hand, if the similarity is equal to or lower than the threshold TH1, the user management unit 202 determines that the identity verification is unsuccessful. In this case, the user management unit 202 takes action such as encouraging the user to register a good quality face image. As described above, when identity verification is completed, the user management unit 202 may discard the identity verification document.

[0088] If identity verification is successful, the user management unit 202 passes the user ID, password, face image, features generated from the face image, and contact information to the database management unit 203. In the following description, a face image registered in the authentication information database will be referred to as a "registered face image."

[0089] Next, an operation of the user management unit 202 when updating a face image (registered face image) will be described. Fig. 12 is a flowchart showing an example of an operation related to updating a face image of the user management unit 202 according to the first embodiment.

[0090] A user who wishes to update his / her facial image accesses the authentication server 10 using the terminal 40. The user management unit 202 displays a menu screen as shown in Fig. 7 on the terminal 40. A user who wishes to update his / her facial image presses the "Update Facial Image" button.

[0091] When the face image update button is pressed, the user management unit 202 displays a GUI for the user to log in to the system. For example, the user management unit 202 displays a screen as shown in Fig. 13 and acquires a user ID and a password.

[0092] The user management unit 202 searches the authentication information database using the acquired user ID and password as keys, and if a corresponding entry is found, it determines that the user is registered in the system and proceeds with the facial image update process. In this case, the user management unit 202 reads out the registered facial image from the corresponding entry. On the other hand, if the above entry is not found, the user management unit 202 determines that the user has failed to log in to the system. In this case, the user management unit 202 notifies the user of this fact. Note that the user management unit 202 may display the read facial image (registered facial image) so that the user can confirm it at the time of reading out the facial image from the authentication information database.

[0093] After a user registered in the system logs in, the user management unit 202 acquires an update facial image (hereinafter referred to as an update facial image) (step S101 in FIG. 12). For example, the user management unit 202 displays a screen as shown in FIG. 14 to acquire an update facial image. The user selects the update facial image and presses the "OK" button.

[0094] The user management unit 202 determines whether or not the registered face image may be updated using the acquired updated face image.

[0095] The user management unit 202 calculates the similarity between the registered face image and the updated face image (step S102). The user management unit 202 performs threshold processing on the calculated similarity, and determines whether or not to update the registered face image based on the result.

[0096] If the similarity is greater than the threshold value TH2 (step S103, Yes branch), the user management unit 202 permits the update of the registered face image (step S108). Since two face images with high similarity can be determined to be face images acquired from substantially the same person, the user management unit 202 permits the update of the registered face image. In this case, the user management unit 202 displays a message as shown in FIG. 15 to notify the user that the registered face image has been updated.

[0097] If the similarity is smaller than the threshold value TH3 (step S104, Yes branch), the user management unit 202 rejects the update of the registered face image. Since two face images with low similarity can be determined as face images of different people, the user management unit 202 rejects the update of the registered face image (step S109). In this case, since there is a suspicion of fraudulent use of the system, the user management unit 202 displays a message as shown in FIG.

[0098] If the similarity is equal to or greater than the threshold TH3 and equal to or less than the threshold TH2 (step S103, No branch; step S104, No branch), the user management unit 202 acquires the identity document (step S105). For example, the user management unit 202 acquires the identity document using a GUI as shown in Fig. 17. The user management unit 202 extracts a verification face image from the identity document.

[0099] In addition, if the identity verification document is not destroyed when the user registers with the system and is stored in the database, the user management unit 202 may omit execution of step S105 and use the identity verification document stored in the database.

[0100] Alternatively, the user management unit 202 may take measures such as refusing to accept old identification documents (identification documents issued a predetermined period before the facial image update date) based on the expiration date, issue date, etc. of the acquired identification document. That is, the user management unit 202 may select an identification document from which an updated facial image is to be extracted based on the description of the identification document (for example, the date and period described in the document). That is, the user management unit 202 may decide whether or not to extract a verification facial image based on the description of the identification document. The user management unit 202 may acquire a verification facial image that reflects the user's current appearance, etc., by making such a selection or decision.

[0101] The user management unit 202 calculates the similarity between the updated face image and the verification face image (step S106). The user management unit 202 executes threshold processing on the calculated similarity, and determines whether or not to update the registered image based on the result.

[0102] If the similarity is higher than the threshold value TH4 (step S107, Yes branch), the user management unit 202 permits updating of the registered face image (step S108). In this case, the user management unit 202 displays a screen as shown in FIG.

[0103] On the other hand, if the similarity is equal to or less than the threshold value TH4 (step S107, No branch), the user management unit 202 refuses to update the registered face image with the updated face image (step S109). In this case, the user management unit 202 displays a screen as shown in FIG.

[0104] Alternatively, the user management unit 202 may display a screen as shown in Fig. 18 to prompt the user to re-input an updated face image, etc. The user management unit 202 may repeat the above-described determination process using the re-input face image.

[0105] When updating of the registered face image is permitted, the user management unit 202 generates features from the updated face image. The user management unit 202 passes the user ID, password, generated features, and updated face image to the database management unit 203, and instructs the database management unit 203 to update the biometric information (feature, face image).

[0106] In this way, the user management unit 202 functioning as a facial image update unit determines whether to update the registered facial image with the updated facial image depending on the similarity between the registered facial image (first facial image) and the updated facial image (second facial image). The user management unit 202 updates the registered facial image when the similarity between the registered facial image and the updated facial image is greater than a threshold value TH2. The user management unit 202 does not update the registered facial image when the similarity between the registered facial image and the updated facial image is less than a threshold value TH3.

[0107] Furthermore, the user management unit 202 acquires the user's identification document if the similarity between the registered face image and the updated face image is equal to or greater than the threshold TH3 and equal to or less than the threshold TH2. The user management unit 202 extracts a verification face image (third face image) from the identification document, and determines whether to update the registered face image according to the similarity between the updated face image and the verification face image. The user management unit 202 updates the registered face image if the similarity between the updated face image and the verification face image is greater than the threshold TH4. The user management unit 202 does not update the registered face image if the similarity between the updated face image and the verification face image is equal to or less than the threshold TH4.

[0108] The database management unit 203 is a means for managing the authentication information database. The authentication information database stores information identifying a system user (user ID, password), biometric information of the user (feature amount, face image), a service provider ID identifying a service provider, and a service user ID identifying a user in each service, in association with each other. Furthermore, the authentication information database also stores the contact information of the user in association with the above information. The authentication information database is a database that stores biometric information on the face of each of a plurality of users (registered face image, feature amount generated from the image).

[0109] When the database management unit 203 acquires the above five pieces of information (user ID, password, feature amount, facial image, contact information) from the user management unit 202, it adds a new entry to the authentication information database. For example, when the above five pieces of information about user U1 are acquired, the database management unit 203 adds the entry shown in the bottom row of Fig. 19. Note that at the user registration stage, the service provider ID and service user ID have not been generated, so nothing is set in these fields.

[0110] When the database management unit 203 receives four pieces of information (user ID, password, feature amount, and facial image) accompanied by an instruction to update a facial image from the user management unit 202, it updates (overwrites) the feature amount and facial image of the corresponding entry.

[0111] The service registration unit 204 is a means for enabling individual service registration by a system user. The service registration unit 204 processes a service registration request received from the management server 20 of the service provider.

[0112] The service registration unit 204 searches the authentication information database using the user ID and password included in the acquired service registration request as keys. The service registration unit 204 checks the service provider ID field of the identified user (the user identified from the pair of the user ID and password).

[0113] The service registration unit 204 determines whether or not the service provider ID included in the service registration request acquired from the management server 20 is set in the service provider ID field. If the service provider ID acquired from the management server 20 is already registered in the database, the service registration unit 204 notifies the management server 20 of that fact. In this case, since the service (service provider) that the user is attempting to register is already registered in the authentication information database, the service registration unit 204 transmits a "negative response" as a response to the service registration request.

[0114] On the other hand, if the service provider ID included in the service registration request is not set in the service provider ID field of the identified user, the service registration unit 204 generates a service user ID corresponding to the user and the service provider.

[0115] As described above, the service user ID is identification information that is uniquely determined from a combination of a user and a service provider. For example, the service registration unit 204 calculates a hash value using the user ID, the password, and the service provider ID, and sets the calculated hash value as the service user ID. Specifically, the service registration unit 204 calculates a concatenated value of the user ID, the password, and the service provider ID, and calculates a hash value of the calculated concatenated value to generate the service user ID.

[0116] Note that the generation of the service user ID using the hash value is merely an example, and is not intended to limit the method of generating the service user ID. The service user ID may be any information that can uniquely identify a combination of a system user and a service provider. For example, the service registration unit 204 may assign a unique value each time a service registration request is processed, and use the number as the service user ID.

[0117] When the service user ID is generated, the service registration unit 204 passes the service provider ID and service user ID along with the user ID and password to the database management unit 203. The database management unit 203 registers the two IDs (service provider ID, service user ID) in the authentication information database. For example, when a user U1 performs service registration for a service provider S1, the above two IDs are added to the entry shown at the bottom of Fig. 20.

[0118] Since service registration is performed for each service provider, multiple service providers and service user IDs may be set for one user. For example, when user U1 performs service registration for each of service providers S1 and S2, the entries in the second and third lines of Fig. 21 are generated. Note that when user U2 performs service registration for service provider S1, the entry in the bottom row of Fig. 21 is generated.

[0119] When the service provider ID and the service user ID are registered in the authentication information database, the service registration unit 204 notifies the management server 20 that the service registration request has been processed normally. The service registration unit 204 transmits an "acknowledgement" as a response to the service registration request. At that time, the service registration unit 204 transmits a response including the service user ID to the management server 20.

[0120] The authentication unit 205 is a means for performing authentication processing of the system user. The authentication unit 205 processes an authentication request received from the management server 20 of the service provider. The authentication unit 205 refers to an authentication information database to authenticate the person to be authenticated.

[0121] The authentication unit 205 extracts the feature amount and the service provider ID included in the authentication request. The authentication unit 205 searches the authentication information database using the extracted feature amount and the service provider ID as keys to identify the corresponding service user ID. The authentication unit 205 sets the feature amount extracted from the authentication request as the feature amount on the matching side and the feature amount stored in the database as the feature amount on the registration side, and executes 1:N matching.

[0122] FIG. 22 is a flowchart showing an example of the operation of the authentication unit 205 according to the first embodiment.

[0123] The authentication unit 205 calculates the similarity between each of a plurality of feature amounts registered in the authentication information database and a feature amount to be matched (a feature amount of a person to be authenticated) (step S201).

[0124] The authentication unit 205 determines whether or not any of the calculated similarities is greater than a threshold value TH5 (step S202).

[0125] If there is at least one similarity greater than the threshold value TH5 (step S202, Yes branch), the authentication unit 205 identifies the user (user ID, password) with the greatest similarity (step S203).

[0126] Thereafter, the authentication unit 205 determines whether or not there is an entry that matches the service provider ID included in the authentication request among at least one or more service provider IDs associated with the identified user (user ID, password) (step S204).

[0127] When an entry as described above exists (Yes branch in step S204), the authentication unit 205 determines that the authentication of the user has succeeded (step S205). In this case, the authentication unit 205 sends an "affirmative response" to the management server 20 that is the source of the authentication request. At that time, the authentication unit 205 generates a response (response to the authentication request) including the service user ID of the identified entry and sends it to the management server 20.

[0128] When an entry as described above does not exist (No branch in step S204), the authentication unit 205 determines that the authentication of the user has failed (step S206). In this case, the authentication unit 205 sends a "negative response" to the management server 20 that is the source of the authentication request.

[0129] Even when there is no similarity greater than the threshold TH5 (No branch in step S202), the authentication unit 205 determines that the authentication of the user has failed (step S207).

[0130] After that, the authentication unit 205 determines whether there is a similarity greater than the threshold TH6 (where TH6 < TH5) among the plurality of similarities calculated in step S201 (step S208). Note that the threshold TH5 is a threshold for determining that the person to be authenticated is the user himself / herself, and the threshold TH6 is a threshold for determining that the person to be authenticated is another person.

[0131] If there is at least one similarity greater than the threshold TH6 (Yes branch in step S208), the authentication unit 205 identifies the user with the greatest similarity (step S209).

[0132] The authentication unit 205 updates the "authentication failure database" using the information of the identified user (step S210). Note that the authentication failure database and the operations related to the update of the database will be described later.

[0133] If there is no similarity greater than the threshold TH6 (No branch in step S208), the authentication unit 205 ends the process without performing any special operations.

[0134] 21, when an authentication request includes a feature amount "FV1" and a service provider ID "S1", the feature amount FV1 identifies the entries (users) in the second and third lines, and the service provider ID "S1" identifies the entry in the second line. As a result, the authentication request is normally processed, and an affirmative response including the service user ID "U1S1" is sent to the management server 20.

[0135] Furthermore, if authentication of the person to be authenticated fails (step S202, No branch), the authentication unit 205 performs threshold processing on the calculated similarity to identify a user who is presumed to be the person to be authenticated among users registered in the authentication information database (step S209). Specifically, if the calculated similarity falls within the range from the first threshold (threshold TH6) to the second threshold (threshold TH5), the authentication unit 205 determines that authentication has failed due to a change in the appearance of the person to be authenticated. The authentication unit 205 presumes that the user corresponding to the largest similarity value among the similarities falling within the above range is the person to be authenticated. The authentication unit 205 stores information of the user who is presumed to be the person to be authenticated in the authentication failure database (step S210).

[0136] Next, the authentication failure database and update control of the database will be described.

[0137] The authentication failure database is a database that stores information on users who are assumed to have failed authentication due to a change in the person's appearance, etc. Fig. 23 is a diagram showing an example of the authentication failure database. Referring to Fig. 23, the authentication failure database stores user IDs, passwords, contact information, and the number of failures in association with each other.

[0138] Note that the authentication failure database shown in Fig. 23 is merely an example, and is not intended to limit the items stored therein. For example, contact information can be acquired from the authentication information database based on the user ID and password, and therefore may not be included in the authentication failure database. Alternatively, face images and feature amounts may be stored in the authentication failure database.

[0139] When processing an authentication request, the authentication unit 205 calculates similarities between the feature included in the authentication request and multiple feature stored in the authentication information database. If there is at least one similarity that is greater than a threshold TH6 and less than or equal to a threshold TH5 (TH6<similarity≦TH5) among the calculated similarities, the authentication unit 205 updates the authentication failure database or adds an entry.

[0140] That is, if the calculated similarity does not exceed the threshold TH5 at which the person is recognized as the real person, but exceeds the similarity TH6 at which the person is determined to be a completely different person, the authentication unit 205 determines that the person has failed authentication due to a change in appearance. In this case, the authentication unit 205 registers information on the user who is most similar to the person to be authenticated (the user with the closest similarity) in the authentication failure database. The user who is most similar to the person to be authenticated is the user who is presumed to be the person to be authenticated.

[0141] The authentication unit 205 reads out the user ID, password, and contact information from the entry (entry in the authentication information database) of the feature corresponding to the largest similarity among the similarities included in the above range (TH6<similarity≦TH5). The authentication unit 205 searches the authentication failure database using the read user ID and password as keys. If a corresponding entry does not exist, the authentication unit 205 adds a new entry to the database. At that time, the number of failures is set to "1".

[0142] As a result of searching the authentication failure database using the user ID and password as keys, if a corresponding entry is found, the authentication unit 205 increments (adds 1) the value in the failure count field of the identified entry.

[0143] In this way, authentication unit 205 stores (registers) the number of times authentication has failed for a user who is presumed to be authenticated in the authentication failure database.

[0144] The facial image update recommendation unit 206 is a means for recommending to a user to update a registered facial image. When authentication of a person to be authenticated fails, the facial image update recommendation unit 206 recommends to a user who is presumed to be the person to be authenticated among a plurality of users to update the biometric information (facial image) stored in the authentication information database. More specifically, when it is determined that the user's appearance or the like has changed and facial authentication has failed, the facial image update recommendation unit 206 notifies the terminal 40 carried by the user of that effect.

[0145] The facial image update recommendation unit 206 periodically or at a predetermined timing refers to the authentication failure database and acquires the value of the failure count field of each entry. The facial image update recommendation unit 206 decides whether or not to recommend updating of the facial image of a user who is presumed to be the person to be authenticated, based on the number of authentication failures. More specifically, the facial image update recommendation unit 206 executes threshold processing on the acquired failure count, and transmits a "facial image update recommendation notice" to the terminal 40 according to the result.

[0146] If the number of failures is greater than the threshold TH7, the facial image update recommendation unit 206 transmits a "facial image update recommendation notification" to the corresponding contact. The terminal 40 that receives the notification displays a message as shown in Fig. 24, and prompts the user to update the registered facial image.

[0147] The facial image update recommendation notice may include various information. For example, the facial image update recommendation unit 206 may transmit a facial image update recommendation notice including a facial image of a user presumed to be authenticated (a facial image registered in the authentication information database) to the terminal 40. In this case, the terminal 40 may display a display as shown in Fig. 25. If a user sees a display as shown in Fig. 25 and his / her face is displayed, he / she will be satisfied and will update the facial image registered in the authentication server 10.

[0148] Alternatively, when the user registers in the system, the system registration date, the age at the time of registration, and the like may also be stored in the authentication information database, and the facial image update recommendation unit 206 may transmit a facial image update recommendation notice including this information to the terminal 40. Alternatively, the facial image update recommendation unit 206 may transmit a facial image update recommendation notice including the system registration period since the facial image was registered (or updated) to the terminal 40. In this case, the user can recognize that the facial image has not been updated for a long period of time, which may motivate the user to update the facial image.

[0149] The operation of the face image update recommendation unit 206 can be summarized as shown in the flowchart of FIG.

[0150] The face image update recommendation unit 206 compares the number of failures in the authentication failure database with a threshold value TH7 (step S301).

[0151] If the number of failures is greater than the threshold value TH7 (step S301, Yes branch), the facial image update recommendation unit 206 transmits a facial image update recommendation notice to the terminal 40 (step S302).

[0152] If the number of failures is equal to or less than the threshold value TH7 (step S301, No branch), the face image update recommendation unit 206 does not perform any particular operation.

[0153] The storage unit 207 stores information necessary for the operation of the authentication server 10. In the storage unit 207, an authentication information database (first database) and an authentication failure database (second database) are constructed.

[0154] [Management Server] Fig. 27 is a diagram showing an example of a processing configuration (processing module) of the management server 20 according to the first embodiment. Referring to Fig. 27, the management server 20 includes a communication control unit 301, a personal information acquisition unit 302, a service registration request unit 303, a database management unit 304, an authentication request unit 305, and a storage unit 306.

[0155] The communication control unit 301 is a means for controlling communication with other devices. For example, the communication control unit 301 receives data (packets) from the authentication server 10 and the authentication terminal 30. The communication control unit 301 also transmits data to the authentication server 10 and the authentication terminal 30. The communication control unit 301 passes data received from other devices to other processing modules. The communication control unit 301 transmits data acquired from other processing modules to other devices. In this way, the other processing modules transmit and receive data to and from other devices via the communication control unit 301.

[0156] The personal information acquisition unit 302 is a means for acquiring personal information required when the service provider provides the service. For example, when the service provider is a "retailer", the personal information acquisition unit 302 acquires payment-related information (e.g., credit card information, bank account information) in addition to the user's name, etc. Alternatively, when the service provider is a "hotel operator", the personal information acquisition unit 302 acquires reservation information regarding accommodation (e.g., accommodation date, etc.) in addition to the user's name, etc.

[0157] The personal information acquisition unit 302 acquires the above personal information such as the name, as well as the user ID and password determined when the user registered with the system.

[0158] The personal information acquiring unit 302 acquires personal information, a user ID, and a password by using any means. For example, the personal information acquiring unit 302 displays a GUI or a form for inputting the above information on the terminal 40 (see FIG. 28). Alternatively, the information as shown in FIG. 28 may be displayed on a WEB page managed and operated by the service provider. Alternatively, the terminal 40 may download an application provided by the service provider, and the display as shown in FIG. 28 may be performed by the application. In particular, the WEB page may be a WEB page that manages the member information of the service provider. That is, the members of each service provider may register for a service on a WEB page that manages their own member information.

[0159] The personal information acquisition unit 302 passes the personal information, user ID, and password acquired using a GUI or the like to a service registration request unit 303 .

[0160] The service registration request unit 303 is a means for requesting (requesting) the authentication server 10 to register the user's use of the service.

[0161] The service registration request unit 303 selects the user ID and password from the above three pieces of information (personal information, user ID, and password) acquired from the personal information acquisition unit 302. The service registration request unit 303 transmits a service registration request including the selected user ID, password, and service provider ID to the authentication server 10.

[0162] The service registration request unit 303 acquires a response to the service registration request from the authentication server 10. If the acquired response is a "negative response", the service registration request unit 303 notifies the user of that fact. For example, the service registration request unit 303 notifies the user that the service registration has already been performed.

[0163] If the acquired response is an "affirmative response", the service registration request unit 303 notifies the user that the service registration was successful. In addition, the service registration request unit 303 passes the service user ID included in the response and the personal information acquired from the personal information acquisition unit 302 to the database management unit 304.

[0164] The database management unit 304 is a means for managing a user information database. The user information database is a database for managing information on users (system users) to whom services are provided. The user information database stores personal information (e.g., name, etc.) of the users in association with the service user ID acquired from the authentication server 10.

[0165] The database management unit 304 adds a new entry to the user information database when it acquires the above information (personal information, service user ID) from the service registration request unit 303. For example, when the management server 20 of the service provider S1 acquires the above information regarding the user U1, the entry shown at the bottom of Fig. 29 is added.

[0166] The authentication request unit 305 is a means for requesting the authentication server 10 to authenticate the user.

[0167] When the authentication request unit 305 acquires biometric information (face image) from the authentication terminal 30, the authentication request unit 305 generates features from the face image. The authentication request unit 305 transmits an authentication request including the generated features and the service provider ID to the authentication server 10.

[0168] If the response from the authentication server 10 is a "negative response" (if the authentication has failed), the authentication request unit 305 notifies the authentication terminal 30 accordingly.

[0169] If the response from the authentication server 10 is an "affirmative response" (if the authentication is successful), the authentication request unit 305 extracts the service user ID included in the response from the authentication server 10. The authentication request unit 305 searches the user information database using the service user ID as a key, and identifies the corresponding entry.

[0170] The authentication request unit 305 reads out the personal information set in the personal information field of the identified entry, and transmits it to the authentication terminal 30. For example, in the example of FIG. 29, if the service user ID is “U1S1”, the personal information in the bottom row is transmitted to the authentication terminal 30.

[0171] The storage unit 306 stores information necessary for the operation of the management server 20. A user information database is constructed in the storage unit 306.

[0172] [Authentication device] The authentication terminal 30 transmits biometric information acquired from the user to the management server 20, thereby acquiring personal information of the user from the management server 20. The authentication terminal 30 provides services to the user using the acquired personal information.

[0173] Fig. 30 is a diagram showing an example of a processing configuration (processing module) of the authentication terminal 30 according to the first embodiment. Referring to Fig. 30, the authentication terminal 30 includes a communication control unit 401, a biometric information acquisition unit 402, a service providing unit 403, a message output unit 404, and a storage unit 405.

[0174] The communication control unit 401 is a means for controlling communication with other devices. For example, the communication control unit 401 receives data (packets) from the management server 20. The communication control unit 401 also transmits data to the management server 20. The communication control unit 401 passes data received from other devices to other processing modules. The communication control unit 401 transmits data acquired from other processing modules to other devices. In this way, the other processing modules transmit and receive data to and from other devices via the communication control unit 401.

[0175] The biometric information acquisition unit 402 is a means for controlling the camera and acquiring the biometric information (face image) of the user. The biometric information acquisition unit 402 captures an image in front of the device periodically or at a predetermined timing. The biometric information acquisition unit 402 determines whether or not the acquired image contains a human face image, and if a face image is included, extracts the face image from the acquired image data.

[0176] Since existing technologies can be used for the facial image detection process and facial image extraction process by the biometric information acquisition unit 402, detailed explanations will be omitted. For example, the biometric information acquisition unit 402 may extract a facial image (face region) from image data using a learning model learned by a CNN (Convolutional Neural Network). Alternatively, the biometric information acquisition unit 402 may extract a facial image using a method such as template matching.

[0177] The biometric information acquiring unit 402 passes the extracted face image to the service providing unit 403 .

[0178] The service providing unit 403 is a means for providing a predetermined service to a user. The service providing unit 403 transmits the face image acquired from the biometric information acquiring unit 402 to the management server 20. The management server 20 returns personal information (e.g., name, etc.) corresponding to the face image. The service providing unit 403 uses the returned personal information to provide the user with a service.

[0179] The message output unit 404 is a means for outputting various messages to the user. For example, the message output unit 404 outputs a message regarding the authentication result of the user and a message regarding the provision of services. The message output unit 404 may display a message using a display device such as a liquid crystal monitor, or may play an audio message using an audio device such as a speaker.

[0180] The storage unit 405 stores information necessary for the operation of the authentication terminal 30 .

[0181] [System Operation] Next, a description will be given of the operation of the authentication system according to the first embodiment. Note that the description of the operation will focus on the service registration phase and the service provision phase, and a description of the user registration phase will be omitted.

[0182] FIG. 31 is a sequence diagram showing an example of operations related to the service registration phase of the authentication system according to the first embodiment.

[0183] The management server 20 acquires personal information (information necessary to provide a service), a user ID, and a password from the user (step S01).

[0184] The management server 20 transmits a service registration request including the acquired user ID, password, and service provider ID to the authentication server 10 (step S02).

[0185] The authentication server 10 generates a service user ID using the acquired user ID, password, and service provider ID (step S03).

[0186] The authentication server 10 stores the service provider ID and the service user ID in the authentication information database (step S04).

[0187] The authentication server 10 transmits a response (response to the service registration request) including the service user ID to the management server 20 (step S05).

[0188] The management server 20 associates the personal information acquired in step S01 with the service user ID acquired from the authentication server 10 and stores them in the user information database (step S06).

[0189] FIG. 32 is a sequence diagram showing an example of an operation related to the service providing phase of the authentication system according to the first embodiment.

[0190] The authentication terminal 30 acquires a facial image (biometric information) of the user, and transmits the acquired facial image to the management server 20 (step S11).

[0191] The management server 20 generates features from the acquired face image (step S12).

[0192] The management server 20 transmits an authentication request including the generated feature amount and the service provider ID to the authentication server 10 (step S13).

[0193] The authentication server 10 executes authentication processing using the feature amount and the service provider ID included in the authentication request, and identifies the corresponding service user ID (step S14).

[0194] The authentication server 10 transmits a response (response to the authentication request) including the identified service user ID to the management server 20 (step S15).

[0195] The management server 20 searches the user information database using the acquired service user ID, and identifies the corresponding personal information (step S16).

[0196] The management server 20 transmits the specified personal information to the authentication terminal 30 (step S17).

[0197] The authentication terminal 30 uses the acquired personal information to provide a service (step S18).

[0198] As described above, when the authentication system according to the first embodiment fails to authenticate a person to be authenticated, it judges whether the authentication has failed due to a change in the person's appearance or the like. When it is judged that the authentication has failed due to a change in the person's appearance or the like, the authentication server 10 identifies a user who is presumed to be the person to be authenticated from among the users registered in the authentication information database. The authentication server 10 accumulates information on such people to be authenticated (people who have failed authentication but cannot be determined to be completely different people) in an authentication failure database. In addition, when authentication has failed multiple times for the same user (a user who is presumed to be the person to be authenticated), the authentication server 10 prompts the user to update his / her face image. As a result, the user can update the face image registered in the authentication server 10 at an appropriate time, and the possibility of authentication failure is reduced. That is, the authentication accuracy of the authentication system is maintained at a high level for a long period of time.

[0199] In the authentication system according to the first embodiment, the authentication server 10 determines whether or not to update the registered face image based on the similarity between the registered face image and the updated face image. If the similarity between the two face images is very high, the authentication server 10 determines that the face image of the user who was initially registered in the system has been used as the face image for updating, and updates the face image. On the other hand, if the similarity between the two face images is very low, the authentication server 10 determines that the face image of a person other than the user who was initially registered in the system has been used as the face image for updating, and rejects the update of the face image. For example, if the appearance of the user has changed over time and the two face images are somewhat different, the authentication server 10 requests the user to submit an identity document. The authentication server 10 updates the face image when the identity of the person in the face image used for updating can be confirmed by comparing the verification face image and the updated face image described in the identity document. In other words, when it is unclear from only the registered face image and the updated face image whether the user registered in the system and the person updating the face image match, the authentication server 10 uses an identity document to confirm the match between the system user and the provider of the updated face image. As a result, the authentication server 10 can prevent unauthorized updates to the registered face image.

[0200] [Second embodiment] Next, the second embodiment will be described in detail with reference to the drawings.

[0201] In the first embodiment, the authentication server 10 identifies users who have been registered in the system and have failed to be authenticated due to changes in appearance, etc. Furthermore, the authentication server 10 prompts the identified users to update their facial images via the terminals 40 carried by the users. In the second embodiment, a case will be described in which the authentication server 10 prompts the users to update their facial images via the authentication terminals 30.

[0202] The configuration of the authentication system according to the second embodiment can be the same as that of the first embodiment, and therefore the explanation corresponding to Fig. 2 will be omitted. Also, the processing configurations of the authentication server 10, management server 20, and authentication terminal 30 according to the second embodiment can be the same as those of the first embodiment, and therefore the explanation thereof will be omitted.

[0203] The following description will focus on the differences between the first and second embodiments.

[0204] In the second embodiment, the user does not need to register contact information in the authentication server 10 when registering in the system. That is, the contact information field does not need to exist in the authentication information database shown in Fig. 19 etc. In addition, the terminal 40 as a means for receiving a facial image update recommendation notification from the authentication server 10 does not need to be included in the system.

[0205] The authentication failure database according to the second embodiment stores biometric information (feature amount) of an individual who has failed in authentication in association with the number of failures (see FIG. 33).

[0206] Fig. 34 is a flowchart showing an example of the operation of authentication unit 205 according to the second embodiment. In Fig. 34, when the similarity is greater than threshold value TH5 (step S202, Yes branch), the subsequent operations can be the same as the operations of authentication unit 205 according to the first embodiment described with reference to Fig. 22, and therefore the description thereof will be omitted.

[0207] When authentication of the person to be authenticated fails, the authentication unit 205 judges whether the calculated similarity is greater than a threshold value TH6 (step S211). If the similarity is greater than the threshold value TH6 (step S211, Yes branch), the authentication unit 205 performs a matching process using the authentication failure database (step S212). Specifically, the authentication unit 205 sets the feature amount of the person to be authenticated to the matching side and the feature amount registered in the authentication failure database to the registration side, and performs 1:N matching.

[0208] After that, the authentication unit 205 updates the authentication failure database (step S213).

[0209] If the result of the above matching process is that there is no feature that substantially matches the feature of the person to be authenticated, authentication unit 205 adds a new entry to the authentication failure database and sets the number of failures field to "1." Authentication unit 205 also sets the feature of the person to be authenticated in the added entry.

[0210] If the result of the above matching process is that there is a feature that substantially matches the feature of the person to be authenticated, authentication unit 205 adds "1" to the value in the number of failures field of the corresponding entry.

[0211] Thereafter, the authentication unit 205 transfers the feature amount of the person to be authenticated to the facial image update recommendation unit 206, and instructs the user corresponding to the feature amount to determine whether or not a recommendation to update the facial image is necessary (step S214). As in the first embodiment, the facial image update recommendation unit 206 performs threshold processing on the number of failures of the person to be authenticated, and determines whether or not a recommendation regarding updating the facial image is necessary based on the result. The facial image update recommendation unit 206 responds with the determination result to the authentication unit 205.

[0212] If a recommendation is not required (step S215, No branch), the authentication unit 205 notifies the source of the authentication request of the authentication failure (step S216). Note that, even if the calculated similarity is not greater than the threshold value TH6 (step S211, No branch), the authentication unit 205 also notifies the source of the authentication request of the authentication failure.

[0213] If a recommendation is necessary (step S215, Yes branch), the authentication unit 205 instructs the facial image update recommendation unit 206 to transmit a facial image update recommendation notification (step S217).

[0214] The facial image update recommendation unit 206 that has received the instruction transmits a facial image update recommendation notification to the management server 20 that is the sender of the authentication request. The notification is transferred to the authentication terminal 30 that has acquired the biometric information of the person to be authenticated. The authentication terminal 30 displays a message as shown in Fig. 24 to prompt the person to be authenticated to update his / her facial image.

[0215] In this way, the authentication server 10 according to the second embodiment transmits a facial image update recommendation notice instead of an authentication result when it is necessary to prompt a facial image update. Alternatively, the authentication server 10 may include information (a flag) in a negative response to an authentication request indicating that the negative response corresponds to a "facial image update recommendation notice." In this case, the authentication terminal 30 can display different messages to the person who has failed in authentication depending on whether a normal authentication failure has been received or an authentication failure corresponding to a facial image update recommendation has been received.

[0216] As described above, the authentication system according to the second embodiment can urge the person to be authenticated to update his / her face image when the person fails authentication a predetermined number of times. That is, in the second embodiment, instead of the user who is presumed to be the person to be authenticated, the person to be authenticated, who is verified as the person in front of the authentication terminal 30, is recommended to update his / her face image. As a result, like the first embodiment, the authentication accuracy can be maintained.

[0217] Next, the hardware of each device constituting the authentication system will be described.

[0218] The authentication server 10 can be configured by an information processing device (so-called a computer), and has the configuration exemplified in Fig. 35. For example, the authentication server 10 includes a processor 311, a memory 312, an input / output interface 313, and a communication interface 314. The components such as the processor 311 are connected by an internal bus or the like, and are configured to be able to communicate with each other.

[0219] However, the configuration shown in Fig. 35 is not intended to limit the hardware configuration of the authentication server 10. The authentication server 10 may include hardware not shown, and may not include the input / output interface 313 as necessary. Furthermore, the number of processors 311 and the like included in the authentication server 10 is not intended to be limited to the example shown in Fig. 35, and for example, the authentication server 10 may include multiple processors 311.

[0220] The processor 311 is, for example, a programmable device such as a central processing unit (CPU), a micro processing unit (MPU), or a digital signal processor (DSP). Alternatively, the processor 311 may be a device such as a field programmable gate array (FPGA), or an application specific integrated circuit (ASIC). The processor 311 executes various programs including an operating system (OS).

[0221] The memory 312 is a random access memory (RAM), a read only memory (ROM), a hard disk drive (HDD), a solid state drive (SSD), etc. The memory 312 stores an OS program, application programs, and various data.

[0222] The input / output interface 313 is an interface for a display device and an input device (not shown). The display device is, for example, a liquid crystal display, etc. The input device is, for example, a keyboard, a mouse, etc. that accepts user operations.

[0223] The communication interface 314 is a circuit, a module, etc. that communicates with other devices. For example, the communication interface 314 includes a network interface card (NIC).

[0224] The functions of the authentication server 10 are realized by various processing modules. The processing modules are realized, for example, by the processor 311 executing a program stored in the memory 312. The program can be recorded in a computer-readable storage medium. The storage medium can be a non-transitory medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. That is, the present invention can also be embodied as a computer program product. The program can be downloaded via a network, or updated using a storage medium storing the program. The processing modules may also be realized by a semiconductor chip.

[0225] The management server 20, authentication terminal 30, and terminal 40 can also be configured from information processing devices like the authentication server 10, and their basic hardware configurations are not described here because they are no different from the authentication server 10. For example, the authentication terminal 30 may be provided with a camera for capturing an image of the user.

[0226] The authentication server 10, which is an information processing device, is equipped with a computer, and the computer executes a program to realize the functions of the authentication server 10. The authentication server 10 also executes a face image update recommendation method by means of the program.

[0227] [Variations] The configuration, operation, and the like of the authentication system described in the above embodiment are merely examples, and are not intended to limit the system configuration, and the like.

[0228] In the above embodiment, it has been described that a user determines a user ID and a password, and identifies a user (system user) registered in the system using the user ID and password. However, the authentication system may determine an ID (identifier) ​​that uniquely identifies a system user. For example, in the user registration phase, the authentication server 10 acquires biometric information (face image, feature amount) of the user. The authentication server 10 may generate the above ID based on the biometric information. For example, the authentication server 10 may calculate a hash value from the feature amount of the face image, and use the calculated hash value instead of the user ID and password. The feature amount of the face image differs for each user, and the hash value generated from the feature amount also differs for each user, so it can be used as the ID of the system user.

[0229] In the above embodiment, it has been described that the user registration phase and the service registration phase are executed at different times, but these phases may be executed substantially at the same time. For example, the authentication terminal 30 installed at the service provider to which the user wishes to provide a service may be used to execute the above two registration phases. Specifically, the user may use the authentication terminal 30 to perform user registration (input of biometric information, user ID, and password), and then, successively, perform service registration (input of personal information, user ID, and password). In this case, the authentication terminal 30 may be provided with a user registration function (user management unit 202) of the authentication server 10 and a personal information acquisition function (personal information acquisition unit 302) of the management server 20.

[0230] The multiple authentication terminals 30 owned by the service provider do not have to be installed on the same premises, building, etc. If the service provider is the same, the authentication terminals 30 may be installed in spatially separated locations.

[0231] In the above embodiment, one service provider ID is assigned to one service provider, but one service provider ID may be assigned to multiple service providers. Multiple service providers may be grouped together and a service provider ID may be issued for each group. For example, when service providers S1 and S2 cooperate with each other to provide the same service, a common service provider ID may be issued to these service providers S1 and S2.

[0232] In the above embodiment, a case has been described in which biometric information related to "feature amounts generated from a facial image" is transmitted from the management server 20 to the authentication server 10. However, biometric information related to a "facial image" may be transmitted from the management server 20 to the authentication server 10. In this case, the authentication server 10 may generate feature amounts from the acquired facial image and execute the authentication process (matching process).

[0233] In the above embodiment, the authentication terminal 30 acquires a face image, and the management server 20 generates features from the face image. However, the authentication terminal 30 may generate features from a face image and transmit the generated features to the management server 20. In other words, the management server 20 does not have to generate features.

[0234] In the above embodiment, the authentication server 10 stores the biometric information (face image, feature amount) of the user, and the management server 20 stores the personal information (name, etc.) of the user. However, these two servers may be integrated, and the integrated server may store the biometric information and the personal information. That is, the authentication terminal 30 may transmit the biometric information to the integrated server, and the server may transmit the corresponding personal information to the authentication terminal 30 as a result of the authentication process.

[0235] In the above embodiment, the feature amount generated from the registered face image is stored in the authentication information database, but the feature amount does not have to be stored in the database. The authentication server 10 may generate the feature amount from the registered face image every time it processes an authentication request.

[0236] In the above embodiment, it has been described that identity verification is performed using an identification document when the user registers in the system, but this identity verification may be omitted. Identity verification of system users may be performed individually by the service provider. That is, the management server 20 may perform identity verification using biometric information (face image) and an identification document. In this case, the management server 20 may delete the biometric information after identity verification is completed.

[0237] Alternatively, a staff member at the authentication center may perform identity verification using a facial image and an identification document acquired from the user, and input information of the identified user (user ID, password, facial image) to the authentication server 10.

[0238] In the above embodiment, it has been described that old features and facial images are deleted (overwritten with new features and facial images) when updating a facial image, but the old features and facial images may also be left in the database. Furthermore, if old features remain, the authentication server 10 may also use the old features in the matching process. For example, if the matching process using new features (updated features) is unsuccessful, the authentication server 10 may use the old features in the matching process. This approach can absorb slight changes in appearance, etc., and improve authentication accuracy.

[0239] Although the format of data transmission between each device (authentication server 10, management server 20, authentication terminal 30) is not particularly limited, data transmitted between these devices may be encrypted. Biometric information is transmitted between these devices, and in order to appropriately protect the biometric information, it is desirable to transmit and receive encrypted data.

[0240] In the above embodiment, the terminal 40 of the user is described as being used to update a face image. The terminal 40 may be used for purposes other than updating a face image. For example, the user may use the terminal 40 to update other information registered in the authentication server 10. For example, the user may use the terminal 40 to access the authentication server 10 and select a service provider from which a service is to be provided by biometric authentication. That is, the user may register for a service via the authentication server 10. In this case, if there are many service providers, a service provider that is used less frequently or has not been used recently may be displayed preferentially. Alternatively, the user may use the terminal 40 to apply for withdrawal from the system or the service.

[0241] In the above embodiment, the face image update recommendation unit 206 transmits a face image update recommendation notification based on the number of authentication failures of a user who is presumed to be authenticated. However, the face image update recommendation unit 206 may determine whether or not to transmit a face image update recommendation notification based on other information instead of or in addition to the number of failures. For example, it may be determined whether or not to transmit a face image update recommendation notification based on the age of the user. For example, in the case of a minor, the face changes quickly over time, so the face image update recommendation unit 206 may transmit a face image update recommendation notification with a small number of failures. That is, the face image update recommendation unit 206 may change the threshold value TH7 that determines the transmission of a face image update recommendation notification based on the age of the user (user registered in the authentication failure database). Alternatively, the face image update recommendation unit 206 may change the threshold value TH7 based on the elapsed time from the time of system registration. Specifically, if the period of system registration is short, the threshold value TH7 is set to be large, and if the period is long, the threshold value TH7 is set to be small. By taking such measures, the longer a user remains registered in the system, the more likely it is that a facial image update recommendation notification will be sent.

[0242] When authentication fails multiple times in response to an authentication request from the same authentication terminal 30 (management server 20), the authentication server 10 may prompt the authentication terminal 30 to update the face image. For example, when authentication fails, the authentication server 10 may hold the most recent feature amount of the person to be authenticated, and when it is determined that authentication has failed for the same person, may prompt the authentication server 10 to update the face image via the management server 20 and the authentication terminal 30.

[0243] The authentication server 10 may change the threshold value TH6 for estimating the person who has failed authentication depending on the sender of the authentication request (management server 20). For example, consider a case where the environment in which the authentication terminal 30 is installed is poor and there is a high tendency for authentication to fail. The reliability of a face image acquired in such an environment and the authentication result using the face image is low. Therefore, the authentication server 10 sets the threshold value TH6 high. As a result, it is possible to prevent a low-reliability result acquired in a poor environment from being registered in the authentication failure database.

[0244] The authentication server 10 may store the authentication history of a user registered in the authentication failure database. Specifically, the authentication server 10 may store information on the service providers (management server 20) that have successfully authenticated the user and the service providers that have failed to authenticate the user in association with each other. When there are many authentication failures for a particular service provider, the authentication server 10 may notify the service provider of this fact. For example, when the probability of successful authentication differs greatly between multiple service providers, the authentication server 10 may notify the service provider that has many authentication failures of this fact and urge them to improve the face image capture environment, etc.

[0245] In the above embodiment, the authentication server 10 registers users who are presumed to have failed authentication due to changes in appearance or the like in an authentication failure database. When registering the users in the database, the authentication server 10 may notify the authentication terminal 30 of the fact via the management server 20. For example, upon receiving the notification, the authentication terminal 30 may display a message such as "Your authentication has failed. The facial image registered in the system may be out of date. We recommend that you update your facial image." When urging (recommending) to update the facial image via the authentication terminal 30 in this way, the user does not need to register contact information in the authentication server 10.

[0246] In the above embodiment, a case has been described in which, for users who have failed authentication and whose similarity falls within a predetermined range (TH6<similarity≦TH5), information on the users is stored using an authentication failure database. However, the authentication server 10 may be configured to uniformly store information on each user who has failed authentication. When authentication fails, the authentication server 10 may register information on the user corresponding to the highest similarity in the authentication failure database.

[0247] In the second embodiment, the authentication unit 205 registers the feature amount of the authentication-subject who has failed to be authenticated in the authentication failure database. However, instead of the feature amount of the authentication-subject, the authentication unit 205 may register the feature amount corresponding to the largest value of the calculated similarities in the authentication failure database. That is, the authentication failure database may store the feature amount of a user who is presumed to be the authentication-subject among a plurality of users (the user with the largest similarity) in association with the number of authentication failures. Furthermore, when the authentication unit 205 fails to authenticate the authentication-subject, it identifies the entry of the authentication-subject who has failed to be authenticated by performing a matching process using the feature amount stored in the authentication failure database and the feature amount of the authentication-subject who has failed to be authenticated. The authentication unit 205 updates the value of the failure count field of the identified entry.

[0248] In the flow charts (flow charts, sequence diagrams) used in the above description, multiple steps (processes) are described in order, but the order of execution of the steps executed in the embodiments is not limited to the order described. In the embodiments, the order of the steps shown in the figures can be changed to a degree that does not interfere with the content, such as executing each process in parallel.

[0249] The above-mentioned embodiments have been described in detail to facilitate understanding of the present disclosure, and it is not intended that all of the configurations described above are necessary. In addition, when a plurality of embodiments are described, each embodiment may be used alone or in combination. For example, it is possible to replace a part of the configuration of an embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of an embodiment. Furthermore, it is possible to add, delete, or replace a part of the configuration of an embodiment with another configuration.

[0250] The above explanation makes clear the industrial applicability of the present invention, and the present invention is suitably applicable to authentication systems for authenticating customers of retail stores, hotels, etc. However, the application of the present disclosure is not limited to authentication systems, and the present disclosure is suitable for systems that update biometric information (especially registered face images).

[0251] A part or all of the above-described embodiments can be described as, but is not limited to, the following supplementary notes. [Appendix 1] a first database that stores biometric information relating to the face of each of a plurality of users; an authentication unit that refers to the first database and authenticates a person to be authenticated; a recommendation unit that, when authentication of the person to be authenticated fails, recommends an update of biometric information stored in the first database to a user who is presumed to be the person to be authenticated, among the plurality of users; An authentication server comprising: [Appendix 2] 2. The authentication server according to claim 1, wherein the recommendation unit recommends updating the biometric information when it is determined that authentication has failed due to a change in the appearance of the person to be authenticated. [Appendix 3] the first database stores feature amounts generated from face images of the respective users; The authentication unit calculating a similarity between each of the plurality of feature amounts stored in the first database and the feature amount of the person to be authenticated; Identifying a user who is presumed to be the person to be authenticated based on a result of threshold processing of the calculated similarity; 3. The authentication server according to claim 1 or 2, further comprising: a second database configured to store information about the identified user. [Appendix 4] The authentication server described in Appendix 3, wherein the authentication unit estimates that the user corresponding to the largest similarity among the calculated similarities that is greater than a first threshold and less than or equal to a second threshold is the person to be authenticated. [Appendix 5] 5. The authentication server according to claim 4, wherein the first threshold is a threshold for determining that the person to be authenticated is the person himself / herself, and the second threshold is a threshold for determining that the person to be authenticated is a different person. [Appendix 6] the authentication unit stores in the second database at least the number of times authentication has failed for the user who is presumed to be the person to be authenticated; 6. The authentication server according to claim 3, wherein the recommendation unit determines whether to recommend updating the biometric information based on the number of times the authentication has failed. [Appendix 7] The authentication server according to claim 6, wherein the recommendation unit recommends updating the biometric information based on a result of threshold processing for the number of authentication failures. [Appendix 8] 8. The authentication server according to claim 3, wherein the second database stores contact information of the user who is presumed to be the person to be authenticated. [Appendix 9] The authentication server of claim 8, wherein the recommendation unit sends a facial image update recommendation notification to contacts stored in the second database. [Appendix 10] The authentication server according to claim 9, wherein the recommendation unit transmits the facial image update recommendation notification including a facial image of a user who is presumed to be the person to be authenticated, the facial image being stored in a first database. [Appendix 11] The authentication server according to claim 9 or 10, wherein the recommendation unit transmits the face image update recommendation notification including at least one of an age of the user presumed to be the person to be authenticated, a system registration date, and a system registration period. [Appendix 12] 12. The authentication server according to any one of appendices 9 to 11, wherein the recommendation unit determines whether or not to send the facial image update recommendation notification depending on the age or system registration period of the user who is presumed to be the person to be authenticated. [Appendix 13] 2. The authentication server according to claim 1, wherein the recommendation unit, on behalf of a user presumed to be the person to be authenticated, recommends to the person to be authenticated that the biometric information stored in the first database be updated. [Appendix 14] a second database for storing the number of times authentication of the authenticated person has failed if authentication of the authenticated person has failed; 14. The authentication server of claim 13, wherein the recommendation unit recommends the person to be authenticated to update the biometric information when the number of times authentication failures of the person to be authenticated is greater than a predetermined value. [Appendix 15] the second database stores the biometric information of the person to be authenticated and the number of times the authentication has failed in association with each other; The authentication server of claim 14, wherein, when authentication of the person to be authenticated fails, the authentication unit identifies an entry of the person to be authenticated who has failed to be authenticated by performing a matching process using the biometric information stored in the second database and the biometric information of the person to be authenticated who has failed to be authenticated, and updates the number of times authentication has failed for the identified entry. [Appendix 16] the second database stores biometric information of a user who is presumed to be the person to be authenticated among the plurality of users in association with the number of times the authentication has failed; The authentication server of claim 14, wherein, when authentication of the person to be authenticated fails, the authentication unit identifies an entry of the person to be authenticated who has failed to be authenticated by performing a matching process using the biometric information stored in the second database and the biometric information of the person to be authenticated who has failed to be authenticated, and updates the number of times authentication has failed for the identified entry. [Appendix 17] An authentication server including a first database that stores biometric information relating to the faces of a plurality of users, Referencing the first database to authenticate the person to be authenticated; A facial image update recommendation method for, when authentication of the person to be authenticated fails, recommending to a user among the plurality of users who is presumed to be the person to be authenticated to update biometric information stored in the first database. [Appendix 18] A computer installed in an authentication server having a first database that stores biometric information on the faces of each of a plurality of users, a process of authenticating an authentication subject by referring to the first database; a process of recommending, when authentication of the person to be authenticated fails, to a user who is presumed to be the person to be authenticated among the plurality of users to update biometric information stored in the first database; A computer-readable storage medium that stores a program for executing the above.

[0252] The disclosures of the above cited prior art documents are incorporated herein by reference. Although the embodiments of the present invention have been described above, the present invention is not limited to these embodiments. It will be understood by those skilled in the art that these embodiments are merely illustrative and that various modifications are possible without departing from the scope and spirit of the present invention. In other words, the present invention naturally includes various modifications and amendments that a person skilled in the art can make in accordance with the entire disclosure, including the scope of the claims, and the technical ideas. [Explanation of symbols]

[0253] 10, 100 Authentication Servers 20 Management Server 30 Authentication terminal 40 Terminals 101 The first database 102, 205 Authentication Department 103 Advisory Department 201, 301, 401 Communication control unit 202 User Management Department 203, 304 Database (DB) Management Department 204 Service Registration Department 206 Facial Image Update Recommendation Section 207, 306, 405 Storage section 302 Personal Information Acquisition Department 303 Service Registration Request Section 305 Authentication Request Section 311 Processor 312 Memory 313 Input / Output Interface 314 Communication Interface 402 Biometric information acquisition unit 403 Service Provision Department 404 Message output section

Claims

1. a first database that stores first biometric information relating to the faces of each of a plurality of users; an authentication unit that refers to the first database and authenticates a person to be authenticated; a recommendation unit that uses the number of times authentication of the subject has failed to recommend to a user who is presumed to be the subject of authentication among the plurality of users to update the first biometric information stored in the first database; a receiving unit that receives second biometric information related to a face of the user presumed to be the person to be authenticated from the user presumed to be the person to be authenticated; an update unit that determines whether or not to update the first biometric information stored in the first database with the second biometric information based on a similarity between the first biometric information and the second biometric information of the user who is presumed to be the subject of authentication; An authentication server comprising:

2. The authentication unit stores in a second database at least the number of times authentication has failed for the user presumed to be the authenticatee, the recommendation unit determines whether or not to recommend updating the biometric information depending on a result of threshold processing for the number of authentication failures, and recommends updating the biometric information when a recommendation is necessary. The authentication server of claim 1 .

3. The authentication server according to claim 1 , wherein the recommendation unit is further configured to recommend updating the biometric information when it is determined that authentication has failed due to a change in the person's appearance.

4. the first database stores feature amounts generated from face images of the respective users; The authentication unit calculating a similarity between each of the plurality of feature amounts stored in the first database and the feature amount of the person to be authenticated; Identifying a user who is presumed to be the person to be authenticated based on a result of threshold processing of the calculated similarity; The authentication server according to claim 2 , further comprising: storing information of the identified user in the second database.

5. 5. The authentication server according to claim 4, wherein the authentication unit presumes that the user corresponding to the largest similarity value among the calculated similarities that is greater than a first threshold value and is equal to or smaller than a second threshold value is the person to be authenticated.

6. 6. The authentication server according to claim 5, wherein the first threshold is a threshold for determining that the person to be authenticated is a different person, and the second threshold is a threshold for determining that the person to be authenticated is the person himself / herself.

7. 7. The authentication server according to claim 1, wherein the recommendation unit recommends updating the biometric information by a recommendation notification including a facial image of a user who is presumed to be the person to be authenticated, the facial image being stored in the first database.

8. The authentication server according to claim 1 , wherein the recommendation unit determines whether or not to recommend updating the biometric information based further on at least one of an age of the user and a period of system enrollment.

9. 2. The authentication server according to claim 1, wherein the recommendation unit, on behalf of a user presumed to be the person to be authenticated, recommends the person to be authenticated to update the biometric information stored in the first database.

10. An authentication server including a first database that stores first biometric information relating to the faces of each of a plurality of users, referring to the first database to authenticate the person to be authenticated; performing a recommendation process for recommending an update of the first biometric information stored in the first database to a user who is presumed to be the person to be authenticated among the plurality of users, using the number of times authentication of the person to be authenticated has failed; receiving second biometric information relating to a face of the user presumed to be the person to be authenticated from the user presumed to be the person to be authenticated; A facial image update recommendation method for determining whether or not to update the first biometric information stored in the first database with the second biometric information based on the similarity between the first biometric information and the second biometric information of a user who is presumed to be the person to be authenticated.

11. A computer installed in an authentication server having a first database that stores first biometric information related to the faces of each of a plurality of users, a process of authenticating an authentication subject by referring to the first database; a recommendation process for recommending an update of the first biometric information stored in the first database to a user who is presumed to be the person to be authenticated, among the plurality of users, by using the number of times authentication of the person to be authenticated has failed; receiving second biometric information relating to a face of the user presumed to be the person to be authenticated from the user presumed to be the person to be authenticated; and determining whether or not to update the first biometric information stored in the first database with the second biometric information based on the degree of similarity between the first biometric information and the second biometric information of the user who is presumed to be the person to be authenticated.

Images