Authentication device, authentication system, and authentication method

Abstract

This authentication device (101) comprises a first authentication unit (103) for executing a first authentication process using first biological information and personal identification information, a master information management unit (105) for causing master information that includes the first biological information and / or feature information indicating the features of the first biological information to be stored in a storage unit (104) when the first authentication process is successful, and a third authentication unit (106) for executing a third authentication process using third biological information and the master information when a second authentication process is successful.

Description

[Technical field]

[0001] The present invention relates to an authentication device and an authentication system. and Authentication Method By law Regarding. [Background technology]

[0002] In terminals such as smartphones and tablets, personal authentication processing may be performed during terminal login to log in when transitioning from a sleep state to an operating state, starting up the terminal, etc. In addition to personal authentication processing based on a combination of a user ID (identifier) ​​and password, some terminal logins use biometric information such as a face image captured by a camera or a fingerprint obtained by a sensor.

[0003] Here, the sleep state is a state in which available functions are restricted by accepting only limited operations, etc. The operating state is a state in which the functions of the terminal (including the functions of application software installed on the terminal) can be used without restrictions in the sleep state, etc. Typically, a terminal in the sleep state accepts an operation to transition to the operating state, and transitions to the operating state when the user successfully completes the user authentication process in the terminal login executed in response to the operation.

[0004] On the other hand, some application software (hereinafter simply referred to as "apps") installed on terminals handles highly confidential information, such as processing for receiving services from a bank's system. When launching such an app or receiving a specific service using the app, the app often performs identity authentication processing.

[0005] For example, Patent Document 1 discloses a monitoring system including a monitoring device to be operated and an operator monitoring device that monitors the person operating the monitoring device. The operator monitoring device described in Patent Document 1 includes a face image storage unit that stores face image data (face image data for comparison) captured in advance together with an operating authority level.

[0006] Patent Document 1 also describes that an operator A, who is given a high level of operating authority, logs into a monitoring device using his / her own password, and when the monitoring device starts up, the facial image data of the operator A is captured and the captured facial image data is collated with facial image data for comparison. It also describes that when the monitoring device is started up and operated, the facial image data (current facial image data) of the operator currently operating the device is collated with the facial image data for comparison, thereby enabling operation according to the operating authority. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] JP 2008-165353 A Summary of the Invention [Problem to be solved by the invention]

[0008] In the personal authentication process for device login, only the result of the personal authentication process may be output, and the biometric information used in the personal authentication process may not be output. In such cases, it is often difficult to obtain the biometric information used in the personal authentication process for device login using the app's functions. If it is assumed that the personal authentication process for device login is used for the personal authentication process in the app, it is considered that the result of the personal authentication process for device login will be used directly in the personal authentication process in the app.

[0009] However, for example, if image data referenced in the identity authentication process in terminal login is tampered with, there is a possibility that an incorrect result of the identity authentication process is output in the terminal login. Therefore, if the result of the identity authentication process in terminal login is used as is in the identity authentication process in the app, there is a risk that the identity authentication process in the app will be performed incorrectly, and there is a risk that the accuracy of the identity authentication process in the app will decrease.

[0010] Furthermore, in the case of identity authentication processing in an app, identity authentication processing may be performed using a method different from that used for device login in order to improve the accuracy of identity authentication, etc. In such cases, even if the biometric information itself used for identity authentication processing in device login could be obtained using the app's functions, it would be difficult to use that biometric information for identity authentication processing in the app.

[0011] The technology described in Patent Document 1 relates to a monitoring system that monitors the person operating the monitoring device, and it is considered difficult to apply this technology to the above-mentioned application login.

[0012] The present invention has been made in view of the above circumstances, and one of its objects is to enable accurate personal authentication processing separate from personal authentication processing in a device such as a terminal. [Means for solving the problem]

[0013] In order to achieve the above object, an authentication device according to a first aspect of the present invention comprises: a first authentication means for executing a first authentication process using a face image included in the first biometric information and a face image included in personal identification information indicating a document for personal identification; a master information management means for storing master information including at least one of the first biometric information and feature information indicating a feature of the first biometric information in a storage means when the first authentication process is successful; and a third authentication means for executing a third authentication process by using the third biometric information and the master information when the second authentication process is successful. 、 The second authentication process is an authentication process executed by a terminal. do.

[0014] In order to achieve the above object, an authentication system according to a second aspect of the present invention comprises: The authentication device, A terminal, The authentication device includes: a first authentication means for executing a first authentication process using a face image included in the first biometric information and a face image included in personal identification information indicating a document for personal identification; a master information management means for storing master information including at least one of the first biometric information and feature information indicating a feature of the first biometric information in a storage means when the first authentication process is successful; a third authentication means for executing a third authentication process by using the third biometric information and the master information when the second authentication process is successful; The terminal includes: A first generating means for generating the first biological information; A second generating means for generating second biometric information; A third generating means for generating the third biometric information; and a second authentication means for executing the second authentication process by using the second biometric information.

[0015] In order to achieve the above object, an authentication method according to a third aspect of the present invention comprises: The computer performing a first authentication process using a facial image included in the first biometric information and a facial image included in identification information indicating a document for identification; if the first authentication process is successful, storing master information including at least one of the first biometric information and feature information indicating a feature of the first biometric information in a storage means; and executing a third authentication process using the third biometric information and the master information when the second authentication process is successful. fruit, The second authentication process is an authentication process executed by a terminal. . Effect of the Invention

[0017] According to the present invention, it is possible to perform highly accurate personal authentication processing separate from the personal authentication processing in a device such as a terminal. [Brief description of the drawings]

[0018] [Figure 1]1 is a diagram illustrating an example of a configuration of an authentication system according to a first embodiment of the present invention. [Diagram 2] FIG. 2 is a diagram illustrating an example of a physical configuration of the authentication device according to the first embodiment. [Diagram 3] FIG. 2 is a diagram illustrating an example of a physical configuration of a terminal according to the first embodiment. [Figure 4] 4 is an example of a flowchart of terminal login according to the first embodiment of the present invention. [Diagram 5] 1 is a flowchart illustrating an example of an account opening process according to the first embodiment of the present invention. [Figure 6] 1 is a flowchart illustrating an example of an account opening process according to the first embodiment of the present invention. [Figure 7] FIG. 2 is a diagram illustrating an example of a configuration of master information. [Figure 8] 4 is an example of a flowchart of system login according to the first embodiment of the present invention. [Figure 9] FIG. 11 is a diagram illustrating an example of the configuration of an authentication system according to a second embodiment of the present invention. [Figure 10] 13 is a flowchart illustrating an example of an account opening process according to the second embodiment of the present invention. [Figure 11] 13 is an example of a flowchart of system login according to the second embodiment of the present invention. [Figure 12] FIG. 13 is a diagram illustrating a configuration example of an authentication device according to a first modified example. [Figure 13] FIG. 13 is a diagram illustrating a configuration example of an authentication system according to a first modified example. [Figure 14] 13 is a flowchart showing an example of a personal authentication process according to the first modification. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0019] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. In all the drawings, the same components are denoted by the same reference numerals, and the description thereof will be omitted as appropriate.

[0020] <<Embodiment 1>> The authentication system 100 according to the first embodiment of the present invention is a system that performs personal authentication processing. The personal authentication processing is processing for confirming whether or not a person is the person in question.

[0021] 1, the authentication system 100 includes an authentication device 101 and a terminal 102 on which application software (hereinafter, also simply referred to as an "app") is pre-installed. Note that there may be multiple terminals 102.

[0022] The authentication device 101 and the terminal 102 are connected to each other via a network N, which is a communication network constructed using wired or wireless means or a combination of these, and are capable of transmitting and receiving information to and from each other via the network N.

[0023] The application pre-installed in the terminal 102 is for utilizing a service provided by a system (computer system) associated with the application. In this embodiment, an example will be described in which the application pre-installed in the terminal 102 is for utilizing a service provided by a bank system. Services provided by a bank system include, for example, account opening, transfer, and remittance.

[0024] The application installed on the terminal 102 is not limited to this, and may be any appropriate application.

[0025] (Functional configuration of authentication device 101) The authentication device 101 is a server of the bank system associated with the application. The authentication device 101 performs, for example, an identity authentication process for using services provided by the bank system through the functions of the application installed on the terminal 102.

[0026] 1, authentication device 101 functionally includes a first authentication unit 103, a storage unit 104, a master information management unit 105, and a third authentication unit 106. Although not shown, authentication device 101 may further include a function for implementing a service provided by a bank system.

[0027] The first authentication unit 103 executes a first authentication process using the first biometric information and the personal identification information.

[0028] The first authentication process is one of the identity authentication processes performed by the authentication device 101. The first authentication process is, for example, identity authentication process performed when opening a bank account or the like through the function of an application installed in the terminal 102. Such a first authentication process is identity authentication process performed when particularly high-precision identity verification is required, that is, identity authentication process with particularly high accuracy.

[0029] In detail, the first authentication unit 103 includes a first acquisition unit 107 and a first authentication processing unit .

[0030] The first acquisition unit 107 acquires the first biometric information and the personal identification information from the terminal 102 via the network N.

[0031] The first biometric information is information about the person's biometrics. The first biometric information is, for example, an image including the person's face (i.e., a face image). Includes. One piece of biometric information includes at least one image of a predetermined facial expression or movement of the person in addition to or instead of a facial image.

[0032] As described later, the first biological information is generated by the terminal 102. Note that the first biological information may be generated by another device (not shown) connected to the network N.

[0033] The first biometric information is not limited to these images of the person (including facial images and images other than facial images), and may include, for example, one or more of an image of the person, a fingerprint, veins, and irises.

[0034] The personal identification information is information indicating a personal identification document (document for personal identification). The document indicated by the personal identification information is a document including a face image of the person, such as a driver's license, a document indicating a My Number, which is a number unique to each citizen (so-called My Number card), etc. The personal identification information is, for example, image information obtained by photographing a document, and in this embodiment, is generated by the terminal 102 as described later.

[0035] In addition, the personal identification information may be generated not only by photographing a document but also by scanning the document using a scanner or the like, or may be generated by another device (not shown) connected to the network N.

[0036] The first authentication processing unit 108 executes the first authentication processing using the first biometric information and the personal identification information acquired by the first acquisition unit 107.

[0037] In detail, for example, in the first authentication process, the first authentication processing unit 108 extracts a face image included in the personal identification information by image processing. Then, in the first authentication process, it determines whether the extracted face image and the face image obtained from the first biometric information are face images of the same person, and outputs the result of the determination. If the result of this determination is that the face images are of the same person, it indicates that the first authentication process has been successful, and if the face images are not of the same person, it indicates that the first authentication process has failed.

[0038] Conventional techniques may be applied to the image processing for extracting a face image included in the personal identification information and for determining whether the face images are of the same person. As such techniques, for example, image processing techniques using machine learning are suitable.

[0039] For example, the first authentication processing unit 108 extracts a facial image included in the personal identification information by using a learning model trained by machine learning. In this case, the first authentication processing unit 108 outputs the facial image included in the personal identification information by inputting the personal identification information to a learning model trained by machine learning for extracting a human face from image information showing a document.

[0040] The input data to the learning model during learning is image information of a document including a human face image. The input data may be image information of a document of the same type as the document indicated by the identity verification information. In machine learning, supervised learning may be performed in which the area of ​​a human face according to the image information is the correct answer.

[0041] For example, the first authentication processing unit 108 judges whether the face images are of the same person using a learning model trained by machine learning. In this case, the first authentication processing unit 108 inputs the face image extracted from the personal identification information and the first biometric information including the face image to a trained learning model that has been trained through machine learning to judge whether the face image extracted from the personal identification information and the face image included in the first biometric information are of the same person, and outputs the result of the judgment as to whether the face image extracted from the personal identification information and the face image included in the first biometric information are of the same person.

[0042] Input data to the learning model during learning is a face image extracted from the personal identification information and the first biometric information including the face image. The input data may include personal identification information and the first biometric information of the same person, and personal identification information and the first biometric information of different people. In machine learning, supervised learning may be performed in which the correct answer is whether the face image extracted from the personal identification information and the face image included in the first biometric information are the same person.

[0043] For example, if the first biometric information includes at least one image of a predetermined facial expression or movement of the person, in the first authentication process, a facial image for the first authentication process may be determined from an image included in the first biometric information. In this case, the first authentication processing unit 108 outputs a facial image for the first authentication process by inputting the first biometric information into a trained learning model that has undergone machine learning to determine a facial image for the first authentication process from the first biometric information.

[0044] Input data to the learning model during learning is the first biometric information including images of predetermined facial expressions and movements. In machine learning, a learning model for determining whether or not face images are of the same person may be used to perform supervised learning in which the correct answer is whether or not the result of the determination obtained from the face image determined from the first biometric information and the face image included in the identification document as input data.

[0045] In many cases, facial images of a person with no facial expression are used on identification documents, and it is desirable to use a facial image with a facial expression similar to that of the facial image included in the identification document for comparison. By performing a process of determining a facial image for the first authentication process from the first biometric information, a facial image suitable for the first authentication process can be obtained from images of predetermined facial expressions and movements included in the first biometric information. In this case, it is preferable to use the determined facial image and the facial image extracted from the identification information to determine whether these facial images are facial images of the same person.

[0046] The first acquisition unit 107 may acquire personal information including one or more of the person's address, name, date of birth, etc. In this case, the first authentication processing unit 108 may further determine whether the personal information acquired by the first acquisition unit 107 matches the personal information included in the personal identification information. For example, a conventional character recognition technology may be adopted as a technology for acquiring the personal information from the personal identification information.

[0047] Various types of information are stored in the storage unit 104. For example, master information is stored in the storage unit 104. The master information is information including at least one of first biometric information and feature information indicating features of the first biometric information.

[0048] The master information management unit 105 stores the master information in the storage unit 104 .

[0049] When the master information includes the first biometric information, the master information management unit 105 stores the first biometric information acquired by the first acquisition unit 107 in the storage unit 104. When the master information includes characteristic information, the master information management unit 105 generates characteristic information related to a predetermined characteristic from the first biometric information acquired by the first acquisition unit 107, and stores the generated characteristic information in the storage unit 104. The characteristic information includes, for example, a value related to the predetermined characteristic.

[0050] If the second authentication process is successful, the third authentication unit 106 executes the third authentication process using the third biometric information and the master information.

[0051] Here, the second authentication process is an individual authentication process performed in the terminal 102, and is different from the first authentication process and the third authentication process. The second authentication process is an individual authentication process performed, for example, in terminal login for logging in to the terminal 102.

[0052] The third authentication process is one of the personal authentication processes performed by the authentication device 101. process is, for example, an identity authentication process for logging in to a bank system associated with an application installed on the terminal 102.

[0053] In the third authentication process, personal identification information may be used, but it is not necessary to use personal identification information. In that respect, the third authentication process may be less accurate than the first authentication process.

[0054] However, master information generated based on the first biometric information acquired during the first authentication process is used. In addition, if the first biometric information includes images of predetermined facial expressions and movements, this can also improve the accuracy of the third authentication process. Therefore, the third authentication process is an identity authentication process that ensures a certain degree of accuracy, that is, a highly accurate identity authentication process.

[0055] Furthermore, when the second authentication process is an identity authentication process based on a combination of a user ID (identifier) ​​and a password, the third authentication process can generally be said to be an identity authentication process with higher accuracy than the second authentication process in that it uses biometric authentication.

[0056] Even when the second authentication process uses biometric information, it is often unclear what kind of biometric information will be used and how it will be used in the second authentication process. In contrast, since the third authentication process is performed by the authentication device 101, it is clear what kind of biometric information will be used and how it will be used in the identity authentication process. Therefore, the third authentication process can be said to be identity authentication process in which a certain degree of high accuracy is reliably ensured, that is, highly accurate identity authentication process.

[0057] In detail, the third authentication unit 106 includes a third acquisition unit 109 and a third authentication processing unit 110.

[0058] The third acquisition unit 109 acquires the third biometric information from the terminal 102 via the network N. The third biometric information is transmitted from the terminal 102 during or after the second authentication process, for example, and is acquired from the terminal during or after the second authentication process.

[0059] The third biometric information is information about the biological information of the person. In this embodiment, the third biometric information is generated by the terminal 102. The third biometric information includes, for example, a face image of the person, or includes an image of a predetermined facial expression or movement of the person in addition to or instead of the face image.

[0060] The third biometric information is only required to include the same type of biometric information as the first biometric information, and is not limited to images of the person (including facial images and images other than facial images), but may include, for example, one or more of an image of the person, a fingerprint, veins, and iris.

[0061] If the second authentication process executed by the terminal 102 is successful, the third authentication processing unit 110 executes the third authentication process using the third biometric information acquired by the third acquisition unit 109 and the master information stored in the memory unit 104.

[0062] In detail, for example, when the master information includes the first biometric information, the third authentication processing unit 110 generates feature information on a predetermined feature from the first biometric information. When the master information includes the feature information, the third authentication processing unit 110 acquires the feature information from the storage unit 104.

[0063] The third authentication processing unit 110 generates, from the third biometric information acquired by the third acquisition unit 109, feature information relating to a predetermined feature.

[0064] Then, the third authentication processing unit 110 compares the characteristic information obtained from the master information with the characteristic information obtained from the third biometric information, and determines whether the master information and the third biometric information are of the same person based on the comparison result. If the information is of the same person, the result of this determination indicates that the third authentication process was successful, and if the information is not of the same person, the result indicates that the third authentication process was unsuccessful.

[0065] A conventional technique may be applied to the process for determining whether the information is of the same person, and an image processing technique using machine learning is suitable as such a technique.

[0066] For example, the third authentication processing unit 110 judges whether the master information and the third biometric information are information of the same person using a learning model trained by machine learning. In this case, the third authentication processing unit 110 inputs the master information and the third biometric information to a trained learning model that has undergone machine learning to judge whether the master information and the third biometric information are information of the same person, and outputs the result of the judgment as to whether these pieces of information are information of the same person.

[0067] The input data to the learning model during learning is master information including at least one of the first biometric information and feature information obtained from the first biometric information, and the third biometric information. The input data includes master information and third biometric information of the same person, and feature information of a different person. No.In the machine learning, it is preferable to perform supervised learning in which a correct answer is whether the master information and the third biometric information are information of the same person.

[0068] (Functional configuration of terminal 102) Terminal 102 includes a display unit 111, an audio output unit 112, a first generation unit 113, a confirmation information generation unit 114, a second generation unit 115, a third generation unit 116, a second authentication unit 117, and a terminal communication unit 118.

[0069] The display unit 111 displays various types of information. The audio output unit 112 outputs audio.

[0070] When the first generating unit 113 receives an instruction to open an account or the like through a function of a pre-installed application, the first generating unit 113 generates the first biometric information. For example, the first generating unit 113 takes an image of the person and generates the first biometric information including the captured image. This image may be either a still image or a moving image.

[0071] For example, when the first biometric information includes a face image, a guide indicating a range in which the face should be positioned is displayed on the display unit 111 together with the captured real-time image during shooting. When the face is positioned within a predetermined range in the shooting area, the first generating unit 113 captures the face and generates the first biometric information including the face image. Note that instead of or together with the guide on the display unit 111, a voice such as "Please position your face in the center of the screen" may be used to guide the face to be positioned within the predetermined range.

[0072] For example, when the first biometric information includes at least one image of a predetermined facial expression or movement of the person, at the time of photographing, at least one of the predetermined facial expressions or movements is instructed to the person by one or both of characters displayed on the display unit 111 and sound output from the sound output unit 112. The first generating unit 113 photographs the person making a facial expression, movement, etc. according to the instruction, and generates the first biometric information including at least one image of the predetermined facial expression or movement.

[0073] The confirmation information generating unit 114 generates personal identification information following generation of the first biometric information by the first generating unit 113. The confirmation information generating unit 114 takes an image of an identification document, for example, and generates personal identification information including the captured image.

[0074] When generating the personal identification information, for example, when photographing, a guide showing the range in which the personal identification document should be positioned is displayed on the display unit 111 together with the photographed real-time image. When the personal identification document is positioned within a predetermined range in the photographing area, the confirmation information generating unit 114 photographs the personal identification document and generates personal identification information including the image of the personal identification document. Note that instead of or together with the guide on the display unit 111, a voice such as "Please position the personal identification document in the center of the screen" may be used to guide the user to position the face within the predetermined range.

[0075] It should be noted that after receiving an instruction to open an account or the like, either the generation of the first biometric information by the first generating unit 113 or the generation of the personal identification information by the confirmation information generating unit 114 may be executed first.

[0076] For example, when receiving an instruction to log in to the terminal 102, the second generating unit 115 generates second biometric information. The second biometric information is biometric information used in a second authentication process described later. The second biometric information includes at least one of a face image, a fingerprint, veins, and an iris. That is, the second biometric information may include the same type of biometric information as the biometric information included in the first biometric information, or may include a different type of biometric information from the biometric information included in the first biometric information.

[0077] When the third generating unit 116 receives an instruction to log in to the bank's system through a function of a pre-installed application, the third generating unit 116 generates the third biometric information. For example, the third generating unit 116 takes an image of the person and generates the third biometric information including the captured image. This image may be either a still image or a moving image.

[0078] For example, when the third biometric information includes a face image, the third generation unit 116 generates the third biometric information including a face image in the same manner as described in the case where the first biometric information includes a face image.

[0079] For example, when the third biometric information includes at least one image of the person's predetermined facial expression or movement, the third generation unit 116 generates the third biometric information including at least one image of the predetermined facial expression or movement in a manner similar to that described when the first biometric information includes a similar image.

[0080] When the second biometric information is generated by the second generation unit 115, the second authentication unit 117 executes a second authentication process using the second biometric information. The second authentication process is, for example, a personal authentication process performed at the time of terminal login. The second authentication unit 117 is typically a function realized by software installed in the terminal 102 together with the OS (operating system) of the terminal 102.

[0081] The terminal communication unit 118 transmits and receives information to and from the authentication device 101 via the network N.

[0082] The terminal communication unit 118 transmits, for example, first biometric information and personal identification information generated in response to an instruction to open an account or the like to the authentication device 101. The terminal communication unit 118 transmits, for example, third biometric information generated in response to an instruction to log in to a bank system to the authentication device 101.

[0083] Up to this point, the description has been mainly given of the functional configuration of the authentication system 100 according to the embodiment 1. From now on, the physical operation of the authentication system 100 according to the embodiment 1 will be described.

[0084] The authentication system 100 is physically composed of an authentication device 101 and a terminal 102, which are connected via a network N.

[0085] (Physical configuration of authentication device 101) The authentication device 101 is physically, for example, a general-purpose computer.

[0086] In detail, for example, the authentication device 101 has a physical configuration as shown in FIG. 2, which includes a bus 1010, a processor 1020, a memory 1030, a storage device 1040, a network interface 1050, an output interface 1060, and an input interface 1070.

[0087] The bus 1010 is a data transmission path for transmitting and receiving data between the processor 1020, the memory 1030, the storage device 1040, the network interface 1050, the output interface 1060, and the input interface 1070. However, the method of connecting the processor 1020 and the like to each other is not limited to bus connection.

[0088] The processor 1020 is implemented by a central processing unit (CPU), a graphics processing unit (GPU), or the like.

[0089] The memory 1030 is a main storage device realized by a RAM (Random Access Memory) or the like.

[0090] The storage device 1040 is an auxiliary storage device realized by a hard disk drive (HDD), a solid state drive (SSD), a memory card, a read only memory (ROM), or the like. The storage device 1040 stores program modules for realizing each functional unit of the authentication device 101. The processor 1020 loads each of these program modules into the memory 1030 and executes them, thereby realizing each functional unit corresponding to the program module.

[0091] The network interface 1050 is an interface for connecting the authentication device 101 to the network N.

[0092] The output interface 1060 is a liquid crystal panel, an organic EL (Electro-Luminescence) panel, or the like, which serves as an interface for presenting information to the user.

[0093] The input interface 1070 is a touch panel, a keyboard, a mouse, or the like, which serves as an interface for the user to input information.

[0094] (Physical configuration of terminal 102) The terminal 102 is physically, for example, a tablet PC (Personal Computer), a smartphone, or the like.

[0095] In detail, for example, the terminal 102 has a physical configuration as shown in FIG. 3, which includes a bus 2010, a processor 2020, a memory 2030, a storage device 2040, a network interface 2050, an output interface 2060, an input interface 2070, a speaker 2080, and a camera 2090.

[0096] The bus 2010 is a data transmission path for transmitting and receiving data among the processor 2020, the memory 2030, the storage device 2040, the network interface 2050, the output interface 2060, the input interface 2070, the speaker 2080, and the camera 2090. However, the method of connecting the processor 2020 and the like to each other is not limited to bus connection.

[0097] The processor 2020 is a processor realized by a CPU, a GPU, etc. The memory 2030 is a main storage device realized by a RAM, etc. The storage device 2040 is an auxiliary storage device realized by a HDD, an SSD, a memory card, a ROM, etc.

[0098] The storage device 2040 stores program modules for implementing each functional unit of the terminal 102. The processor 2020 loads each of these program modules into the memory 2030 and executes them to implement each functional unit corresponding to the program module.

[0099] In this embodiment, the program modules stored in the storage device 2040 are included in the OS (operating system), apps, etc. of the terminal 102. In general, the functions of an app may be realized only by the app's program module, but may also be realized by combining a function realized by the app's program module with a function realized by the OS's program module.

[0100] The functions of the display unit 111, the audio output unit 112, the first generation unit 113, the confirmation information generation unit 114, the third generation unit 116, and the device communication unit 118 according to this embodiment include functions realized by program modules included in the application. The functions of the second generation unit 115 and the second authentication unit 117 are functions realized by program modules included in the OS.

[0101] The network interface 2050 is an interface for connecting the terminal 102 to the network N. The output interface 2060 is a liquid crystal panel, an organic EL panel, or the like, serving as an interface for presenting information to a user. The input interface 2070 is a touch panel, a keyboard, a mouse, or the like, serving as an interface for a user to input information.

[0102] The speaker 2080 outputs audio. The camera 2090 is a device for photographing an object, and generates image information including the object.

[0103] Instead of or in addition to the camera 2090, the terminal 102 may have at least one of a sensor for detecting a fingerprint, a sensor for detecting veins, and a sensor for detecting an iris.

[0104] Up to this point, the description has been mainly given of the physical configuration of the authentication system 100 according to embodiment 1. From here, the operation of the authentication system 100 according to embodiment 1 will be described.

[0105] (Operation of authentication system 100) The authentication system 100 performs identity authentication processing, which includes terminal login, account opening processing, system login, and the like.

[0106] (Terminal login) Terminal login is a process for logging in to the terminal 102, and is executed, for example, when the terminal 102 is switched on or when the terminal 102 is switched on from a sleep state to an operating state.

[0107] The sleep state is a state in which available functions are restricted. In the sleep state, for example, the available functions are restricted by limiting the operations that can be accepted to predetermined operations such as operations for transitioning to the operating state.

[0108] The operating state is a state in which the functions of the terminal (including the functions of application software installed on the terminal) can be used. When the personal authentication process (second authentication process) during terminal login is successful, the terminal 102 enters the operating state.

[0109] In this embodiment, the use of app functions on the terminal 102 is restricted not only when the power is off, but also when the terminal 102 is in a sleep state. Therefore, terminal login is a prerequisite for using the bank system through the terminal 102. Terminal login is initiated, for example, when a predetermined operation for logging in to the terminal 102 (for example, touching a touch panel or pressing a button) is performed, or when the terminal 102 is powered on.

[0110] As shown in the flowchart of FIG. 4, the second generating unit 115 generates second biometric information (step S101).

[0111] In detail, for example, when an operation for logging in to the terminal 102 is performed or the power is turned on, the second generation unit 115 starts detection by a sensor in response to the operation. Here, a case where the sensor is a camera will be described as an example. In this case, the second generation unit 115 starts capturing an image in response to the operation. Then, the second generation unit 115 generates second biometric information including the captured image.

[0112] The second authentication unit 117 executes the second authentication process using the second biometric information generated in step S101 (step S102).

[0113] In detail, for example, the second authentication unit 117 compares the feature amount of a preregistered face image with the feature amount of an image included in the second biometric information, and determines whether or not these feature amounts match. The preregistered face image is a face image of the user of the terminal 102, and information including this face image is held in advance in, for example, the second authentication unit 117.

[0114] Here, matching is not limited to when the feature amounts are the same, but also includes when the difference in the feature amounts is within a predetermined range, and the same applies hereinafter.

[0115] The second authentication unit 117 determines whether or not the second authentication process is successful (step S103).

[0116] In detail, for example, when the second biometric information includes a face image and the feature amount of the face image matches the feature amount of the pre-registered face image, the second authentication unit 117 determines that the second authentication process is successful. When the second biometric information does not include a face image and when the feature amount of the face image included in the second biometric information does not match the feature amount of the pre-registered face image, the second authentication unit 117 determines that the second authentication process is unsuccessful.

[0117] If it is determined that the second authentication process has failed (step S103; No), the second authentication unit 117 ends the terminal login. In this case, the terminal 102 maintains a sleep state, or enters a sleep state after power-on. At this time, the second authentication unit 117 may cause the display unit 111 to display a message indicating that the second authentication process has failed.

[0118] If it is determined that the second authentication process is successful (step S103; Yes), the second authentication unit 117 puts the terminal 102 into an operating state, for example, causes the display unit 111 to display a menu screen, which is the initial screen (step S104), and terminates the terminal login.

[0119] (Account opening process) The account opening process is a process for opening a bank account via the terminal 102. The account opening process is started, for example, after logging in to the terminal 102, launching an app, and receiving an instruction to start the account opening process.

[0120] As shown in the flowchart of FIG. 5, the first generating unit 113 generates the first biometric information (Step S201).

[0121] In detail, for example, when an operation for starting an account opening process is performed, the first generating unit 113 starts capturing an image in response to the operation. The first generating unit 113 displays a guide indicating a range in which to position the face together with the captured real-time image on the display unit 111. When the face is positioned within a predetermined range in the capture area, the first generating unit 113 generates first biometric information including the face image at that time.

[0122] The terminal communication unit 118 transmits the first biometric information generated in step S201 to the authentication device 101 via the network N (step S202). As a result, the first acquisition unit 107 acquires the first biometric information from the terminal 102 (step S203).

[0123] The confirmation information generating unit 114 generates personal confirmation information (step S204).

[0124] In detail, for example, the confirmation information generating unit 114 displays a guide indicating the range in which the identification document is positioned together with a real-time image captured by the camera on the display unit 111. When the identification document is positioned within a predetermined range in the photographed area, the confirmation information generating unit 114 generates identification information including the image of the identification document at that time.

[0125] The terminal communication unit 118 transmits the personal identification information generated in step S204 to the authentication device 101 via the network N (step S205). As a result, the first acquisition unit 107 acquires the personal identification information from the terminal 102 (step S206).

[0126] The first authentication processing unit 108 executes the first authentication process using the first biometric information and the personal identification information acquired in steps S203 and S106 (step S207).

[0127] In detail, for example, the first authentication processing unit 108 extracts a facial image included in the personal identification information by image processing, and obtains a feature amount of the extracted facial image. The first authentication processing unit 108 obtains a feature amount of the facial image included in the first biometric information.

[0128] The first authentication processing unit 108 compares the feature amount of the face image included in the personal identification information with the feature amount of the face image included in the first biometric information. If the compared feature amounts match, the first authentication processing unit 108 determines that the face images included in the personal identification information and the first biometric information are of the same person. If the compared feature amounts do not match, the first authentication processing unit 108 determines that the face images included in the personal identification information and the first biometric information are not of the same person.

[0129] As shown in FIG. 6, the first authentication unit 103 determines whether or not the first authentication process has been successful (step S208).

[0130] In detail, for example, when the face images included in the personal identification information and the first biometric information are of the same person, the first authentication unit 103 determines that the first authentication process is successful. On the other hand, when the face images included in the personal identification information and the first biometric information are not of the same person, the first authentication unit 103 determines that the first authentication process is unsuccessful.

[0131] If it is determined that the first authentication process has failed (step S208; No), the first authentication unit 103 notifies the terminal 102 via the network N that the account cannot be opened (step S209), and ends the account opening process.

[0132] The notification sent in step S209 is acquired by terminal communication unit 118, which then displays, for example, a message to the effect that the account cannot be opened on display unit 111. This allows the user to know that the first authentication process has failed.

[0133] The notification in step S209 also includes the user ID of the master information, and the user ID may be acquired and held by the third acquisition unit 109, for example.

[0134] When it is determined that the first authentication process is successful (step S208; Yes), the master information management unit 105 generates master information and stores it in the storage unit 104 (step S210).

[0135] 7 is a diagram showing an example of the master information generated and stored in step S210. In the master information shown in the diagram, a user ID, first biometric information, characteristic information, and an account number are associated with each other.

[0136] The user ID is information for identifying a user. The first biometric information is information acquired in step S203. The feature information includes a feature amount of a face image included in the first biometric information. The feature amount of the face image included in the first biometric information is acquired in step S207. The account number is a number for identifying an account, and is assigned when generating master information according to, for example, a predetermined rule.

[0137] When personal information is acquired from the terminal 102 by the first acquisition unit 107, the personal information may be further included in the master information.

[0138] The first authentication unit 103 notifies the terminal 102 via the network N that the account opening has been accepted (step S211), and ends the account opening process.

[0139] The notification sent in step S211 is acquired by terminal communication unit 118, which then displays, for example, a message to the effect that the account opening has been accepted on display unit 111. This allows the user to know that the first authentication process has been successful.

[0140] (System login) System login is a process for logging in to a bank's system through the terminal 102. This system is associated with an application installed on the terminal 102. By logging in to the system, the user can, for example, ,mouth seat Open Setting did Later, you can use the account to make transfers, remittances, and other services.

[0141] System login is initiated, for example, when an operation to start an application is performed on the terminal 102 after terminal login.

[0142] As shown in the flowchart of FIG. 8, the third generating unit 116 generates the third biometric information (Step S301).

[0143] In detail, for example, when an operation for starting an app is performed, the third generating unit 116 starts capturing an image in response to the operation. The third generating unit 116 displays a guide indicating a range in which the face is positioned together with a captured real-time image on the display unit 111. When the face is positioned within a predetermined range in the capture area, the third generating unit 116 generates third biometric information including the face image at that time.

[0144] The process of step 301 may be performed during execution of step S101 in the terminal login. In this case, in step S101, the second biometric information and the third biometric information are generated using a common face image generated by a camera.

[0145] The terminal communication unit 118 transmits the user ID stored in advance and the third biometric information generated in step S301 to the authentication device 101 via the network N (step S302). As a result, the third acquisition unit 109 acquires the user ID and the third biometric information from the terminal 102 (step S303).

[0146] The third authentication processing unit 110 executes the third authentication process using the user ID and the third biometric information acquired in step S303 and the master information stored in the storage unit 104 in step S210 (step S304).

[0147] In detail, for example, the third authentication processing unit 110 refers to the master information and acquires feature information associated with the user ID acquired in step S303. Note that the third authentication processing unit 110 may acquire the feature information by using the first biometric information included in the master information to obtain a feature amount of the face image included in the first biometric information.

[0148] The third authentication processing unit 110 obtains a feature amount of the face image included in the third biometric information.

[0149] The third authentication processing unit 110 compares the feature amount included in the characteristic information of the master information with the feature amount of the face image included in the third biometric information. If these compared feature amounts match, the third authentication processing unit 110 determines that the characteristic information of the master information and the third biometric information are information of the same person. If the compared feature amounts do not match, the third authentication processing unit 110 determines that the characteristic information of the master information and the third biometric information are not information of the same person.

[0150] The third authentication unit 106 determines whether or not the third authentication process is successful (step S305).

[0151] In detail, for example, when the characteristic information of the master information and the third biometric information are information of the same person, the third authentication unit 106 determines that the third authentication process is successful. On the other hand, when the characteristic information of the master information and the third biometric information are not information of the same person, the third authentication unit 106 determines that the third authentication process is unsuccessful.

[0152] If it is determined that the third authentication process has failed (step S305; No), the third authentication unit 106 notifies the terminal 102 via the network N that the login has failed (step S306), System Login Exit.

[0153] The notification transmitted in step S306 is acquired by the terminal communication unit 118, and the terminal communication unit 118 displays, for example, a message to the effect that login has failed on the display unit 111. This allows the user to know that the third authentication process has failed.

[0154] When it is determined that the third authentication process is successful (step S305; Yes), the third authentication unit 106 notifies the terminal 102 via the network N that the login was successful (step S307), System Login Exit.

[0155] The notification sent in step S306 is acquired by the terminal communication unit 118, which then displays, for example, an initial screen such as a menu screen on the display unit 111. This allows the user to know that the third authentication process has been successful, and allows the user to use the services provided by the bank's system through the terminal 102.

[0156] So far, the first embodiment of the present invention has been described.

[0157] In this embodiment, master information including at least one of the first biometric information used in the first authentication process and feature information indicating features of the first biometric information is stored, and if the second authentication process is successful, the third authentication process is executed using the third biometric information and the master information.

[0158] Since the first authentication process is performed using the first biometric information and the personal identification information, the first biometric information is information confirmed with reference to the personal identification information, and is highly likely to be the biometric information of the person. Therefore, the first biometric information and feature information of the master information are also highly likely to be information based on the biometric information of the person. Since the third authentication process can be performed using such master information, the third authentication process can perform highly accurate personal authentication. Moreover, the third authentication process is performed when the second authentication process is successful.

[0159] Therefore, accurate personal authentication processing (first authentication processing and third authentication processing) separate from the personal authentication processing (second authentication processing) in the terminal 102 becomes possible.

[0160] In this embodiment, the processes in the first authentication process and the third authentication process are different from the process in the second authentication process. That is, the processes in the first authentication process and the second authentication process are different from each other, and the processes in the third authentication process and the second authentication process may be different from each other. As a result, even if the process in the second authentication process is unknown or is relatively low-precision personal authentication, the first authentication process and the third authentication process can perform highly accurate personal authentication.

[0161] Therefore, accurate personal authentication processing (first authentication processing and third authentication processing) separate from the personal authentication processing (second authentication processing) in the terminal 102 becomes possible.

[0162] The process in the first authentication process and the process in the third authentication process may be the same or different.

[0163] When the process in the first authentication process and the process in the third authentication process are the same, the process can be standardized, which makes it easier to create an application and reduces the amount of application data.When the process in the first authentication process and the process in the third authentication process are different, it is possible to perform personal authentication with accuracy according to the situation in which the first authentication process and the third authentication process are required.

[0164] <<Embodiment 2>> In the first embodiment, an example has been described in which the authentication device 101 is a server of a bank system associated with an application. The authentication device 101 may be a terminal on which the application is installed.

[0165] (Functional configuration of authentication system 200) EMBODIMENTS OF THE PRESENT DISCLOSURE 2 As shown in FIG. 9, an authentication system 200 according to the present invention includes a terminal 202 as an authentication device, and a server 221.

[0166] The terminal 202 includes the functional units 103 to 106 included in the authentication device 101 according to the embodiment 1, in addition to the functional units 111 to 118 included in the terminal 102 according to the embodiment 1. However, the first acquisition unit 107 and the third acquisition unit 109 may acquire information via a bus 2010 (see FIG. 3) instead of acquiring information via the network N.

[0167] The server 221 is a server of a bank system associated with the application, and is configured to be able to transmit and receive information to and from the terminal 202 via the network N. The server 221 receives a notification from the terminal 202, and performs processing in accordance with the notification.

[0168] (Physical configuration of authentication system 200) The terminal 202 may be physically configured in the same manner as the terminal 102 according to the first embodiment. The server 221 may be physically configured in the same manner as the authentication device 101 according to the first embodiment.

[0169] (Operation of authentication system 200) Terminal login according to this embodiment may be similar to terminal login according to the first embodiment.

[0170] 10 and 11 are flowcharts showing the account opening process and the system login process according to this embodiment, respectively.

[0171] 10, in the account opening process according to the present embodiment, the processes of steps S201, S203 to S204, and S206 to S211 are performed similarly to those of embodiment 1. However, the notifications in each of steps S209 and S211 are performed by the terminal communication unit 118 and transmitted to the server 221 via the network N.

[0172] By receiving the notification in step S209, the user of server 221 can know that an attempt has been made to open an account, and that the account cannot be opened because the first authentication process has failed.

[0173] By receiving the notification in step S211, the user of the server 221 can know that the first authentication process has been successful and the account opening has been accepted. 2 At least one of personal information, master information, etc. of the user (02) may be included.

[0174] 11, in system login according to this embodiment, the processes of steps S301, S303 to S307 are performed similarly to those of embodiment 1. However, the notifications in each of steps S306 and S307 are performed by the terminal communication unit 118 and transmitted to the server 221 via the network N.

[0175] By receiving the notification in step S306, the user of server 221 can know that the third authentication process has failed. By receiving the notification in step S307, the user of server 221 can know that the third authentication process has succeeded.

[0176] Following or instead of step S306, the third authentication unit 106 may display a message on the display unit 111 to the effect that login has failed. This allows the user to know that the third authentication process has failed. Following or instead of step S307, the third authentication unit 106 may display, for example, an initial screen such as a menu screen on the display unit 111. This allows the user to know that the third authentication process has been successful.

[0177] This embodiment also provides the same effects as the first embodiment.

[0178] (Variation 1) 12 is a diagram showing an example of the configuration of an authentication device 101 according to Modification 1. The authentication device 101 includes a first authentication unit 103, a master information management unit 105, and a third authentication unit .

[0179] The first authentication unit 103 executes a first authentication process using the first biometric information and the personal identification information. If the first authentication process is successful, the master information management unit 105 stores master information including at least one of the first biometric information and feature information indicating features of the first biometric information in the storage unit 104. If the second authentication process is successful, the third authentication unit 106 executes a third authentication process using the third biometric information and the master information.

[0180] According to the authentication device 101 of the present modified example 1, even if the process in the second authentication process is unknown or the personal authentication has a relatively low accuracy, the first authentication process and the third authentication process can perform a highly accurate personal authentication. A highly accurate personal authentication process (the first authentication process and the third authentication process) separate from the personal authentication process (the second authentication process) in the device such as the terminal 102 becomes possible.

[0181] 13, an authentication system 100 according to the first modification includes an authentication device 101 and a terminal 102. The terminal 102 includes a first generation unit 113, a second generation unit 115, a third generation unit 116, and a second authentication unit 117.

[0182] The first generating unit 113 generates first biometric information. The second generating unit 115 generates second biometric information. The third generating unit 116 generates third biometric information. The second authenticating unit 117 executes a second authentication process using the second biometric information.

[0183] According to the authentication system 100 of the present modified example 1, even if the process in the second authentication process is unknown or the personal authentication has a relatively low accuracy, the first authentication process and the third authentication process can perform a highly accurate personal authentication. A highly accurate personal authentication process (the first authentication process and the third authentication process) separate from the personal authentication process (the second authentication process) in the device such as the terminal 102 becomes possible.

[0184] FIG. 14 is a flowchart showing an example of the personal authentication process (authentication process) according to the first modification.

[0185] The first authentication unit 103 executes the first authentication process using the first biometric information and the personal identification information (step S207).

[0186] If the first authentication process is successful, the master information management unit 105 stores master information including at least one of the first biometric information and feature information indicating a feature of the first biometric information in the storage unit 104 (step S210).

[0187] If the second authentication process is successful, the third authentication processing unit 110 executes the third authentication process using the third biometric information and the master information (step S304).

[0188] According to the identity authentication process (authentication process) of the present modified example 1, even if the process in the second authentication process is unknown or the identity authentication has a relatively low accuracy, the first authentication process and the third authentication process can perform identity authentication with high accuracy. It becomes possible to perform identity authentication processes (first authentication process and third authentication process) with high accuracy, which are different from the identity authentication process (second authentication process) in the device such as the terminal 102.

[0189] Although the embodiment and modifications of the present invention have been described above with reference to the drawings, these are merely examples of the present invention, and various configurations other than those described above can also be adopted.

[0190] In addition, in the flowcharts used in the above description, multiple steps (processing) are described in order, but the order of execution of the steps performed in each of the embodiments is not limited to the order described. In each of the embodiments, the order of the steps shown in the figures can be changed to the extent that the content is not affected. In addition, the above-mentioned embodiments and variations can be combined to the extent that the content is not contradictory.

[0191] A part or all of the above-described embodiments can be described as, but is not limited to, the following supplementary notes.

[0192] 1. a first authentication means for executing a first authentication process using the first biometric information and the personal identification information; a master information management means for storing master information including at least one of the first biometric information and feature information indicating a feature of the first biometric information in a storage means when the first authentication process is successful; and a third authentication means for executing a third authentication process by using the third biometric information and the master information when the second authentication process is successful. Authentication device. 2. The first authentication means a first acquisition means for acquiring the first biometric information and the personal identification information from a terminal; a first authentication processing means for executing the first authentication processing by using the first biometric information and the personal identification information; the second authentication process is an authentication process executed by the terminal, The third authentication means is a third acquisition means for acquiring third biometric information from the terminal during or after the second authentication process; and a third authentication processing means for executing the third authentication processing by using the third biometric information acquired by the third acquisition means and the master information when the second authentication processing is successful. The authentication device described in 1. above. 3. A verification information generating means for generating the identity verification information; A first generating means for generating the first biological information; A second generating means for generating second biometric information; A third generating means for generating the third biometric information; and a second authentication means for executing the second authentication process using the second biometric information, The first authentication means a first acquisition means for acquiring the first biometric information from the first generation means and acquiring the personal identification information from the identification information generation means; a first authentication processing means for executing the first authentication processing using the first biometric information and the personal identification information; The third authentication means is a third acquisition means for acquiring third biometric information generated in the terminal during or after execution of a second authentication process by the second authentication means; and a third authentication processing means for executing the third authentication processing by using the third biometric information acquired by the third acquisition means and the master information when the second authentication processing by the second authentication means is successful. The authentication device described in 1. above. 4. The third biometric information includes the same type of biometric information as the biometric information included in the first biometric information. An authentication device according to any one of 1 to 3 above. 5. the first biometric information and the third biometric information include a face image, The second biometric information includes at least one of a face image, a fingerprint, a vein, and an iris. The authentication device described in 4. above. 6. The first authentication process and the third authentication process are different from the second authentication process. An authentication device according to any one of 1 to 5 above. 7. The authentication device according to 1 or 2 above; The terminal, The terminal includes: A first generating means for generating the first biological information; A second generating means for generating second biometric information; A third generating means for generating the third biometric information; and a second authentication means for executing the second authentication process using the second biometric information. Authentication system. 8. The computer executing a first authentication process using the first biometric information and the identity verification information; if the first authentication process is successful, storing master information including at least one of the first biometric information and feature information indicating a feature of the first biometric information in a storage means; and executing a third authentication process using the third biometric information and the master information when the second authentication process is successful. Authentication method. 9. On the computer, executing a first authentication process using the first biometric information and the identity verification information; if the first authentication process is successful, storing master information including at least one of the first biometric information and feature information indicating a feature of the first biometric information in a storage means; and a program for executing a third authentication process by using the third biometric information and the master information when the second authentication process is successful. 10. On the computer, executing a first authentication process using the first biometric information and the identity verification information; if the first authentication process is successful, storing master information including at least one of the first biometric information and feature information indicating a feature of the first biometric information in a storage means; a recording medium having a program recorded thereon for executing a third authentication process using the third biometric information and the master information when the second authentication process is successful;

[0193] This application claims priority based on Japanese Patent Application No. 2021-208613, filed on December 22, 2021, the disclosure of which is incorporated herein in its entirety. [Explanation of symbols]

[0194] 100,200 Authentication Systems 101 Authentication device 102,202 devices 103 First Certification Section 104 Storage section 105 Master Information Management Department 106 Third Certification Department 107 First acquisition part 108 First authentication processing unit 109 Third acquisition part 110 Third authentication processing unit 111 Display section 112 Audio output section 113 1st generation part 114 Confirmation information generation unit 115 Second generation part 116 Third generation part 117 Second Certification Section 118 Terminal communication unit 221 Server

Claims

1. a first authentication means for executing a first authentication process using a face image included in the first biometric information and a face image included in personal identification information indicating a document for personal identification; a master information management means for storing master information including at least one of the first biometric information and characteristic information indicating a characteristic of the first biometric information in a storage means when the first authentication process is successful; a third authentication means for executing a third authentication process by using third biometric information and the master information when the second authentication process is successful; The second authentication process is an authentication process executed by a terminal. Authentication device.

2. The first authentication means is a first acquisition means for acquiring the first biometric information and the personal identification information from a terminal; a first authentication processing means for executing the first authentication processing using a face image included in the first biometric information and a face image included in the personal identification information; The third authentication means is a third acquisition means for acquiring third biometric information from the terminal during or after the second authentication process; and a third authentication processing means for executing the third authentication processing by using the third biometric information acquired by the third acquisition means and the master information when the second authentication processing is successful. The authentication device according to claim 1 .

3. a first authentication means for executing a first authentication process using a face image included in the first biometric information and a face image included in personal identification information indicating a document for personal identification; a master information management means for storing master information including at least one of the first biometric information and characteristic information indicating a characteristic of the first biometric information in a storage means when the first authentication process is successful; and a third authentication means for acquiring third biometric information generated in the terminal during execution of the second authentication process, and for executing the third authentication process using the third biometric information and the master information if the second authentication process is successful. Authentication device.

4. A verification information generating means for generating the identity verification information; A first generating means for generating the first biometric information; A second generating means for generating second biological information; A third generating means for generating the third biometric information; a second authentication means for executing the second authentication process using the second biometric information, The first authentication means is a first acquisition means for acquiring the first biometric information from the first generation means and acquiring the personal identification information from the identification information generation means; a first authentication processing means for executing the first authentication processing using a face image included in the first biometric information and a face image included in the personal identification information; The third authentication means is a third acquisition means for acquiring third biometric information generated in a terminal during execution of a second authentication process by the second authentication means; and a third authentication processing means for executing the third authentication processing by using the third biometric information acquired by the third acquisition means and the master information when the second authentication processing by the second authentication means is successful. The authentication device according to claim 3.

5. The third biometric information includes a face image. The authentication device according to any one of claims 1 to 4.

6. The second biometric information includes at least one of a face image, a fingerprint, a vein, and an iris. The authentication device according to claim 4.

7. The first authentication process and the third authentication process are different from the second authentication process. The authentication device according to any one of claims 1 to 4.

8. An authentication device; A terminal, The authentication device includes: a first authentication means for executing a first authentication process using a face image included in the first biometric information and a face image included in personal identification information indicating a document for personal identification; a master information management means for storing master information including at least one of the first biometric information and characteristic information indicating a characteristic of the first biometric information in a storage means when the first authentication process is successful; a third authentication means for executing a third authentication process by using third biometric information and the master information when the second authentication process is successful; The terminal includes: A first generating means for generating the first biometric information; A second generating means for generating second biological information; A third generating means for generating the third biometric information; and a second authentication means for executing the second authentication process using the second biometric information. Authentication system.

9. The computer performing a first authentication process using a facial image included in the first biometric information and a facial image included in identity verification information indicating a document for identity verification; if the first authentication process is successful, storing master information including at least one of the first biometric information and characteristic information indicating a characteristic of the first biometric information in a storage means; executing a third authentication process by using third biometric information and the master information when the second authentication process is successful; The second authentication process is an authentication process executed by a terminal. Authentication method.

Images