Information processing device, authentication system, information processing method, and program

Abstract

This information processing device is provided with: a processing unit that determines, from among first registrants registered in advance, a second registrant that satisfies a prescribed condition; and a communication unit that transmits information pertaining to face authentication processing of the second registrant to another information processing device that executes the face authentication processing.

Description

Information processing device, authentication system, information processing method, and program

[0001] The present disclosure relates to an information processing device, an authentication system, an information processing method, and a program.

[0002] In stations, offices, etc., there are areas where entry is restricted to people other than certain individuals. Gates are installed at the entrances and exits of such areas, and the entry of people who pass through the gate to enter the area and the exit of people who pass through the gate to leave the area are managed.

[0003] Patent document 1 describes a technology in which the facial authentication data of visitors is sent from a server to a facial authentication terminal device at the start of the time period during which entry is permitted, and is deleted from the facial authentication terminal device at the end of the time period during which entry is permitted, thereby allowing authentication of visitors to be performed solely by the facial authentication terminal device.

[0004] JP 2015-198442 A

[0005] However, there is room for further study on methods for shortening the time required to authenticate a person to be authenticated (for example, an entrance visitor).

[0006] Non-limiting embodiments of the present disclosure contribute to providing an information processing device, an authentication system, an information processing method, and a program that can reduce the time required to authenticate a person to be authenticated.

[0007] An information processing device according to one embodiment of the present disclosure includes a processing unit that determines a second registrant who satisfies predetermined conditions from among first registrants who have been registered in advance, and a communication unit that transmits information regarding the facial recognition processing of the second registrant to another information processing device that performs facial recognition processing.

[0008] An authentication system according to one embodiment of the present disclosure includes a first information processing device and a second information processing device, wherein the first information processing device determines a second registrant who satisfies predetermined conditions from among first registrants who have been registered in advance, and transmits information regarding the facial recognition processing of the second registrant to the second information processing device, which executes the facial recognition processing. The second information processing device determines whether the subject is included among the second registrants based on the information regarding the facial recognition processing of the second registrant received from the first information processing device and a facial image of the subject of the facial recognition processing.

[0009] In an information processing method according to one embodiment of the present disclosure, an information processing device determines a second registrant who satisfies predetermined conditions from among first registrants who have been registered in advance, and transmits information regarding the facial recognition processing of the second registrant to another information processing device that performs facial recognition processing.

[0010] A program according to one embodiment of the present disclosure causes an information processing device to determine a second registrant who satisfies predetermined conditions from among first registrants who have been registered in advance, and to transmit information regarding the facial recognition processing of the second registrant to another information processing device that performs facial recognition processing.

[0011] These comprehensive or specific aspects may be realized as a system, an apparatus, a method, an integrated circuit, a computer program, or a recording medium, or may be realized as any combination of a system, an apparatus, a method, an integrated circuit, a computer program, and a recording medium.

[0012] Non-limiting examples of the present disclosure can reduce the time required to authenticate a subject of authentication.

[0013] Further advantages and benefits of an embodiment of the present disclosure will become apparent from the specification and drawings. Such advantages and / or benefits may be provided by some of the embodiments and features described in the specification and drawings, respectively, but not necessarily all of them may be provided to obtain one or more identical features.

[0014] FIG. 1 shows an example of entrance / exit management using conventional facial authentication. FIG. 2 shows an example of entrance / exit management using facial authentication according to an embodiment. FIG. 3 shows an example of an authentication system according to an embodiment. FIG. 4 shows an example of the configuration of an edge server and a cloud server. A flowchart showing an example of the flow of processing for registering an edge registrant according to an embodiment. A flowchart showing an example of the flow of authentication processing according to an embodiment. A diagram showing an operation example 1 while an authentication request is being made from the edge server to the cloud server. A diagram showing an operation example 2 while an authentication request is being made from the edge server to the cloud server.

[0015] Preferred embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings. In this specification and drawings, components having substantially the same functions are designated by the same reference numerals, and redundant description will be omitted.

[0016] (One embodiment) <Knowledge that led to the present disclosure> In stations, offices, etc., there are areas (restricted areas) where entry to people other than specific people is restricted. Gates are installed at the entrances and exits of such areas, and entry of people who enter the area through the gates and exit of people who leave the area through the gates are managed.

[0017] For example, in the case of a station, ticket gates are provided at the entrances and exits of the station, and entry of people is managed by allowing people who are authorized to enter the station to pass through the ticket gate and entering the station, and restricting people other than those authorized to enter the station from passing through the ticket gate. Similarly to entry, exit of people is also managed by allowing people who are authorized to exit the station to pass through the ticket gate and leaving the station, and restricting people other than those authorized to exit the station from passing through the ticket gate.

[0018] In the case of an office, for example, a gate is installed at the entrance and exit of the office premises, and entry of people is controlled by allowing people who are authorized to enter the office premises to pass through the gate and restricting people other than those authorized to enter the office premises from passing through the gate. Similarly to entry, exit of people is controlled by allowing people who are authorized to exit the office premises to pass through the gate and restricting people other than those authorized to exit the office premises from passing through the gate.

[0019] In recent years, the use of face recognition to manage the entry and / or exit of people (hereinafter referred to as entrance and exit management) has been considered.

[0020] FIG. 1 is a diagram showing an example of conventional entrance / exit management using facial recognition. FIG. 1 shows a gate and a pedestrian (hereinafter, sometimes referred to as a person to be authenticated) attempting to pass through the gate. FIG. 1 also shows a camera that captures an image of the area around the face of the person to be authenticated, an edge PC connected to the camera, and a cloud server connected to the edge PC. The cloud server and the edge PC are connected via a network. The cloud server stores information related to the facial recognition process of individuals who have been pre-registered as people permitted to pass through the gate. Hereinafter, a person who has been pre-registered as people permitted to pass through the gate may be simply referred to as a registrant. Identification information (ID) is assigned to the registrant. In the following, for illustrative purposes, the registrant will be described as a person permitted to pass through the gate.

[0021] In the example of FIG. 1 , the edge PC acquires an image of an area including the face of the person to be authenticated (hereinafter referred to as a “face image”) from an image of the person to be authenticated captured by a camera, or features extracted from the face image (hereinafter referred to as “facial features”), and transmits the facial image or facial features to a cloud server. The cloud server performs a facial recognition process to determine whether the person to be authenticated is permitted to pass through the gate based on the facial image or facial features. Note that this facial recognition process is performed between the person to be authenticated and registrants registered in the cloud server. In the facial recognition process, a score indicating the degree of similarity between the facial features of the person to be authenticated and the facial features of the registrants is calculated for each registrant registered in the cloud server. If the highest score among the calculated scores is equal to or greater than a threshold, the registrant corresponding to the highest score is determined to be the person to be authenticated. If it is determined that the person to be authenticated is one of the registrants registered in the cloud server, authentication of the person to be authenticated is successful, and the person to be authenticated is permitted to pass through the gate.

[0022] In the face authentication process, the process of comparing the facial features of the person to be authenticated with the facial features of the registrant to identify the registrant who corresponds to the person to be authenticated may be referred to as a face matching process. The face authentication process may include a process of determining whether the registrant identified in the face matching process is a person permitted to pass through the gate. In the present embodiment, for example, all registrants are people permitted to pass through the gate, so in the present embodiment, face matching and face authentication may be synonymous.

[0023] If the person to be authenticated is included in the people registered with the cloud server, the cloud server transmits a gate control signal to the gate to instruct it to open the gate. In this case, the cloud server may store an authentication result indicating that the face authentication of the person to be authenticated was successful.

[0024] Furthermore, if the person to be authenticated is not included among the people registered with the cloud server, the cloud server transmits a gate control signal to the gate instructing it to close, and the gate opens or closes the gate based on the gate control signal.

[0025] 1, the edge PC transmits a facial image or facial feature information of the person to be authenticated to the cloud server every time the person to be authenticated is photographed for facial recognition processing, which places a heavy burden on communication between the edge PC and the cloud server, reduces throughput, and increases the time required for facial recognition processing.Furthermore, because the facial recognition processing requires time, it may be difficult to apply facial recognition to a system that allows the person to be authenticated to pass through a gate without stopping in front of the gate, such as a walk-through authentication system.

[0026] FIG. 2 is a diagram showing an example of entrance / exit management using face recognition according to the present embodiment. Similar to FIG. 1, FIG. 2 shows a gate, a person to be authenticated who is about to pass through the gate, a camera that captures an image of the area around the person's face, an edge PC connected to the camera, and a cloud server. Also, unlike FIG. 1, FIG. 2 shows an edge server connected to the edge PC, and the edge server and the cloud server connected via a network. The edge server stores information related to face recognition processing for some registrants who satisfy predetermined conditions among those registered in the cloud server. The edge PC and the edge server may be configured as an integrated unit.

[0027] 2, the edge PC acquires a facial image or facial feature values ​​from an image of the person to be authenticated captured by a camera and transmits the facial image or facial feature values ​​to the edge server. The edge server performs a facial recognition process based on the facial image or facial feature values ​​to determine whether the person to be authenticated is a person permitted to pass through the gate. The facial recognition process here is performed between the person to be authenticated and a registered person stored in the edge server.

[0028] If the person to be authenticated is included in the registered users of the edge server, the edge server transmits a gate control signal to the gate to instruct it to open the gate. In this case, the edge server may transmit an authentication result indicating that the face authentication of the registered user corresponding to the person to be authenticated was successful to the cloud server, and the authentication result may be stored in the cloud server.

[0029] If the person to be authenticated is not included among those registered with the edge server, the edge server transmits a facial image or facial feature amount of the person to be authenticated to the cloud server. The cloud server performs a facial recognition process to determine whether the person to be authenticated is a person permitted to pass through the gate based on the facial image or facial feature amount, and transmits a gate control signal based on the determination result to the gate.

[0030] As shown in Figure 2, information regarding the facial authentication process for at least some of the registered users is stored in the edge server on the edge PC side, and the edge server performs facial authentication between the authentication target and the registered users, thereby reducing the number of times that the facial image or facial feature information of the authentication target is transmitted to the cloud server. This reduces the communication load between the edge PC and the cloud server, improves throughput, and shortens the time required for facial authentication. Furthermore, because the time required for facial authentication can be shortened, facial authentication can be applied to systems such as walk-through authentication systems that allow the authentication target to pass through a gate without stopping in front of the gate.

[0031] In the following, in this embodiment, as shown in Figure 2, an example of a face authentication system will be described in which at least some information of registered individuals is stored in an edge server on the edge PC side, and the edge server performs face authentication processing between the person to be authenticated and some of the registered individuals.

[0032] <System Configuration Example> Fig. 3 is a diagram showing an example of an authentication system according to the present embodiment. Fig. 3 shows an edge server 10, a cloud server 20, an imaging device 30, and a display device 40. The edge server 10 is connected to the imaging device 30 and the display device 40 via a wired or wireless connection. The edge server 10 is connected to the cloud server 20 via a network. Note that the edge server 10 shown in Fig. 3 corresponds to a configuration in which the edge PC and edge server shown in Fig. 2 are integrated together. The "edge server" may also be referred to as an edge PC. Furthermore, the "cloud server" may also be referred to as a cloud PC.

[0033] The imaging device 30 is provided in a position where it can capture an image of an area including the face of a person who is about to pass through the gate. The imaging device 30 captures an image of an area including the face of a person who is about to pass through the gate, and outputs the captured image (captured image) to the edge server 10.

[0034] Note that a person attempting to pass through the gate corresponds to a person attempting to pass through the gate. A person attempting to pass through the gate may be either a person who is permitted to pass through the gate or a person who is not permitted to pass through the gate. In the following, a person attempting to pass through the gate will be referred to as a person to be authenticated.

[0035] The display device 40 displays information regarding whether or not the person to be authenticated can pass through the gate to the person to be authenticated. The display device 40 displays information output from the edge server 10. For example, if facial authentication of the person to be authenticated is successful, the display device 40 displays information indicating that authentication has been successful to the person to be authenticated. Also, for example, if facial authentication of the person to be authenticated has failed, the display device 40 displays information indicating that authentication has failed to the person to be authenticated. The displayed information may be a text message or a symbol indicating success or failure of authentication. Alternatively, the display device 40 may present information to the person to be authenticated by voice.

[0036] While FIG. 3 illustrates an example including one display device 40, the present disclosure is not limited thereto. The authentication system of the present disclosure may include multiple display devices 40. Furthermore, while the display device 40 illustrates an example in which the authentication target displays information regarding whether or not the target can pass through a gate, the authentication system of the present disclosure may also include a display device 40 that displays information to a person other than the target. A person other than the target is, for example, a manager who manages the actions of the target (e.g., entering and exiting a gate). When the authentication system is used to manage entrances and exits at station ticket gates, the authentication system may include a display device 40 that displays information to a station employee, which corresponds to an example of a manager. When the authentication system is used to manage entrances and exits at office entrances, the authentication system may include a display device 40 that displays information to an office manager (or security guard).

[0037] The display device 40 that displays information to the administrator may display information about whether the authentication of the person to be authenticated has been successful. Alternatively, the display device 40 that displays information to the administrator may display information such as a warning when the person to be authenticated is likely to pass through the gate fraudulently or when the person to be authenticated has passed through the gate fraudulently.

[0038] When the authentication of the person to be authenticated is delayed, the display device 40 may display information to the person to be authenticated requesting that he or she wait for the completion of authentication. Furthermore, when the authentication of the person to be authenticated is delayed, the display device 40 may display information to the administrator indicating that the authentication has been delayed. An example of the display on the display device 40 in response to an authentication delay will be described later.

[0039] The display device 40 may be attached to the gate within the field of view of the person to be authenticated who is about to pass through the gate. Alternatively, the display device 40 may take the form of a smartphone or tablet owned by the person to be authenticated or a person other than the person to be authenticated (for example, the administrator described above). The display device 40 is an example of a user interface that displays information to a user (for example, the person to be authenticated or the administrator). The display device 40 may include a control unit that controls the display, an operation unit that accepts user operations, a communication unit that transmits information related to user operations and receives information from external devices, etc.

[0040] The cloud server 20 is connected to the edge server 10 via a network.

[0041] The cloud server 20 may be connected to multiple edge servers 10. For example, if the edge server 10 is installed at a ticket gate of a station, the cloud server 20 may be connected to the edge servers 10 installed at each of the multiple stations. Also, for example, if the edge server 10 is installed at the entrance / exit gate of an office in a certain location, the cloud server 20 may be connected to the edge servers 10 installed at each of the offices in a plurality of locations.

[0042] Cloud server 20 stores information about the face authentication process for pre-registered registrants. A registrant may be a user who has registered information in order to use the gate passage management service based on face authentication in the system according to the present embodiment.

[0043] For example, in a case where the edge server 10 is installed at a station ticket gate, users of the railway network including the station register their facial images, personal information, etc. in advance in order to use a gate passage management service based on face recognition. In this case, the cloud server 20 may store information on each registered user of the railway network.

[0044] Furthermore, for example, in a case where the edge server 10 is installed at the entrance / exit gate of an office, facial images, personal information, etc. of employees working in the office are registered in the cloud server 20. Note that in a case where a company has multiple offices, the cloud server 20 may store information on each of the employees working in each of the multiple offices.

[0045] Hereinafter, registrants stored in the cloud server 20 may be referred to as cloud registrants. Also, registrants stored in the edge server 10 may be referred to as edge registrants. Also, without distinguishing between these, registrants who have registered information related to face authentication may be simply referred to as registrants. Cloud registrants may be all people who have registered information in order to use the services provided by the system according to this embodiment. The set of edge registrants may be a subset of the set of cloud registrants.

[0046] Furthermore, information regarding the facial authentication process of a registrant may be referred to as the registrant's registration information. The registration information includes the registrant's ID, a facial image of the registrant, etc. The facial image of the registrant may be referred to as a registered facial image below.

[0047] The cloud server 20 includes a first storage unit 201 , a face matching unit 202 , an edge registration determination unit 203 , and a communication unit 204 .

[0048] The first storage unit 201 stores registration information of cloud registrants. The registration information of cloud registrants may include authentication results of face authentication processing of the cloud registrants. The authentication results may include the date and time when face authentication was performed, the score when face authentication was performed, etc. The authentication results may be referred to as history information or a log.

[0049] The face matching unit 202 performs face authentication processing based on the registration information of the cloud registrant. For example, when the cloud server 20 receives request information requesting face authentication from the edge server 10, the cloud server 20 performs face authentication processing of the person to be authenticated corresponding to the captured face image based on the facial feature amounts of the captured face image included in the request information and the facial feature amounts of the registered face images of each of the cloud registrants. Note that the face matching unit 202 may improve the accuracy of the face authentication processing by performing machine learning based on the results of the face authentication processing. In the face authentication processing, it determines whether the person to be authenticated is included in the cloud registrants, and if the person to be authenticated is included in the cloud registrants, it identifies which of the cloud registrants the person to be authenticated is. Note that in the face authentication processing by the face matching unit 202, a successful authentication corresponds to a case where a cloud registrant corresponding to the person to be authenticated is identified, and a failed authentication corresponds to a case where a cloud registrant corresponding to the person to be authenticated is not identified. A failed authentication includes a case where the person to be authenticated is not included in the cloud registrants, and a case where the person to be authenticated is included in the cloud registrants but it is determined that the cloud registrant does not correspond to the person to be authenticated.

[0050] If the authentication is successful, the face matching unit 202 transmits a gate control signal to a gate control device (omitted in FIG. 3 ) via the communication unit 204, instructing it to open the gate. The gate is opened under the control of the gate control device that has received the gate control signal. The face matching unit 202 also transmits the gate control signal instructing it to open the gate to the display device 40 via the communication unit 204. The display device 40, which has received the gate control signal, displays information indicating that the authentication was successful.

[0051] If authentication fails, the face matching unit 202 transmits a gate control signal to the gate control device via the communication unit 204, instructing the gate to be closed. The gate control device, which has received the gate control signal, closes the gate, preventing the person to be authenticated from passing through the gate. The face matching unit 202 also transmits the gate control signal to the display device 40 via the communication unit 204, instructing the gate to be closed. The display device 40, which has received the gate control signal, displays information indicating that authentication has failed. This allows the person to be authenticated to confirm that they have been prevented from passing through the gate.

[0052] The face matching unit 202 may transmit a signal directly to the display device 40 and the gate control device via the communication unit 204. Alternatively, the face matching unit 202 may transmit a signal to the communication unit 103 of the edge server 10 via the communication unit 204, and the communication unit 103 of the edge server 10 may transmit (transfer) the signal received from the face matching unit 202 to the display device 40 and the gate control device.

[0053] The edge registration determination unit 203 determines an edge registrant from among the cloud registrants. The edge registration determination unit 203 transmits the registration information of the determined edge registrant to the edge server 10 via the communication unit 204. The edge server 10 stores the received registration information of the edge registrant. Note that a method for determining an edge registrant will be described later. Determining an edge registrant may be synonymous with selecting an edge registrant from among the cloud registrants, or setting (or registering) some of the cloud registrants as edge registrants. Furthermore, a cloud registrant whose registration information is registered in the edge server 10 corresponds to an edge registrant. For example, registering the registration information of a cloud registrant in the edge server 10 corresponds to determining the cloud registrant as an edge registrant and registering the registration information of the determined edge registrant in the edge server 10.

[0054] The communication unit 204 transmits and receives information (or signals) between the cloud server 20 and other devices (for example, the edge server 10).

[0055] In the cloud server 20, the face matching unit 202 and the edge registration determination unit 203 may be collectively referred to as a processing unit.

[0056] The edge server 10 includes a second storage unit 101 , a face matching unit 102 , and a communication unit 103 .

[0057] The second storage unit 101 stores registration information of edge registrants. The registration information of edge registrants may include authentication results of face authentication processing of the edge registrants. The authentication results may include the date and time when face authentication was performed, the score when face authentication was performed, etc.

[0058] The face matching unit 102 performs face authentication processing based on the registration information of the edge registrant. For example, when the edge server acquires a captured image from the imaging device 30 via the communication unit 103, it performs face authentication processing of the person to be authenticated corresponding to the captured face image based on the facial feature amount of the captured face image acquired from the captured image and the facial feature amount of the registered face images of each edge registrant. The face authentication processing determines whether the person to be authenticated is included in the edge registrants, and if the person to be authenticated is included in the edge registrants, identifies which of the edge registrants the person to be authenticated is. Note that in the face authentication processing by the face matching unit 102, a successful authentication corresponds to a case where an edge registrant corresponding to the person to be authenticated is identified, and a failed authentication corresponds to a case where an edge registrant corresponding to the person to be authenticated is not identified. A failed authentication includes a case where the person to be authenticated is not included in the edge registrants, and a case where the person to be authenticated is included in the edge registrants but it is determined that the edge registrant does not correspond to the person to be authenticated.

[0059] If the authentication is successful, the face matching unit 102 transmits a gate control signal to the gate control device via the communication unit 103, instructing the gate to be opened. The gate is opened under the control of the gate control device that has received the gate control signal. The face matching unit 102 also transmits the gate control signal to the display device 40 via the communication unit 103, instructing the gate to be opened. The display device 40, which has received the gate control signal, displays information indicating that the authentication has been successful.

[0060] If the authentication fails, the face matching unit 102 requests face authentication from the cloud server 20 via the communication unit 103. For example, the face matching unit 102 transmits request information indicating a request for face authentication to the cloud server 20. The request information includes information on the facial features of the person to be authenticated who has failed to be authenticated.

[0061] The communication unit 103 transmits and receives information (or signals) between the edge server 10 and other devices (for example, the cloud server 20, the image capturing device 30, and the display device 40).

[0062] Note that the configuration example shown in Figure 3 is just an example, and the present disclosure is not limited to this. For example, some of the components included in the cloud server 20 and / or the edge server 10 may be omitted, or components not shown in Figure 3 may be included in the cloud server 20 and / or the edge server 10. Furthermore, in Figure 3, the components included in one device may be separated into two or more devices. For example, the edge registration determination unit 203 of the cloud server 20 may be included in a device separate from the face matching unit 202.

[0063] <Configuration Example of Edge Server and Cloud Server> FIG. 4 is a diagram showing an example of the configuration of the edge server 10 and the cloud server 20. As shown in FIG.

[0064] For example, the edge server 10 and the cloud server 20 in the present embodiment may function as computers that perform processing of the wireless communication method of the present disclosure. The edge server 10 and the cloud server 20 may be physically configured as computer devices including a processor 301, a memory 302, a storage 303, a communication unit 304, an input unit 305, an output unit 306, a GPU (Graphics Processing Unit) 307, a bus 308, and the like.

[0065] In the following description, the term "apparatus" can be interpreted as a circuit, a device, a unit, etc. The hardware configuration of the edge server 10 and the cloud server 20 may be configured to include one or more of the apparatuses shown in the drawings, or may be configured to exclude some of the apparatuses.

[0066] Each function of the edge server 10 and the cloud server 20 is realized by loading specific software (programs) onto hardware such as the processor 301, memory 302, and GPU 307, causing the processor 301 and / or GPU 307 to perform calculations, control communication via the communication unit 304, and control at least one of reading and writing data in the memory 302 and storage 303.

[0067] The processor 301 and / or the GPU 307, for example, run an operating system to control the entire computer. The processor 301 may be configured by a central processing unit (CPU) including an interface with peripheral devices, a control device, an arithmetic unit, a register, etc. For example, the face matching unit 102, the face matching unit 202, and the edge registration determination unit 203 described above may be realized by the processor 301 and / or the GPU 307.

[0068] The processor 301 also reads programs (program codes), software modules, data, etc. from at least one of the storage 303 and the communication device 304 into the memory 302 and executes various processes in accordance with the programs. The programs used are those that cause a computer to execute at least some of the operations described in the above-described embodiments. For example, the edge server 10 and the cloud server 20 may be implemented by a control program stored in the memory 302 and running on the processor 301, and similar implementations may be made for other functional blocks. While the above-described various processes have been described as being executed by one processor 301, they may also be executed simultaneously or sequentially by two or more processors 301. The processor 301 may be implemented by one or more chips. The programs may also be transmitted from a network via a telecommunications line.

[0069] The memory 302 is a computer-readable recording medium and may be configured by at least one of, for example, a read-only memory (ROM), an erasable programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), a random access memory (RAM), etc. The memory 302 can store executable programs (program codes), software modules, etc. for implementing the wireless communication method according to an embodiment of the present disclosure. For example, the second storage unit 101 and the first storage unit 201 described above may be realized by the memory 302.

[0070] The storage 303 is a computer-readable recording medium and may be composed of, for example, at least one of an optical disk, a hard disk drive, a flexible disk, a magneto-optical disk, a smart card, a flash memory, a magnetic strip, etc. The storage 303 may also be called an auxiliary storage device. The above-mentioned storage medium may be, for example, a database, a server, or other appropriate medium including at least one of the memory 302 and the storage 303. For example, the above-mentioned second storage unit 101 and first storage unit 201 may be realized by the storage 303. Alternatively, the above-mentioned second storage unit 101 and first storage unit 201 may be realized by the memory 302 and the storage 303.

[0071] The communication unit 304 is hardware (transmission / reception device) for communicating between computers via at least one of a wired network and a wireless network, and is also referred to as, for example, a network device, a network controller, a network card, a communication module, etc. For example, the above-mentioned communication unit 103 and communication unit 204 may be realized by the communication unit 304. The communication unit 304 may be implemented as a transmission unit and a reception unit that are physically or logically separated.

[0072] The input unit 305 is an input device (e.g., a keyboard, a mouse, a microphone, a switch, a button, a sensor, etc.) that accepts input from the outside. The output unit 306 is an output device (e.g., a display, a speaker, an LED lamp, etc.) that outputs to the outside. The input unit 305 and the output unit 306 may be integrated into one unit (e.g., a touch panel).

[0073] Furthermore, each device, such as the processor 301 and the memory 302, is connected by a bus 308 for communicating information. The bus 308 may be configured using a single bus, or may be configured using different buses between each device.

[0074] <Example of Method for Determining Edge Registrant> An example of a method for determining an edge registrant, which is performed by the edge registration determination unit 203 of the cloud server 20 described above, will be described.

[0075] For example, the edge registrant may be selected from among the cloud registrants, based on the cloud registrants who are relatively easy to authenticate in the edge server 10. The edge registrant may be selected individually for each of the multiple edge servers 10.

[0076] For example, the edge registration determination unit 203 determines, among cloud registrants, a cloud registrant for whom face authentication processing is relatively easy as an edge registrant.

[0077] For example, a cloud registrant who is relatively likely to be authenticated by the edge server 10 may be a cloud registrant who has a relatively high probability of being authenticated by the edge server 10, or a cloud registrant who has a relatively low probability of failing authentication by the edge server 10.

[0078] In this embodiment, among cloud registrants, cloud registrants who are relatively easy to be authenticated by the edge server 10 are determined based on the cloud registrant's pass history, the results of the face authentication process, etc. The cloud registrant's pass history, the results of the face authentication process, etc. may not be accumulated in the early stages of introducing the authentication system according to this embodiment.

[0079] Below, we will explain how to determine edge registrants in the early stages of introducing the authentication system of this embodiment, and how to determine edge registrants after the authentication system of this embodiment is introduced, where the passage history of cloud registrants, results of facial recognition processing, etc. are accumulated and used.

[0080] <Example of Method for Determining Edge Registrants in the Early Stage of Introducing an Authentication System> In the early stage of introducing an authentication system, edge registrants may be determined based on information available at that stage.

[0081] For example, the edge registrant may be determined based on registration information regarding the travel range of the cloud registrant that is available in the early stages of introducing the authentication system. Here, the registration information regarding the travel range of the cloud registrant includes registration information for commuter passes for public transportation such as trains and buses, and registration information such as the location of the organization to which the cloud registrant belongs (e.g., office of employment, school, etc.).

[0082] When the authentication system is used to manage entrance and exit through ticket gates at stations, an edge registrant of the edge server 10 of a station that is expected to be used relatively frequently may be determined based on registration information such as a commuter pass of a user of a railway network that corresponds to a cloud registrant. For example, if cloud registrant X has a commuter pass that can be used between stations a and b, it is determined that cloud registrant X uses stations a and b relatively frequently, and cloud registrant X is determined as an edge registrant of each of the edge servers 10 of station a and station b.

[0083] Furthermore, when the authentication system is used to manage entrance and exit to an office, an edge registrant may be determined based on registration information such as the department to which an office employee corresponding to a cloud registrant belongs (which office the employee works in), the normal working hours of the department, etc. For example, if cloud registrant X works in an office at point a from Monday to Wednesday every week and in an office at point b from Thursday to Friday every week, cloud registrant X is determined as an edge registrant of the edge server 10 in the office at point a from Monday to Wednesday, and as an edge registrant of the edge server 10 in the office at point b from Thursday to Friday.

[0084] Furthermore, if there is registered information such as a passage history before the authentication system was introduced, the edge registrant may be determined based on the registered information such as the passage history. For example, the arrival and departure times of office employees are usually recorded, so the edge registrant may be determined based on the recorded arrival and departure times. For example, if a user of a railway network uses a transportation IC card or the like, the user's passage history through station ticket gates is accumulated, so the edge registrant may be determined based on the passage history. Note that the method of determining the edge registrant in this case may be similar to the "example in which time period is considered" described below.

[0085] The above-described example of a method for determining an edge registrant in the early stages of introducing the authentication system may be used when information such as passage history has been accumulated after the authentication system has been introduced. For example, if cloud registrant X changes the scope of use of his / her commuter pass or the location of the organization to which cloud registrant X belongs after the authentication system has been introduced, the location of the edge server 10 that registers cloud registrant X as an edge registrant, the time period during which cloud registrant X is registered as an edge registrant, etc. may be changed based on the registration information of the changed commuter pass and / or the registration information of the changed location of the organization to which the cloud registrant belongs, etc.

[0086] In the initial stage of introducing the authentication system, if there is no available information, there may be no edge registrants. In this case, the edge server 10 may request all face recognition processing to the cloud server 20. Then, after information on the passage history of cloud registrants and the results of face recognition processing has been accumulated, the edge registrants may be determined.

[0087] <Example of a method for determining an edge registrant when information is accumulated after the authentication system is introduced> Below, we will provide an example of each factor that should be considered when selecting a cloud registrant who is relatively easy to authenticate in the edge server 10 as an edge registrant.

[0088] <Example of Considering Time Zone> The probability of being authenticated by the edge server 10 may vary depending on the time zone. For example, in an office, the time zone when employees pass through the gate, in other words, the time zone when employees arrive at work, may be roughly the same every day. In such a case, the edge registration determination unit 203 may determine an edge registrant for each time zone based on the authentication results stored in the first storage unit 201 (e.g., a log showing the date and time of past passage).

[0089] For example, the edge registration determination unit 203 identifies the time when each cloud registrant passed through the gate from the logs for the most recent past week. Then, the edge registration determination unit 203 determines the number of times each cloud registrant passed through the gate for each time period. If the number of times a certain cloud registrant passed through the gate in a certain time period is equal to or greater than a predetermined number, the cloud registrant is selected as an edge registrant for that time period and is registered as an edge registrant.

[0090] For example, an example will be described in which edge registrants are selected for two time periods, 7 AM to 9 AM and 9 AM to 11 AM, and the predetermined number of times is three.

[0091] Of cloud registrants A to C, if cloud registrant A has passed through the gate three times between 7:00 AM and 9:00 AM in the past week and two times between 9:00 AM and 11:00 AM, cloud registrant A will be selected as the edge registrant for the period between 7:00 AM and 9:00 AM. Furthermore, for example, if cloud registrant B has passed through the gate three times between 7:00 AM and 9:00 AM in the past week and three times between 9:00 AM and 11:00 AM, cloud registrant B will be selected as the edge registrant for the periods between 7:00 AM and 9:00 AM and between 9:00 AM and 11:00 AM. Furthermore, for example, if cloud registrant C has passed through the gate two times between 7:00 AM and 9:00 AM in the past week and one time between 9:00 AM and 11:00 AM, cloud registrant C will not be selected as the edge registrant for the periods between 7:00 AM and 9:00 AM and between 9:00 AM and 11:00 AM.

[0092] Like cloud subscriber A, a subscriber may be selected as an edge subscriber in one of the two time periods, like cloud subscriber B, or may be selected as an edge subscriber in each of the two time periods, like cloud subscriber C, or may not be selected as an edge subscriber in either of the two time periods.

[0093] In this way, edge registrants are determined for each time period based on the time the registrant passed through the gate in the past, and the registration information of cloud registrants who have a relatively high probability of passing through the gate during the relevant time period, i.e., a relatively high probability of being authenticated, is stored in the edge server 10, making it easier for the edge server 10 to authenticate registrants corresponding to the stored registration information, and reducing the number of authentication requests made to the cloud server 20.

[0094] In the above example, cloud registrants who pass through a certain time period a predetermined number of times or more are selected as edge registrants for that time period, but the present disclosure is not limited to this. For example, cloud registrants may be sorted in descending order of the number of times they pass through a certain time period, and the top N cloud registrants with the most number of times they pass through may be selected as edge registrants. N is an integer greater than or equal to 1 and may represent an upper limit on the number of edge registrants.

[0095] The upper limit of the number of edge registrants may be determined based on, for example, the performance (for example, memory capacity) of the edge server 10. In other words, the number of people that can fit into the memory of the edge server 10 may be selected as edge registrants.

[0096] Furthermore, while the above example considers time periods, the present disclosure is not limited thereto. Instead of time periods, dates (e.g., days of the week, or weekdays and holidays) may be considered. For example, the edge registration determination unit 203 identifies the dates on which each cloud registrant passed through the gate from the logs for the most recent past month. The edge registration determination unit 203 then determines the number of times each cloud registrant passed through the gate on each day of the week. If the number of times a certain cloud registrant passed through the gate on a certain day of the week is equal to or greater than a predetermined number, the cloud registrant is selected as an edge registrant for that day of the week.

[0097] In addition to the time period, the date (e.g., day of the week, or weekdays and holidays) may also be considered. For example, edge registrants from 7:00 AM to 9:00 AM on weekdays and edge registrants from 7:00 AM to 9:00 AM on holidays may be determined separately.

[0098] <Example of Considering Score During Authentication> In facial authentication, a score indicating the degree of similarity of facial features between the authentication target and the registrant is calculated. In facial authentication, if the highest score is equal to or greater than a threshold, the registrant corresponding to the highest score is determined to be the authentication target. In this case, the higher the score, the less likely authentication failure will occur, and the lower the score, the more likely authentication failure will occur. For example, if a cloud registrant with a low score is registered as an edge registrant in the edge server 10 and face authentication is performed on the authentication target corresponding to that edge registrant, a low score will be calculated, which may result in authentication failure and a request for face authentication to the cloud server 20. Therefore, a cloud registrant with a relatively high score may be selected as the edge registrant.

[0099] The edge registration determination unit 203 determines edge registrants based on the authentication results (e.g., scores from past authentications) stored in the first storage unit 201. For example, the edge registration determination unit 203 identifies the scores from the most recent past week's worth of logs when authentication was performed for each cloud registrant. For example, if there are multiple scores, at least one of the average, maximum, minimum, and median of the multiple scores may be identified. Then, the edge registration determination unit 203 selects cloud registrants whose identified scores are equal to or greater than a threshold as edge registrants and registers them in the edge server 10.

[0100] By taking the score into consideration, a cloud registrant with a high score is registered as an edge registrant in the edge server 10. Then, when face authentication is performed on a person to be authenticated who corresponds to that edge registrant, the possibility of authentication failure can be reduced, and a request for face authentication to the cloud server 20 can be avoided, thereby suppressing a decrease in throughput.

[0101] In addition to the score, the time period may also be taken into consideration. The edge registration determination unit 203 identifies the time when each cloud registrant passed through the gate and the facial recognition score at that time from the logs for the past week. Then, the edge registration determination unit 203 selects cloud registrants who have a score equal to or greater than a threshold among the scores of each cloud registrant who passed through during a certain time period as edge registrants for that time period.

[0102] <Example of Considering Registrant Attributes> Registrants include those with attributes that are likely to cause authentication failure. For example, registrants who frequently change or conceal their hairstyle, registrants who have significant changes over time, or registrants with a small number of training images are likely to cause authentication failure. Registrants who frequently change or conceal their hairstyle include, for example, registrants who are likely to wear hats or wigs. Registrants who have significant changes over time include, for example, children. Registrants with a small number of training images include registrants who have been authenticated a small number of times, i.e., who have passed through a gate a small number of times. If a cloud registrant who is likely to cause authentication failure is registered as an edge registrant in the edge server 10 and face authentication is performed on a person to be authenticated who corresponds to that edge registrant, authentication may fail, potentially resulting in a request for face authentication to the cloud server 20. Therefore, a cloud registrant who does not have attributes that are likely to cause authentication failure may be selected as the edge registrant.

[0103] The edge registration determination unit 203 determines an edge registrant based on the registration information (e.g., age, clothing, and face image learning results) stored in the first storage unit 201. For example, the edge registration determination unit 203 identifies, from the registration information, cloud registrants who do not have attributes that are relatively likely to cause authentication failures among the cloud registrants. Then, the edge registration determination unit 203 selects the identified cloud registrants as edge registrants and registers them in the edge server 10. Note that the method for identifying a cloud registrant who does not have attributes that are likely to cause authentication failures is not particularly limited. For example, a cloud registrant in which specific facial features (e.g., eyes, nose, and mouth) are detected from a face image of the cloud registrant and an occlusion state of the specific facial features is not detected may be identified as a cloud registrant who does not have attributes that are likely to cause authentication failures. Alternatively, the face image of the cloud registrant may be divided into multiple ranges, the divided ranges may be classified into each facial feature (e.g., eyes, nose, mouth, skin, and hair), and the degree of occlusion may be determined by calculating the area of ​​hair, the area of ​​skin, etc. Cloud registrants whose face images are concealed to a lower degree than a predetermined degree may be identified as cloud registrants who do not have attributes that are likely to cause authentication failure.

[0104] By taking into consideration attributes that are likely to cause authentication failure, cloud registrants who do not have attributes that are likely to cause authentication failure (in other words, cloud registrants who have attributes that are easy to authenticate) are registered as edge registrants in the edge server 10. Then, when face authentication is performed on an authentication target person corresponding to that edge registrant, the possibility of authentication failure can be reduced and a request for face authentication to the cloud server 20 can be avoided, thereby suppressing a decrease in throughput.

[0105] The selection and registration of an edge registrant may be performed only once or periodically. Furthermore, the edge registrant may be updated periodically or at specific timing. Alternatively, the registration of an edge registrant may be performed based on a request from a specific person. Here, the specific person may be, for example, an administrator who manages the behavior of the person to be authenticated (e.g., entering and exiting a gate). For example, when an authentication request is made from the edge server 10 to the cloud server 20, after the authentication request is made, the registration information of the cloud registrant corresponding to the authentication request may be registered in the edge server 10.

[0106] For example, if the edge registrants change depending on the time period, the edge registration determination unit 203 may delete the registration information of the edge registrants in a certain time period A from the second storage unit 101 of the edge server 10 after the time period A has passed. In this case, the edge registration determination unit 203 may store the registration information of the edge registrants in time period B in the second storage unit 101 before the time period B following time period A arrives.

[0107] Furthermore, for example, if an edge registrant in a certain time period does not pass through a gate for a certain period (e.g., one month), that is, if facial authentication of the edge registrant is not performed, the registration information of the edge registrant may be deleted from the edge server 10. Furthermore, for example, if the number of authentication failures of an edge registrant exceeds a predetermined number, the registration information of the edge registrant may be deleted from the edge server 10. When the edge registration determination unit 203 determines, based on past authentication results, that facial authentication processing of an edge registrant will not be performed for a certain period, the edge registration determination unit 203 may transmit, to the edge server 10 via the communication unit 204, an instruction to delete from the edge server 10 the registration information of the edge registrant who has failed authentication a predetermined number of times or more, based on past authentication results. Furthermore, the edge registration determination unit 203 may transmit, based on past authentication results, an instruction to delete from the edge server 10 the registration information of an edge registrant who has failed authentication a predetermined number of times or more.

[0108] <Processing Flow of Edge Registration> Next, the flow of edge registrant registration in the edge registration determination unit 203 of the cloud server 20 will be described using an example in which the time period is taken into consideration.

[0109] Fig. 5 is a flowchart showing an example of a process flow for registering an edge registrant according to the present embodiment. The flow shown in Fig. 5 is executed by the cloud server 20. The flow shown in Fig. 5 may also be executed periodically.

[0110] The edge registration determination unit 203 of the cloud server 20 acquires a log of the authentication result (authentication log) from the first storage unit 201 (step 101 (S101)). The length of the authentication log period is not particularly limited, but may be, for example, the authentication log for the most recent past week.

[0111] The edge registration determination unit 203 sets the time periods to be counted (S102). The length of the time periods to be set is not particularly limited. For example, the time periods to be set may be divided into two-hour intervals as described above, or into one-hour intervals, or into time periods such as morning and afternoon. The lengths of the time periods may be the same, or some time periods may be longer than other time periods.

[0112] The edge registration determination unit 203 tallies the number of times each of the M cloud registrants has been successfully authenticated in the past during the set time period (S103). The M cloud registrants may correspond to M cloud registration IDs. M indicates the number of cloud registrants and is an integer equal to or greater than 2. The cloud registration ID corresponds to the ID of the cloud registrant.

[0113] The edge registration determination unit 203 determines the top N cloud registrants in descending order of the number of times authentication has been successful (S104). Note that the N cloud registrants may correspond to N cloud registration IDs. N indicates the number of edge registrants that can be registered, and is an integer greater than or equal to 1 and less than M.

[0114] The edge registration determination unit 203 associates the registration information of the N cloud registrants with the set time period and registers them in the edge server 10 (S105). The N cloud registrants correspond to the edge registrants. Then, the flow shown in FIG. 5 ends.

[0115] The flow shown in FIG. 5 may be executed for each set time period.

[0116] <Authentication Process Flow> Next, the authentication process flow in the authentication system according to this embodiment, which includes the edge server 10 and the cloud server 20, will be described.

[0117] Fig. 6 is a flowchart showing an example of the flow of authentication processing according to this embodiment. The flow shown in Fig. 6 is executed in cooperation between the edge server 10 and the cloud server 20. The flow shown in Fig. 6 is started when a face image is detected.

[0118] The edge server 10 (for example, the face matching unit 102) extracts facial features of a captured face image of a captured image acquired from the image capturing device 30 (S201).

[0119] The edge server 10 (e.g., the face matching unit 102) performs face authentication processing based on the extracted face feature amount (S202). Note that the face authentication processing here is face authentication processing including face matching processing between the face feature amount of the edge registrant stored in the edge server 10 (e.g., the second storage unit 101) and the extracted face feature amount.

[0120] The edge server 10 (for example, the face matching unit 102) determines whether authentication has been successful among the edge registrants (S203).

[0121] If the authentication is successful among the edge registrants (YES in S203), the edge server 10 (for example, the face matching unit 102) instructs the gate to open the gate (S204).

[0122] If authentication fails for any edge registrant (NO in S203), the edge server 10 (e.g., the face matching unit 102) sends the facial features of the captured face image to the cloud server 20 to request face authentication processing from the cloud server 20 (S205).

[0123] The cloud server 20 (e.g., the face matching unit 202) that has received the facial feature data performs face authentication processing based on the received facial feature data (S206). Note that the face authentication processing here is face authentication processing that includes face matching processing between the facial feature data of the cloud registrant stored in the cloud server 20 (e.g., the first storage unit 201) and the received facial feature data.

[0124] The cloud server 20 (for example, the face matching unit 202) determines whether or not authentication has been successful among the cloud registrants (S207).

[0125] If authentication is successful among the cloud registrants (YES in S207), the cloud server 20 (e.g., face matching unit 202) instructs the gate to open the gate (S208). This instruction may be given directly from the cloud server 20 to the gate. Alternatively, the cloud server 20 may notify the edge server 10 of an authentication result indicating that authentication was successful, and the edge server 10 may then issue the instruction. Then, the flow shown in FIG. 6 ends.

[0126] If authentication fails for any cloud registrant (NO in S207), the cloud server 20 (e.g., the face matching unit 202) instructs the gate to close the gate (S209). In this case, an alert indicating that authentication failed may be output. This instruction may also be given directly from the cloud server 20 to the gate. Alternatively, the cloud server 20 may notify the edge server 10 of an authentication result indicating that authentication failed, and the edge server 10, upon receiving the notification, may give the instruction. Then, the flow shown in FIG. 6 ends.

[0127] In the flow shown in Fig. 6, after the edge server 10 extracts facial features in the process of S201, authentication is completed within the edge server 10 in the processes of S202 to S204, and the gate opening instruction can be completed. This reduces the number of communications from the edge server 10 to the cloud server 20, improving throughput. Also, in the flow shown in Fig. 6, if authentication fails within the edge server 10 in the process of S203, authentication can be requested from the cloud server 20, so that the authentication failure within the edge server 10 can be compensated for.

[0128] <Cases where authentication delays occur> As described above, if authentication fails in the edge server 10, the edge server 10 requests facial authentication from the cloud server 20. The time required from when the edge server 10 requests facial authentication from the cloud server 20 until the facial authentication is completed is longer than the time required for authentication to be successful in the edge server 10. This causes a delay in authentication of the person to be authenticated.

[0129] If there is a delay in authentication, the person to be authenticated may pass through the area of ​​the gate where verification is possible before authentication is completed, or the gate may be closed. For example, if the gate does not have a door to restrict the passage of the person to be authenticated, the person to be authenticated may pass through the gate before authentication of the person to be authenticated is completed. Two operation examples for such situations will be described below.

[0130] <Operation Example 1: When Warning the Person to be Authenticated> Fig. 7 is a diagram showing operation example 1 during an authentication request from the edge server 10 to the cloud server 20. Fig. 7 shows a person to be authenticated who is likely to pass through the gate while an authentication request is being made from the edge server 10 to the cloud server 20, and a display device 40 that is provided at the gate and displays information for the person to be authenticated. An example of information displayed on the display device 40 is also shown.

[0131] 7 may be displayed on the display device 40 under the control of the cloud server 20 or the edge server 10. For example, if the person to be authenticated moves beyond a predetermined position (e.g., a checkable area of ​​a gate) while the face matching unit 202 of the cloud server 20 is determining whether or not the person to be authenticated is included among the cloud registrants, the face matching unit 202 causes the display device 40 to display information indicating that the person to be authenticated has moved beyond the predetermined position (e.g., a checkable area of ​​a gate). Whether or not the person to be authenticated has moved beyond the predetermined position (e.g., a checkable area of ​​a gate) may be determined based on information detected by a sensor (e.g., a human presence sensor) provided at the gate.

[0132] 7 , to a person to be authenticated who is likely to pass through the gate while the edge server 10 is requesting authentication from the cloud server 20, the display device 40 displays a message indicating that the person to be authenticated is currently being authenticated and a message requesting the person to slow down or stop to wait for the authentication to be completed. If the person to be authenticated sees this message and slows down or stops, the situation in which the person to be authenticated passes through the gate can be avoided. Then, when the authentication of the person to be authenticated is completed and successful, the person to be authenticated is permitted to pass through the gate, thereby enabling appropriate authentication to be performed.

[0133] <Operation Example 2: Displaying Information to Administrator> Fig. 8 is a diagram showing operation example 2 during an authentication request from the edge server 10 to the cloud server 20. Fig. 8 shows an authentication target Z who has passed through the gate while an authentication request is being made from the edge server 10 to the cloud server 20, and a display device 40 that is provided in a space where the administrator waits and displays information for the administrator. An example of information displayed on the display device 40 is also shown.

[0134] 8, the display device 40 displays a message indicating that there is a person to be authenticated Z who has been determined to have passed through the gate fraudulently while an authentication request was being made from the edge server 10 to the cloud server 20, and that after it was determined that the person to be authenticated Z had passed through the gate fraudulently, the person to be authenticated Z has been successfully authenticated (i.e., it was not actually fraudulent passage). Note that in this example, successful authentication of the person to be authenticated Z means that the registration information of the person to be authenticated Z exists in the cloud server 20, i.e., the person to be authenticated Z is a cloud registrant.

[0135] Upon checking this display, the administrator may register the registration information of the person to be authenticated in the edge server 10, assuming that the person to be authenticated, who has illegally passed through the gate and entered the premises (e.g., an office), will pass through the gate again to leave the premises. For example, the administrator may register the registration information of the person to be authenticated in the edge server 10 by pressing an "Add to Edge" button as shown in Fig. 8. For example, the display device 40 transmits operation information indicating that the "Add to Edge" button has been pressed to the edge server 10, and the edge server 10 stores the registration information of the person to be authenticated based on the operation information.

[0136] 8 may be displayed on the display device 40 under the control of the cloud server 20 or the edge server 10. For example, if the person to be authenticated moves beyond a predetermined position (e.g., a checkable area of ​​a gate) while the face matching unit 202 of the cloud server 20 is determining whether or not the person to be authenticated is included among the cloud registrants, the face matching unit 202 causes the display device 40 to display information indicating that the person to be authenticated has moved beyond the predetermined position (e.g., a checkable area of ​​a gate). Whether or not the person to be authenticated has moved beyond the predetermined position (e.g., a checkable area of ​​a gate) may be determined based on information detected by a sensor (e.g., a human presence sensor) provided at the gate.

[0137] In this case, there is no particular limitation on the period for which the registration information of the authentication target Z is stored in the edge server 10. For example, the registration information may be stored in the edge server 10 for one day from the time when the authentication target Z fraudulently passes through the gate until the next day.

[0138] By this operation, the registration information of the person to be authenticated who has fraudulently passed through the gate while the edge server 10 is making a request for authentication to the cloud server 20 is stored in the edge server 10, so that when the person to be authenticated passes through the gate again, the authentication is successful without any delay in authentication, and the person can pass through the gate legitimately.

[0139] Note that, in the operation example 2, a case where a user passes through a gate illegally while the edge server 10 is making an authentication request to the cloud server 20 is taken as an example, but the present invention is not limited to this. For example, a similar operation may be performed in a case where the gate is closed while the edge server 10 is making an authentication request to the cloud server 20.

[0140] For example, the display device 40 displays a message indicating that the person Z to be authenticated was unable to pass through because the gate was closed while the edge server 10 was making an authentication request to the cloud server 20, and that the authentication of the person Z to be authenticated was successful and the gate was opened after the gate was closed. After checking this display, the administrator may register the registration information of the person Z to be authenticated in the edge server 10, assuming that the person Z who entered the premises through the gate will pass through the gate again to leave the premises.

[0141] By this operation, the registration information of the person to be authenticated who was unable to pass through because the gate was closed while the edge server 10 was making a request for authentication to the cloud server 20 is stored in the edge server 10, so that when the person to be authenticated passes through the gate again, the authentication is successful without any delay in authentication, and the person can pass through the gate legitimately.

[0142] As described above, in the authentication system according to the present embodiment, the cloud server 20 (an example of an information processing device) includes a first storage unit 201 that stores registration information of cloud registrants, an edge registration determination unit 203 (an example of a processing unit) that determines, from among the cloud registrants, edge registrants who satisfy predetermined conditions, and a communication unit 204 that transmits the registration information of the edge registrants to the edge server 10 (an example of another information processing device). The edge server 10 executes a facial recognition process to determine whether the person to be authenticated is included among the edge registrants. This configuration reduces the number of times that a facial image or facial feature amount of the person to be authenticated is transmitted to the cloud server, thereby reducing the communication load between the edge server and the cloud server and improving throughput, thereby shortening the time required to authenticate the person to be authenticated.

[0143] Furthermore, according to the present embodiment described above, the cloud server can dynamically and appropriately determine the edge registrant based on the registration information, etc., so that the edge registrant does not need to be manually set, and authentication can be performed more appropriately and smoothly. Furthermore, even if authentication based on the edge registrant fails, authentication based on the cloud registrant is performed in the cloud server, so that the authentication failure in the edge server can be compensated for.

[0144] Although the above-described embodiment illustrates a configuration including an "edge server" and a "cloud server," the present disclosure is not limited to this. For example, the present disclosure may be applied to a configuration including a "GPU memory" and a "CPU memory." GPU memory generally has a small capacity, or becomes expensive as the capacity increases. However, when facial features are stored in the GPU memory, high-speed matching can be performed through parallel calculations. CPU memory has a larger capacity than GPU memory, but the matching process is slower than that of a GPU. Based on these differences between the two types of memory, the "edge server" and "cloud server" of the present disclosure may be replaced with "GPU memory" and "CPU memory," respectively.

[0145] In addition, in the above-described embodiment, both entry and exit are managed at the entrances and exits of stations, offices, etc., but it is also possible to manage either entry into a facility or exit from a facility at the entrance or exit, and not manage the other.

[0146] Furthermore, in the above-described embodiment, facial recognition when passing through a gate has been described as an example, but the present disclosure is not limited to this. The present disclosure may be applied to cases where facial recognition is used in cases other than passing through a gate.

[0147] Summary of the embodiment An information processing device according to an embodiment of the present disclosure includes a processing unit that determines a second registrant who satisfies predetermined conditions from among first registrants who have been registered in advance, and a communication unit that transmits information regarding the face authentication processing of the second registrant to another information processing device that executes face authentication processing.

[0148] In this information processing device, when the processing unit receives information from the other information processing device requesting facial recognition of the person to be authenticated, it determines whether the person is included among the first registered persons based on the results of the facial recognition processing for the person.

[0149] In this information processing device, if the subject moves beyond a predetermined position while the processing unit is determining whether the subject is included among the first registered users, the processing unit displays information indicating that the subject has moved beyond the predetermined position on a display device owned by an administrator who manages the subject's movements.

[0150] In this information processing device, the processing unit determines, among the first registrants, a first registrant for whom the face authentication process is relatively easy, as the second registrant.

[0151] In this information processing device, the processing unit determines, as the second registrant, a first registrant who has an attribute that makes the face authentication process relatively easy among the first registrants.

[0152] In this information processing device, the processing unit determines the second registrant based on history information indicating a history of past results of face authentication processing of the first registrant.

[0153] In this information processing device, the processing unit determines, based on the history information, a first registrant who has previously succeeded in the facial recognition process during a specified time period as the second registrant for the specified time period.

[0154] In this information processing device, the processing unit determines the number of times that the first registrant has successfully completed the facial recognition process in the past within a specified time period based on the history information, and determines the first registrant among the first registrants whose number of times is equal to or greater than a threshold to be the second registrant.

[0155] In this information processing device, the processing unit determines a score indicating the similarity of facial recognition when the first registrant previously succeeded in the facial recognition process during a specified time period based on the history information, and determines the first registrant whose score is equal to or greater than a threshold value as the second registrant.

[0156] In this information processing device, the processing unit deletes information regarding the facial recognition processing of a second registrant for whom the facial recognition processing is not performed within a predetermined time period and / or a second registrant for whom the facial recognition processing has failed a predetermined number of times or more from the other information processing device.

[0157] An authentication system according to one embodiment of the present disclosure includes a first information processing device and a second information processing device, wherein the first information processing device determines a second registrant who satisfies predetermined conditions from among first registrants who have been registered in advance, and transmits information regarding the facial recognition processing of the second registrant to the second information processing device, which executes the facial recognition processing. The second information processing device determines whether the subject is included among the second registrants based on the information regarding the facial recognition processing of the second registrant received from the first information processing device and a facial image of the subject of the facial recognition processing.

[0158] The authentication system includes a display device owned by an administrator who manages the actions of the subject person.

[0159] In this authentication system, if the second processing unit determines that the subject is not included among the second registered persons, the first processing unit determines whether the subject is included among the first registered persons, and if the subject moves beyond a predetermined position while the first processing unit is determining whether the subject is included among the first registered persons, the display device displays information indicating that the subject has moved beyond the predetermined position.

[0160] In an information processing method according to one embodiment of the present disclosure, an information processing device determines a second registrant who satisfies predetermined conditions from among first registrants who have been registered in advance, and transmits information regarding the facial recognition processing of the second registrant to another information processing device that performs facial recognition processing.

[0161] A program according to one embodiment of the present disclosure causes an information processing device to perform a process of determining a second registrant who satisfies predetermined conditions from among first registrants who have been registered in advance, and transmitting information regarding the facial recognition processing of the second registrant to another information processing device that performs facial recognition processing.

[0162] The present disclosure can be realized in software, hardware, or software in conjunction with hardware.

[0163] Each functional block used in the description of the above embodiments may be partially or entirely realized as an LSI, which is an integrated circuit, and each process described in the above embodiments may be partially or entirely controlled by a single LSI or a combination of LSIs. The LSI may be composed of individual chips, or may be composed of a single chip that includes some or all of the functional blocks. The LSI may have data input and output. Depending on the degree of integration, the LSI may also be called an IC, system LSI, super LSI, or ultra LSI.

[0164] The integrated circuit method is not limited to LSI, and may be realized by a dedicated circuit, a general-purpose processor, or a dedicated processor. Also, a field programmable gate array (FPGA) that can be programmed after LSI manufacturing, or a reconfigurable processor that can reconfigure the connections and settings of circuit cells within the LSI, may be used. The present disclosure may be realized as digital processing or analog processing.

[0165] Furthermore, if an integrated circuit technology that can replace LSI emerges due to advances in semiconductor technology or other derivative technologies, it is natural that such technology may be used to integrate functional blocks. The application of biotechnology, etc. is also a possibility.

[0166] The present disclosure may be implemented in any type of apparatus, device, or system (collectively referred to as a communications apparatus) that has a communications function. The communications apparatus may include a radio transceiver and processing / control circuitry. The radio transceiver may include a receiver and a transmitter, or both functions. The radio transceiver (transmitter and receiver) may include a radio frequency (RF) module and one or more antennas. The RF module may include an amplifier, an RF modulator / demodulator, or the like. Non-limiting examples of communication devices include telephones (e.g., cell phones, smartphones), tablets, personal computers (PCs) (e.g., laptops, desktops, notebooks), cameras (e.g., digital still / video cameras), digital players (e.g., digital audio / video players), wearable devices (e.g., wearable cameras, smartwatches, tracking devices), game consoles, digital book readers, telehealth / telemedicine devices, communication-enabled vehicles or mobile transportation (e.g., cars, airplanes, ships), and combinations of the above devices.

[0167] The communication devices are not limited to portable or mobile devices, but also include any kind of non-portable or fixed equipment, devices, and systems, such as smart home devices (such as home appliances, lighting equipment, smart meters or measuring devices, control panels, etc.), vending machines, and any other "things" that may exist on an IoT (Internet of Things) network.

[0168] In recent years, in the field of IoT (Internet of Things) technology, CPS (Cyber ​​Physical Systems) has been attracting attention as a new concept that creates new added value by linking information between physical space and cyberspace. This CPS concept can also be adopted in the above-mentioned embodiment.

[0169] That is, as a basic configuration of a CPS, for example, an edge server located in physical space and a cloud server located in cyberspace can be connected via a network, and processing can be distributed and performed by processors installed on both servers. Here, it is preferable that each piece of processing data generated in the edge server or cloud server is generated on a standardized platform, and the use of such a standardized platform can improve the efficiency of building a system including a variety of sensor groups and IoT application software.

[0170] Communications include data communications via cellular systems, wireless LAN systems, communication satellite systems, and the like, as well as data communications via combinations of these.

[0171] A communications apparatus also includes devices such as controllers and sensors connected or coupled to a communications device that performs the communications functions described in this disclosure, such as controllers and sensors that generate control and data signals used by the communications device to perform the communications functions of the communications apparatus.

[0172] The communication apparatus also includes infrastructure facilities, such as base stations, access points, and any other apparatus, device, or system that communicates with or controls the various apparatuses listed above, but are not limited to these.

[0173] Although various embodiments have been described above with reference to the drawings, it goes without saying that the present disclosure is not limited to such examples. It is clear that a person skilled in the art can conceive of various modifications or alterations within the scope of the claims, and it is understood that these also naturally fall within the technical scope of the present disclosure. Furthermore, the components of the above-described embodiments may be combined in any manner without departing from the spirit of the disclosure.

[0174] Although specific examples of the present disclosure have been described in detail above, these are merely examples and do not limit the scope of the claims. The technology described in the claims includes various modifications and alterations of the specific examples exemplified above.

[0175] An embodiment of the present disclosure is suitable for a face authentication system.

[0176] REFERENCE SIGNS LIST 10 Edge server 20 Cloud server 30 Imaging device 40 Display device 101 Second storage unit 102, 202 Face matching unit 103, 204, 307 Communication unit 201 First storage unit 203 Edge registration determination unit 301 Processor 302 Memory 303 Storage 304 GPU 305 Input unit 306 Output unit 308 Bus

Claims

1. An information processing device comprising: a processing unit that determines a second registrant who satisfies predetermined conditions from among first registrants who have been registered in advance; and a communication unit that transmits information regarding face recognition processing of the second registrant to another information processing device that performs face recognition processing.

2. The information processing device of claim 1, wherein when the processing unit receives information from the other information processing device requesting facial recognition of a person to be authenticated, the processing unit determines whether the person is included among the first registered persons based on the result of facial recognition processing for the person.

3. The information processing device of claim 2, wherein if the subject moves beyond a predetermined position while the processing unit is determining whether the subject is included in the first registered persons, the processing unit displays information indicating that the subject has moved beyond the predetermined position on a display device owned by an administrator who manages the subject's movements.

4. The information processing device according to claim 1, wherein the processing unit determines, among the first registrants, a first registrant for whom the face recognition process is relatively easy, as the second registrant.

5. The information processing device according to claim 1, wherein the processing unit determines, among the first registrants, a first registrant having attributes that make the face recognition process relatively easy as the second registrant.

6. The information processing device according to claim 1, wherein the processing unit determines the second registrant based on history information indicating a history of past results of face recognition processing of the first registrant.

7. The information processing device according to claim 6, wherein the processing unit determines, based on the history information, a first registrant who has previously succeeded in the face recognition processing during a specified time period among the first registrants as the second registrant during the specified time period.

8. The information processing device according to claim 5, wherein the processing unit determines the number of times that the first registrant has been successful in the face recognition processing in the past during a specified time period based on the history information, and determines a first registrant among the first registrants whose number of times is equal to or greater than a threshold value as the second registrant.

9. The information processing device according to claim 6, wherein the processing unit determines a score indicating the similarity of facial recognition when the first registrant previously succeeded in the facial recognition process during a specified time period based on the history information, and determines a first registrant among the first registrants whose score is equal to or greater than a threshold value as the second registrant.

10. The information processing device according to claim 1, wherein the processing unit deletes information regarding face recognition processing of a second registrant for whom the face recognition processing is not performed within a predetermined time and / or a second registrant for whom the face recognition processing has failed a predetermined number of times or more from the other information processing device.

11. An authentication system comprising a first information processing device and a second information processing device, wherein the first information processing device determines a second registrant who satisfies predetermined conditions from among first registrants who have been registered in advance, and transmits information regarding the facial recognition processing of the second registrant to the second information processing device which executes the facial recognition processing, and the second information processing device determines whether the subject is included among the second registrants based on the information regarding the facial recognition processing of the second registrant received from the first information processing device and a facial image of the subject of the facial recognition processing.

12. The authentication system according to claim 11, further comprising a display device owned by an administrator who manages the actions of the subject person.

13. The authentication system described in claim 11, wherein, when the second processing unit determines that the subject is not included in the second registered persons, the first processing unit determines whether or not the subject is included in the first registered persons, and when the subject moves beyond a predetermined position while the first processing unit is determining whether or not the subject is included in the first registered persons, the display device displays information indicating that the subject has moved beyond the predetermined position.

14. An information processing method, in which an information processing device determines a second registrant who satisfies predetermined conditions from among first registrants who have been registered in advance, and transmits information regarding face recognition processing of the second registrant to another information processing device that performs face recognition processing.

15. A program that causes an information processing device to execute a process of determining a second registrant who satisfies predetermined conditions from among first registrants who have been registered in advance, and transmitting information regarding the face recognition processing of the second registrant to another information processing device that executes face recognition processing.

Images