Server device, system, server device control method, and storage medium

Abstract

The present invention provides a server device that contributes to reduction of burden on a user using an application via a server. The server device includes a storage means and an authentication control means. The storage means stores biometric information of each of a plurality of users belonging to a predetermined group. The authentication control means acquires biometric information of one user among the plurality of users, and executes authentication processing using the biometric information of the one user and the stored biometric information. In a case in which the authentication of the one user is successful, the authentication control means permits the one user to use an application provided by an application server.

Description

Server device, system, server device control method and storage medium

[0001] The present invention is based on the priority claim of Japanese Patent Application No. 2023-147470 (filed September 12, 2023), the entire contents of which are incorporated herein by reference. The present invention relates to a server device, a system, a method for controlling a server device, and a program.

[0002] There are technologies related to logging in to servers that provide applications required for business.

[0003] For example, Patent Literature 1 describes a system that allows members belonging to multiple organizations to select a system to access depending on their work, thereby improving the work efficiency of the work. The connection destination resolution system in Patent Literature 1 includes a connection destination resolution server including a computing device. The computing device receives a connection destination resolution request from a server of a specific organization that has received a notification of successful authentication for the member from an authentication server accessed by a terminal specifying a network address for the specific organization to which the member belongs. The computing device transmits identification information of the affiliated organization associated with the member to a server of the specific organization based on the member's identification information included in the connection destination resolution request. If there are multiple identification information of affiliated organizations, the computing device receives information on the selected organization desired by the member and identification information of the member from the server of the specific organization. The computing device transmits a logon processing request including the member's identification information to the server of the selected organization, and causes the server of the selected organization to execute logon processing for the terminal.

[0004] Japanese Patent Application Laid-Open No. 2015-109015

[0005] As disclosed in Patent Document 1, an ID (identification information) and a password are often used to authenticate a user attempting to log in to a server. However, it is a heavy burden for a user to remember an ID and a password for each server that provides an application.

[0006] A primary object of the present invention is to provide a server device, a system, a method for controlling a server device, and a program that contribute to reducing the burden on users who use applications via a server.

[0007] According to a first aspect of the present invention, a server device is provided which comprises: a storage means for storing biometric information of each of a plurality of users belonging to a specified organization; and an authentication control means for acquiring the biometric information of one of the plurality of users and performing an authentication process using the biometric information of the one user and the stored biometric information, wherein the authentication control means allows the one user to use an application provided by an application server if authentication of the one user is successful.

[0008] According to a second aspect of the present invention, there is provided a system including a terminal held by a user belonging to a specified organization, an application server, and a server device, wherein the server device is equipped with a storage means for storing biometric information of each of a plurality of users belonging to the specified organization, and an authentication control means for acquiring the biometric information of the one of the plurality of users from the terminal and performing an authentication process using the biometric information of the one user and the stored biometric information, and wherein the authentication control means allows the one user to use an application provided by the application server if authentication of the one user is successful.

[0009] According to a third aspect of the present invention, there is provided a method for controlling a server device, in which biometric information of each of a plurality of users belonging to a specified organization is stored in a server device, the biometric information of one of the plurality of users is acquired, an authentication process is performed using the biometric information of the one user and the stored biometric information, and if authentication of the one user is successful, the one user is permitted to use an application provided by an application server.

[0010] According to a fourth aspect of the present invention, a program is provided for causing a computer installed in a server device to execute the following processes: storing biometric information of each of a plurality of users belonging to a specified organization; acquiring the biometric information of one of the plurality of users and performing an authentication process using the biometric information of the one user and the stored biometric information; and, if authentication of the one user is successful, allowing the one user to use an application provided by an application server.

[0011] According to each aspect of the present invention, a server device, a system, a method for controlling a server device, and a program are provided that contribute to reducing the burden on users who use applications via a server. Note that the effects of the present invention are not limited to those described above. The present invention may achieve other effects instead of or in addition to the effects described above.

[0012] FIG. 1 is a diagram illustrating an overview of an embodiment. FIG. 2 is a flowchart illustrating the operation of an embodiment. FIG. 3 is a diagram illustrating an example of a schematic configuration of an information processing system according to the present disclosure. FIG. 4 is a diagram illustrating the operation of the information processing system according to the present disclosure. FIG. 5 is a diagram illustrating an example of a display of a terminal according to the present disclosure. FIG. 6 is a diagram illustrating an example of a processing configuration of a control server according to the present disclosure. FIG. 7 is a diagram illustrating an example of an employee management database according to the present disclosure. FIG. 8 is a flowchart illustrating an example of an operation of an authentication control unit according to the present disclosure. FIG. 9 is a flowchart illustrating an example of an operation of an authentication control unit according to the present disclosure. FIG. 10 is a diagram illustrating an example of a processing configuration of an application server according to the present disclosure. FIG. 11 is a sequence diagram illustrating an example of the operation of the information processing system according to the present disclosure. FIG. 12 is a diagram illustrating the operation of the information processing system according to the present disclosure. FIG. 13 is a diagram illustrating an example of a hardware configuration of a control server according to the present disclosure.

[0013] First, an overview of one embodiment will be described. Note that the reference numerals in the drawings are added to each element for convenience as an example to facilitate understanding, and the description of this overview is not intended to be limiting in any way. Furthermore, unless otherwise specified, the blocks shown in each drawing represent functional units, not hardware units. Connection lines between blocks in each drawing include both bidirectional and unidirectional lines. Unidirectional arrows are used to schematically indicate the flow of the main signal (data) and do not exclude bidirectionality. Note that in this specification and drawings, elements that can be similarly described may be assigned the same reference numerals to avoid redundant explanation.

[0014] A server device 100 according to one embodiment includes a storage unit 101 and an authentication control unit 102 (see FIG. 1). The storage unit 101 stores biometric information for each of a plurality of users belonging to a predetermined organization (step S1 in FIG. 2). The authentication control unit 102 acquires the biometric information of one of the users and performs authentication processing using the biometric information of the one user and the stored biometric information (step S2). If the authentication control unit 102 has successfully authenticated the one user, the authentication control unit 102 permits the one user to use an application provided by the application server (step S3).

[0015] When a user belonging to a predetermined organization wishes to use an application, the server device 100 acquires the user's biometric information. The server device 100 performs biometric authentication using the acquired biometric information and stores the results. When the user requests to use an application via the application server, if the server device 100 has successfully authenticated the user, the server device 100 permits the user to use the application. The user does not need to enter authentication information such as an ID or password into the application server, which reduces the burden on the user. Furthermore, the user does not need to remember an ID, password, etc., which improves convenience when using an application via the application server.

[0016] Specific embodiments will be described in more detail below with reference to the drawings.

[0017] First Embodiment The first embodiment will be described in more detail with reference to the drawings.

[0018] 3, the information processing system according to the first embodiment includes a control server 10 and multiple application servers 11, which are managed by a predetermined organization such as a company, a local government, a university, etc. In the first embodiment, a case will be described in which the control server 10 and the application servers 11 are managed and operated by a company.

[0019] The control server 10 is a server that manages employees belonging to a company, etc. The control server 10 generates accounts for employees and issues employee ID cards to employees.

[0020] The application server 11 is a server that provides in-house business applications necessary for employees to perform their work. For example, each application server 11 provides a healthcare application, a welfare application, an accounting procedure application, a time management application, etc. Alternatively, the application server 11 may provide a production management application, a sales management application, an inventory management application, an order management application, etc. related to the company's own products. The application server 11 provides any application related to the employee's work.

[0021] The control server 10 and the application server 11 may be installed in a company building or on a network (on the cloud).

[0022] A user (employee) carries a terminal 20. The employee operates the terminal 20 to access the control server 10 and the application server 11.

[0023] 3 are connected to a network. Specifically, the control server 10, the application server 11, and the terminal 20 are connected to the network by wired or wireless communication means.

[0024] 3 is an example and is not intended to limit the configuration. For example, the information processing system may include multiple control servers 10. Furthermore, the information processing system may include at least one application server 11.

[0025] [Overall Operation] Next, an overall operation of the information processing system according to the first embodiment will be described.

[0026] <Creating an Account> When an employee joins a company, the employee registers as an employee and operates the terminal 20 to access the control server 10.

[0027] The control server 10 acquires the employee's name, gender, date of birth, address, employee number, department, contact information (telephone number, email address, etc.), biometric information, etc. from a web page or the like for employee registration. Alternatively, a person in the human resources department or the like may input the employee's name, gender, etc. into the control server 10.

[0028] Examples of biometric information include data (features) calculated from physical characteristics unique to an individual, such as a face, fingerprint, voiceprint, veins, retina, or iris pattern. Alternatively, the biometric information may be image data such as a face image or fingerprint image. The biometric information may be any information that includes the user's physical characteristics. In this disclosure, a case where biometric information related to a person's "face" (a face image or features generated from a face image) is used will be described.

[0029] When the control server 10 acquires the name, gender, etc. from the employee, it generates an employee ID for identifying the employee. The control server 10 associates the generated employee ID with the acquired information and stores them in the employee management database. Details of the employee management database will be described later.

[0030] An employee account (employee account) is created by storing the employee ID, name, etc. in the employee management database. Once the employee account is created, the employee can use (seamlessly use) the in-house business applications provided by the company from the terminal 20. In other words, by using the terminal 20, the employee can complete his or her own work on a single terminal 20.

[0031] When an employee account is created, the control server 10 generates a digital employee ID card. The control server 10 uses the digital employee ID card to guarantee that the person to whom the digital employee ID card is issued is an employee of the company. The control server 10 generates the digital employee ID card by attaching a digital signature to a file containing information such as the employee's name, employee number, department, and contact information.

[0032] The control server 10 issues the generated employee ID and digital employee ID card to the employee. Specifically, the control server 10 transmits the generated employee ID and digital employee ID card to the terminal 20. The terminal 20 stores the received employee ID and digital employee ID card. For example, the terminal 20 stores the received digital employee ID card in a digital wallet.

[0033] <Using an In-house Business Application> Before using an in-house business application, an employee must be authenticated by the control server 10. An application for receiving authentication from the control server 10 is installed on the terminal 20.

[0034] When an employee launches the application, the terminal 20 acquires the employee's biometric information. The terminal 20 acquires a facial image of the employee by taking a selfie. The terminal 20 then transmits an "authentication request" to the control server 10, which includes the acquired biometric information (facial image) and the employee ID issued by the control server 10 (step S01 in FIG. 4).

[0035] Upon receiving the authentication request, the control server 10 searches the employee management database using the employee ID included in the notification as a key to identify the corresponding entry. The control server 10 then executes authentication processing using the biometric information stored in the identified entry and the biometric information included in the authentication request.

[0036] If the authentication is successful, the control server 10 stores the fact that the authentication of the employee accessing its own server has been successful in the employee management database. Employees who are determined to have been successfully authenticated can use various in-house business applications without entering an ID, password, etc.

[0037] The control server 10 notifies the terminal 20 of the authentication result (authentication success or failure). The control server 10 transmits a response to the authentication request to the terminal 20 (step S02). Specifically, if the authentication is successful, the control server 10 transmits a positive response indicating that to the terminal 20. If the authentication is unsuccessful, the control server 10 transmits a negative response indicating that to the terminal 20.

[0038] Upon receiving a successful authentication (positive response), the terminal 20 displays a GUI (Graphical User Interface) that allows the employee to select an in-house business application. For example, the terminal 20 displays a GUI such as that shown in FIG.

[0039] In response to the employee's selection, the terminal 20 transmits a "login request" including employee identification information to the application server 11 corresponding to the selected internal business application (step S03 in FIG. 4). The employee identification information is information for identifying the employee, and is exemplified by an employee ID issued by the control server 10.

[0040] When the application server 11 receives a login request including an employee ID, it inquires of the control server 10 whether the employee corresponding to the employee ID has been successfully authenticated. Specifically, the application server 11 sends an "authentication success / failure inquiry" including the employee identification information (employee ID) (step S04).

[0041] The control server 10 sends a response to the application server 11 according to the authentication status of the employee corresponding to the employee ID (step S05). If the employee authentication is successful, the control server 10 sends a positive response indicating that to the application server 11. If the employee authentication is not successful, the control server 10 sends a negative response indicating that to the application server 11.

[0042] In response to the response received from the control server 10, the application server 11 transmits a response to the login request to the terminal 20 (step S06). If the application server 11 receives a positive response, it transmits the positive response to the terminal 20. If the application server 11 receives a negative response, it transmits a negative response to the terminal 20.

[0043] If the control server 10 successfully authenticates the employee, the application server 11 permits the employee to use the in-house business application (permits the employee to log in). If the control server 10 fails to authenticate the employee, the application server 11 denies the employee from using the in-house business application (denies the employee from logging in).

[0044] In this way, employees can use internal business applications with single sign-on that supports biometric authentication.

[0045] Next, details of each device included in the information processing system according to the first embodiment will be described.

[0046] 6 is a diagram illustrating an example of a processing configuration (processing module) of the control server 10 according to an embodiment of the present disclosure. Referring to FIG. 6, the control server 10 includes a communication control unit 201, an employee management unit 202, an authentication control unit 203, and a storage unit 204.

[0047] The communication control unit 201 is a means for controlling communication with other devices. For example, the communication control unit 201 receives data (packets) from the application server 11. The communication control unit 201 also transmits data to the application server 11. The communication control unit 201 passes data received from other devices to other processing modules. The communication control unit 201 transmits data acquired from other processing modules to other devices. In this way, other processing modules transmit and receive data to and from other devices via the communication control unit 201. The communication control unit 201 has a function as a receiving unit that receives data from other devices and a function as a transmitting unit that transmits data to other devices.

[0048] The employee management unit 202 is a means for managing employees belonging to a company. The employee management unit 202 generates an ID for each of multiple users and a certificate (electronic certificate) that certifies that each of the multiple users belongs to a specific organization (company, university, etc.). The employee management unit 202 issues the generated ID and certificate to each of the multiple corresponding users.

[0049] The employee management unit 202 acquires the employee's name, gender, date of birth, address, employee number, department, contact information (telephone number, email address, etc.), biometric information (facial image), etc. from a predetermined web page or the like.

[0050] The employee management unit 202 generates feature quantities from the acquired facial image. Since existing technology can be used for the feature quantity generation process, a detailed description thereof will be omitted. For example, the employee management unit 202 extracts the eyes, nose, mouth, etc. from the facial image as feature points. The employee management unit 202 then calculates the positions of each feature point and the distances between each feature point as feature quantities (generating a feature vector consisting of multiple feature quantities).

[0051] Furthermore, the employee management unit 202 generates an employee ID for identifying the employee. The employee ID may be any information that can uniquely identify the employee. For example, the employee management unit 202 may assign a unique value each time an employee is registered as the employee ID.

[0052] The employee management unit 202 stores the generated employee ID, biometric information (feature amount), etc. in the employee management database (see FIG. 7). Note that the employee management database shown in FIG. 7 is an example and is not intended to limit the items to be stored. For example, the employee management database may also store facial images of employees.

[0053] Once the account is created, the employee management unit 202 generates a digital employee ID card. Specifically, the employee management unit 202 generates the digital employee ID card by attaching the company's digital signature to a file containing information such as the employee's name, employee number, department, and contact details.

[0054] The employee management unit 202 transmits the generated employee ID and digital employee ID card to the terminal 20 .

[0055] The authentication control unit 203 is a means for controlling authentication when an employee uses an internal business application. The authentication control unit 203 acquires biometric information of one of multiple users and performs authentication processing using the biometric information of the one user and the stored biometric information. Furthermore, if the authentication of the one user is successful, the authentication control unit 203 allows the one user to use an application provided by the application server 11.

[0056] The authentication control unit 203 processes an authentication request received from the terminal 20 and an inquiry about the success or failure of authentication received from the application server 11 .

[0057] The operation of the authentication control unit 203 when an authentication request is received will be described with reference to FIG.

[0058] The authentication control unit 203 receives an "authentication request" from the terminal 20 that has started a predetermined application (step S101).

[0059] Upon receiving the authentication request, the authentication control unit 203 searches the employee management database using the employee ID received from the terminal 20 as a key to identify the corresponding entry (step S102).

[0060] The authentication control unit 203 executes authentication processing using the biometric information stored in the identified entry and the biometric information included in the authentication request (step S103).

[0061] Specifically, the authentication control unit 203 generates features from the facial image included in the authentication request, and then performs a matching process (one-to-one matching) using the generated features and the features stored in the identified entry.

[0062] Specifically, the authentication control unit 203 calculates the similarity between corresponding face images using two feature amounts. Based on the result of threshold processing on the calculated similarity, the authentication control unit 203 determines whether the two images are face images of the same person. Note that the similarity can be calculated using a chi-squared distance, Euclidean distance, or the like. The greater the distance, the lower the similarity, and the closer the distance, the higher the similarity.

[0063] If the similarity is greater than a predetermined value (if the distance is shorter than a predetermined value), the authentication control unit 203 determines that the authentication is successful. If the similarity is equal to or less than the predetermined value, the authentication control unit 203 determines that the authentication is unsuccessful.

[0064] If the authentication fails (step S104, No branch), the authentication control unit 203 executes the processes from step S106 onwards.

[0065] If the authentication is successful (step S104, Yes branch), the authentication control unit 203 stores the fact that the authentication was successful in the employee management database (store authentication success; step S105). Specifically, the authentication control unit 203 sets "authenticated" in the authentication status field of the employee management database.

[0066] The authentication control unit 203 notifies the terminal 20 of the authentication result (authentication success or authentication failure) (step S106). If the authentication is successful, the authentication control unit 203 transmits a positive response indicating that to the terminal 20. If the authentication is unsuccessful, the authentication control unit 203 transmits a negative response indicating that to the terminal 20.

[0067] In this way, the authentication control unit 203 acquires the user's biometric information and ID from the user's terminal 20. The authentication control unit 203 uses the user's ID to identify the user's biometric information from among multiple pieces of biometric information that have been pre-registered. The authentication control unit 203 then executes authentication processing (one-to-one authentication) using the identified biometric information and the user's biometric information acquired from the terminal 20.

[0068] The authentication control unit 203 initializes the authentication status field of the employee management database at a predetermined timing or when a predetermined condition is satisfied. For example, the authentication control unit 203 initializes the authentication status field (setting it to "unauthenticated") when the date changes. Alternatively, the authentication control unit 203 may initialize the authentication status field when it receives a notification from the application server 11 that an employee has closed an application. For example, when the authentication control unit 203 receives a logout notification including an employee ID from the application server 11, it initializes the authentication status field of the entry corresponding to that employee ID.

[0069] Next, the operation of the authentication control unit 203 when an inquiry about the success or failure of authentication is received will be described with reference to FIG.

[0070] The authentication control unit 203 receives an "authentication success / failure inquiry" from the application server 11 (step S201).

[0071] When receiving the inquiry about the success or failure of authentication, the authentication control unit 203 searches the employee management database using the employee ID received from the application server 11 as a key, and identifies the corresponding entry (step S202).

[0072] The authentication control unit 203 acquires the setting value (authenticated, unauthenticated) of the authentication status field of the identified entry (acquire authentication status; step S203).

[0073] The authentication control unit 203 sends a response according to the acquired setting value (authentication status) to the application server 11 (step S204). If the employee's authentication status is authenticated, the authentication control unit 203 sends a positive response indicating that to the application server 11. If the employee's authentication status is not authenticated, the authentication control unit 203 sends a negative response indicating that to the application server 11.

[0074] In this way, the authentication control unit 203 obtains the user ID from the application server 11. If the authentication of the user is successful (if the authentication status is authenticated), the authentication control unit 203 notifies the application server 11 that the user has been authenticated. By notifying the application server 11 that the user has been authenticated, the authentication control unit 203 permits the user to use the application.

[0075] The storage unit 204 is a means for storing information necessary for the operation of the control server 10. The storage unit 204 stores biometric information for each of multiple users belonging to a specific organization. The storage unit 204 stores the biometric information and ID of each of the multiple users in association with an employee management database. More specifically, the storage unit 204 stores the ID of a user who has been determined to have been successfully authenticated in association with the fact that the user has been determined to have been successfully authenticated.

[0076] 10 is a diagram illustrating an example of a processing configuration (processing modules) of the application server 11 according to an embodiment of the present disclosure. Referring to FIG. 10, the application server 11 includes a communication control unit 301, a login control unit 302, an application providing unit 303, and a storage unit 304.

[0077] The communication control unit 301 is a means for controlling communication with other devices. For example, the communication control unit 301 receives data (packets) from the control server 10. The communication control unit 301 also transmits data to the control server 10. The communication control unit 301 passes data received from other devices to other processing modules. The communication control unit 301 transmits data acquired from other processing modules to other devices. In this way, other processing modules transmit and receive data to and from other devices via the communication control unit 301. The communication control unit 301 has a function as a receiving unit that receives data from other devices and a function as a transmitting unit that transmits data to other devices.

[0078] The login control unit 302 is a means for controlling employee login (employee authentication).

[0079] The login control unit 302 receives a login request from the employee's terminal 20. Upon receiving the login request, the login control unit 302 sends an "authentication success / failure inquiry" to the control server 10, which includes the employee ID included in the login request.

[0080] The login control unit 302 receives a response (positive response, negative response) to the inquiry about the success or failure of authentication from the control server 10 .

[0081] Depending on the response received from the control server 10, the login control unit 302 determines whether the employee is allowed to log in. If a positive response (authenticated) is received from the control server 10, the login control unit 302 permits the employee to log in. In this case, the login control unit 302 transmits a positive response indicating this to the terminal 20.

[0082] If the employee's login is permitted, the login control unit 302 passes the employee ID received from the terminal 20 (employee ID included in the login request) to the application providing unit 303 .

[0083] If a negative response (not authenticated) is received from the control server 10, the login control unit 302 denies the employee's login. In this case, the login control unit 302 sends a negative response indicating this to the terminal 20.

[0084] The application providing unit 303 is a means for providing an in-house business application. The application providing unit 303 identifies an employee based on the employee ID acquired from the login control unit 302, and provides the identified employee with an in-house business application corresponding to its own server.

[0085] A detailed description of each internal business application will be omitted, as details of each internal business application are outside the scope of the present disclosure.

[0086] The storage unit 304 is a means for storing information necessary for the operation of the application server 11 .

[0087] [Terminal] Examples of the terminal 20 include mobile terminal devices such as smartphones, mobile phones, game consoles, and tablets, as well as computers (personal computers, laptop computers). The terminal 20 can be any equipment or device that can accept operations from users (employees) and communicate with the control server 10, etc. Furthermore, the configuration of the terminal 20 is clear to those skilled in the art, so detailed explanation will be omitted.

[0088] An application for receiving authentication from the control server 10 and for selecting an in-house business application is installed on the terminal 20. When an employee launches the application, the terminal 20 sends an "authentication request" to the control server 10. If the authentication is approved by the control server 10, the terminal 20 displays a GUI such as that shown in Fig. 5. When the employee selects an in-house business application on the GUI, the terminal 20 sends a login request to the application server 11 that corresponds to the employee's selection.

[0089] Note that, for a predetermined period after receiving a successful authentication (a positive response to the authentication request) from the control server 10, the terminal 20 displays a GUI such as that shown in FIG. 5 without again sending an authentication request to the control server 10. Alternatively, the terminal 20 may acquire the user's biometric information and send an authentication request to the control server 10 when the date changes. Alternatively, the terminal 20 may acquire the user's biometric information and send an authentication request to the control server 10 when it receives a login failure (a negative response to the login request) from the application server 11. Specifically, when the terminal 20 launches the application, it displays the GUI shown in FIG. 5. The terminal 20 may send an authentication request to the control server 10 in response to receiving a negative response from the application server 11 corresponding to the application selected by the user. In this case, after receiving a successful authentication from the control server 10, the terminal 20 again sends a login request to the application server 11.

[0090] [System Operation] Next, the operation of the information processing system according to the first embodiment will be described.

[0091] 11 is a sequence diagram illustrating an example of the operation of the information processing system according to the embodiment of the present disclosure. The operation of the information processing system according to the first embodiment when an employee logs in to the application server 11 will be described with reference to FIG.

[0092] The terminal 20 transmits an authentication request including the employee's biometric information and employee ID to the control server 10 (step S01).

[0093] The control server 10 executes authentication processing using the biometric information registered in the employee account and the biometric information included in the authentication request (step S02).

[0094] The control server 10 transmits the authentication result to the terminal 20 (step S03).

[0095] Upon receiving the notification of successful authentication, the terminal 20 transmits a login request including the employee ID to the application server 11 corresponding to the in-house business application selected by the employee (step S04).

[0096] The application server 11 sends an authentication success / failure inquiry including the received employee ID to the control server 10 (step S05).

[0097] The control server 10 transmits a response to the application server 11 according to the authentication status (authenticated, unauthenticated) of the employee corresponding to the employee ID (step S06).

[0098] The application server 11 determines whether to permit login based on the response (authenticated or not) from the control server 10, and transmits a response to the login request to the terminal 20 (step S07).

[0099] Next, a modification of the first embodiment will be described.

[0100] <Variation 1> Even if an employee has biometric information registered in their employee account, authentication by the control server 10 may fail due to the environment when the facial image is acquired or changes in the employee's own face (for example, changes in face due to injury, etc.). In such cases, if the employee cannot use internal business applications, the employee's work will be delayed.

[0101] To solve this problem, if authentication using biometric information fails, the control server 10 may authenticate the employee using the digital employee ID card issued to the employee. The control server 10 may also re-authenticate the person who failed to be authenticated using the digital employee ID card. More specifically, if authentication of a user fails, the authentication control unit 203 performs authentication using the certificate (digital employee ID card) issued to the user.

[0102] Specifically, when the terminal 20 receives a negative response (authentication failed) in response to the authentication request, it sends a "re-authentication request" including the employee ID and digital employee ID stored internally to the control server 10 (see Figure 12).

[0103] The authentication control unit 203 of the control server 10 identifies the person to be authenticated (the person who failed authentication using biometric information) based on the employee ID included in the re-authentication request. Furthermore, the authentication control unit 203 verifies the digital employee ID included in the re-authentication request. The authentication control unit 203 verifies the digital signature attached to the digital employee ID.

[0104] If the digital signature verification is successful, the authentication control unit 203 sets the authentication status of the employee identified by the employee ID to "authenticated." If the digital signature verification is unsuccessful, the authentication control unit 203 does not take any particular action.

[0105] The authentication control unit 203 transmits a response (positive response or negative response) to the re-authentication request to the terminal 20. If the verification of the digital signature is successful, the authentication control unit 203 transmits a positive response indicating successful authentication to the terminal 20. If the verification of the digital signature is unsuccessful, the authentication control unit 203 transmits a negative response indicating unsuccessful authentication to the terminal 20.

[0106] Upon receiving the successful authentication (positive response), the terminal 20 displays a GUI such as that shown in FIG. 5, allowing the employee (the person to be authenticated who has been determined to have been successfully authenticated) to select an in-house business application.

[0107] <Modification 2> In the above embodiment, a case has been described in which the application server 11 sends an inquiry about the success or failure of authentication to the control server 10. Instead of sending this inquiry, the control server 10 may, when the authentication of an employee is successful, notify each application server 11 of information about the employee who has been successfully authenticated. When the authentication control unit 203 of the control server 10 has been successful, the authentication control unit 203 may notify each application server 11 of the fact that the authentication of the user has been successful.

[0108] Specifically, the control server 10 sends an "authentication success notification" including the employee ID of the employee who was successfully authenticated to each application server 11. Each application server 11 stores the employee ID included in the notification in its "login permitted user list."

[0109] Upon receiving the notification that authentication was successful, the terminal 20 sends a login request to the application server 11 corresponding to the internal business application selected by the employee. If the employee ID included in the login request is listed in the permitted login list, the login control unit 302 of the application server 11 allows the employee to log in. If the employee ID included in the login request is not listed in the permitted login list, the login control unit 302 denies the employee from logging in.

[0110] As described above, the control server 10 according to the first embodiment performs biometric authentication using the biometric information of the person to be authenticated. When a user requests to use an application via the application server 11, the control server 10 permits the user to use the application if authentication of the user is successful. As a result, the user does not need to enter authentication information such as an ID or password into the application server 11, thereby reducing the burden on the user. Furthermore, the fact that the user has been successfully authenticated is stored for a predetermined period of time, so the user can start using the in-house business application with a simple operation such as clicking an icon (an icon corresponding to the in-house business application) displayed on the terminal 20.

[0111] Next, the hardware of each device constituting the information processing system will be described. Fig. 13 is a diagram showing an example of the hardware configuration of the control server 10.

[0112] The control server 10 can be configured using an information processing device (a so-called computer), and has the configuration shown in Fig. 13. For example, the control server 10 includes a processor 311, a memory 312, an input / output interface 313, and a communication interface 314. The components such as the processor 311 are connected by an internal bus or the like, and are configured to be able to communicate with each other.

[0113] However, the configuration shown in Fig. 13 is not intended to limit the hardware configuration of the control server 10. The control server 10 may include hardware not shown, and may not include the input / output interface 313 as necessary. Furthermore, the number of processors 311 and the like included in the control server 10 is not intended to be limited to the example shown in Fig. 13; for example, the control server 10 may include multiple processors 311.

[0114] The processor 311 is a programmable device such as a central processing unit (CPU), a micro processing unit (MPU), or a digital signal processor (DSP). Alternatively, the processor 311 may be a device such as a field programmable gate array (FPGA) or an application specific integrated circuit (ASIC). The processor 311 executes various programs including an operating system (OS).

[0115] The memory 312 is a random access memory (RAM), a read only memory (ROM), a hard disk drive (HDD), a solid state drive (SSD), etc. The memory 312 stores an OS program, application programs, and various data.

[0116] The input / output interface 313 is an interface for a display device and an input device (not shown). The display device is, for example, a liquid crystal display, etc. The input device is, for example, a device that accepts user operations, such as a keyboard or a mouse.

[0117] The communication interface 314 is a circuit, module, etc. that communicates with other devices. For example, the communication interface 314 includes a network interface card (NIC).

[0118] The functions of the control server 10 are realized by various processing modules. The processing modules are realized, for example, by the processor 311 executing a program stored in the memory 312. The program can be recorded on a computer-readable storage medium. The storage medium can be a non-transitory medium such as a semiconductor memory, a hard disk, a magnetic recording medium, or an optical recording medium. That is, the present invention can also be embodied as a computer program product. The program can be downloaded via a network or updated using a storage medium storing the program. The processing modules can also be realized by semiconductor chips.

[0119] The application server 11, terminal 20, etc. can also be configured using information processing devices, just like the control server 10, and their basic hardware configurations are no different from those of the control server 10, so a description thereof will be omitted.

[0120] The control server 10, which is an information processing device, is equipped with a computer, and the functions of the control server 10 can be realized by causing the computer to execute a program. The control server 10 also executes the control method of the control server 10 by the program.

[0121] [Modification] The configuration, operation, etc. of the information processing system described in the above embodiment are merely examples, and are not intended to limit the configuration, etc. of the system.

[0122] In the above embodiment, the terminal 20 transmits an authentication request including an employee ID and biometric information to the control server 10. The terminal 20 may also transmit an authentication request including biometric information but not an employee ID to the control server 10. In this case, the control server 10 performs one-to-N authentication (N is a positive integer) using the biometric information included in the authentication request and multiple pieces of biometric information stored in the employee management database.

[0123] The control server 10 may set a validity period for the digital employee ID card issued to the employee. If a digital employee ID card whose validity period has expired is presented at the time of re-authentication, the control server 10 may determine that authentication of the person to be authenticated has failed.

[0124] The form of data transmission between each device (e.g., the control server 10, the terminal 20) is not particularly limited, but the data transmitted between these devices may be encrypted. Biometric information of users and other information is transmitted between these devices, and in order to appropriately protect this information, it is desirable to transmit and receive encrypted data.

[0125] In the above embodiment, the employee management database is configured inside the control server 10, but the database may also be configured on an external database server. That is, some of the functions of the control server 10 may be implemented on another server. More specifically, the above-described "authentication control unit (authentication control means)" and the like may be implemented on any device included in the system.

[0126] In the flow charts (flowcharts, sequence diagrams) used in the above explanation, multiple steps (processes) are described in order, but the order of execution of the steps executed in the embodiments is not limited to the order described. In the embodiments, the order of the steps shown in the drawings can be changed to the extent that the content is not affected, such as by executing each process in parallel.

[0127] The above-described embodiments have been described in detail to facilitate understanding of the present disclosure, and it is not intended that all of the above-described configurations are required. Furthermore, when multiple embodiments are described, each embodiment may be used alone or in combination. For example, it is possible to replace part of the configuration of one embodiment with the configuration of another embodiment, or to add the configuration of another embodiment to the configuration of one embodiment. Furthermore, it is possible to add, delete, or replace part of the configuration of one embodiment with another configuration.

[0128] The above explanation makes it clear that the present invention has industrial applicability, and the present invention can be suitably applied to information processing systems of companies and the like that determine whether employees and the like can use in-house business applications.

[0129] Some or all of the above embodiments can be described as, but are not limited to, the following supplementary notes.

[0130] [Supplementary Note 1] A server device comprising: a storage means for storing biometric information for each of a plurality of users belonging to a predetermined organization; and an authentication control means for acquiring the biometric information of one of the plurality of users and performing an authentication process using the biometric information of the one user and the stored biometric information, wherein the authentication control means allows the one user to use an application provided by an application server if authentication of the one user is successful. [Supplementary Note 2] The server device according to Supplementary Note 1, further comprising: a management means for generating an ID for each of the plurality of users and a certificate proving that each of the plurality of users belongs to the predetermined organization, and issuing the generated ID and certificate to each of the corresponding users. [Supplementary Note 3] The server device according to Supplementary Note 2, wherein the storage means stores the biometric information and ID of each of the plurality of users in association with each other, and the authentication control means acquires the biometric information and ID of the one user, identifies the biometric information of the one user from the stored biometric information using the ID of the one user, and performs an authentication process using the identified biometric information and the acquired biometric information of the one user. [Supplementary Note 4] The server device according to Supplementary Note 3, wherein the storage means stores the ID of the one user whose authentication has been determined to be successful and the fact that the authentication of the one user has been determined to be successful, in association with each other, and the authentication control means, when acquiring the ID of the one user from the application server, notifies the application server that the one user has been authenticated. [Supplementary Note 5] The server device according to any one of Supplements 2 to 4, wherein, when authentication of the one user fails, the authentication control means performs authentication using the certificate issued to the one user. [Supplementary Note 6] The server device according to Supplementary Note 1, wherein, when authentication of the one user is successful, the authentication control means notifies the application server of the fact that authentication of the one user has been successful.[Supplementary Note 7] A system including: a terminal owned by a user belonging to a specified organization, an application server, and a server device, wherein the server device comprises: storage means for storing biometric information of each of a plurality of users belonging to the specified organization, and authentication control means for acquiring the biometric information of the one of the plurality of users from the terminal and performing authentication processing using the biometric information of the one user and the stored biometric information, wherein the authentication control means allows the one user to use an application provided by the application server if authentication of the one user is successful. [Supplementary Note 8] A control method for a server device, wherein the server device stores the biometric information of each of a plurality of users belonging to a specified organization, acquires the biometric information of one of the plurality of users and performs authentication processing using the biometric information of the one user and the stored biometric information, and allows the one user to use an application provided by the application server if authentication of the one user is successful. [Supplementary Note 9] A program for causing a computer installed in a server device to execute the following processes: storing biometric information of each of a plurality of users belonging to a specified organization; acquiring the biometric information of one of the plurality of users and performing authentication processing using the biometric information of the one user and the stored biometric information; and, if authentication of the one user is successful, allowing the one user to use an application provided by an application server.

[0131] Furthermore, some or all of the configurations described in Supplementary Notes 2 to 6 that are dependent on Supplementary Note 1 above may also be dependent on Supplementary Notes 7, 8, and 9 in the same dependent relationship as Supplementary Notes 2 to 6. Furthermore, not limited to Supplementary Notes 1, 7, 8, and 9, some or all of the configurations described as Supplements may be made dependent on various hardware, software, various recording means for recording software, or systems, within the scope of each of the above-mentioned embodiments.

[0132] The disclosures of the above-cited prior art documents are incorporated herein by reference. Although the embodiments of the present invention have been described above, the present invention is not limited to these embodiments. Those skilled in the art will understand that these embodiments are merely illustrative and that various modifications are possible without departing from the scope and spirit of the present invention. In other words, the present invention naturally includes various modifications and alterations that may be made by those skilled in the art in accordance with the entire disclosure, including the claims, and the technical concepts thereof.

[0133] REFERENCE SIGNS LIST 10 Control server 11 Application server 20 Terminal 100 Server device 101 Storage means 102 Authentication control means 201 Communication control unit 202 Employee management unit 203 Authentication control unit 204 Storage unit 301 Communication control unit 302 Login control unit 303 Application providing unit 304 Storage unit 311 Processor 312 Memory 313 Input / output interface 314 Communication interface

Claims

1. A server device comprising: a storage means for storing biometric information of each of a plurality of users belonging to a specified organization; and an authentication control means for acquiring the biometric information of one of the plurality of users, and performing an authentication process using the biometric information of the one user and the stored biometric information, wherein the authentication control means permits the one user to use an application provided by an application server if authentication of the one user is successful.

2. The server device according to claim 1, further comprising a management means for generating an ID for each of the plurality of users and a certificate proving that each of the plurality of users belongs to the specified organization, and for issuing the generated ID and certificate to each of the plurality of corresponding users.

3. The server device described in claim 2, wherein the storage means stores the biometric information and ID of each of the multiple users in association with each other, and the authentication control means acquires the biometric information and ID of one of the users, identifies the biometric information of the one user from the multiple pieces of stored biometric information using the ID of the one user, and performs authentication processing using the identified biometric information and the acquired biometric information of the one user.

4. The server device according to claim 3, wherein the storage means stores the ID of the user who has been determined to have been successfully authenticated in association with the fact that the authentication of the user has been determined to have been successful, and when the authentication control means obtains the ID of the user from the application server, it notifies the application server that the user has been authenticated.

5. A server device according to any one of claims 2 to 4, wherein said authentication control means, if authentication of said one user fails, performs authentication using said certificate issued to said one user.

6. The server device according to claim 1, wherein said authentication control means, when the authentication of said one user is successful, notifies said application server of the fact that the authentication of said one user has been successful.

7. A system comprising: a terminal possessed by a user belonging to a specified organization; an application server; and a server device, wherein the server device is equipped with: a storage means for storing biometric information of each of a plurality of users belonging to the specified organization; and an authentication control means for acquiring the biometric information of the one of the plurality of users from the terminal and performing an authentication process using the biometric information of the one user and the stored biometric information, wherein the authentication control means permits the one user to use an application provided by the application server if authentication of the one user is successful.

8. A method for controlling a server device, comprising: storing biometric information of each of a plurality of users belonging to a specified organization in a server device; acquiring the biometric information of one of the plurality of users; performing an authentication process using the biometric information of the one user and the stored biometric information; and, if authentication of the one user is successful, permitting the one user to use an application provided by an application server.

9. A computer-readable storage medium storing a program for causing a computer mounted on a server device to execute the following processes: storing biometric information of each of a plurality of users belonging to a specified organization; acquiring the biometric information of one of the plurality of users and performing an authentication process using the biometric information of the one user and the stored biometric information; and, if authentication of the one user is successful, allowing the one user to use an application provided by an application server.

Images