Portable electronic device, biometric authentication execution timing control method, and computer-readable storage medium

Abstract

Provided is a portable electronic device capable of setting execution timing for fingerprint authentication processing.　A portable electronic device according to an embodiment comprises a memory, a biometric sensor, a communication interface, and a processor. The memory stores setting information for setting execution timing for biometric authentication processing. The biometric sensor detects biometric information. The communication interface receives a command. The processor determines execution timing for biometric authentication processing on the basis of the setting information, and executes, in accordance with the execution timing indicated by the determination result, the biometric authentication processing based on the biometric information detected by the biometric sensor, and command processing based on the command received by the communication interface.

Description

Portable electronic device, biometric authentication execution timing control method, and computer-readable storage medium

[0001] FIELD Embodiments of the present invention relate to a portable electronic device, a method for controlling timing of biometric authentication execution, and a computer-readable storage medium.

[0002] Security devices such as IC cards equipped with an IC (Integrated Circuit) chip have become widespread and are used as credit cards and IC passports. IC cards are also called portable electronic devices because they are carried by users.

[0003] For many years, personal identification numbers (PINs) have been used to prevent unauthorized use of IC cards, but fingerprint authentication, which offers higher security, is now being used.

[0004] Japanese Patent Publication No. 2006-215699 Japanese Patent Publication No. 2007-157002 International Publication No. 2007 / 066480

[0005] There are two types of IC cards: Native cards and Java cards. In the case of Native cards, fingerprint authentication processing is implemented in a specific command. In the case of Java cards, fingerprint authentication processing is called from the applet side. In IC cards, the execution timing of fingerprint authentication processing cannot be arbitrarily set, and improvements are desired.

[0006] In order to solve the above problems, the present invention provides a portable electronic device capable of setting the execution timing of fingerprint authentication processing, a biometric authentication execution timing control method, and a computer-readable storage medium.

[0007] A portable electronic device according to an embodiment includes a memory, a biometric sensor, a communication interface, and a processor. The memory stores configuration information for setting the execution timing of a biometric authentication process. The biometric sensor detects biometric information. The communication interface receives a command. The processor determines the execution timing of the biometric authentication process based on the configuration information, and executes the biometric authentication process based on the biometric information detected by the biometric sensor and command processing based on the command received by the communication interface according to the execution timing indicated by the determination result.

[0008] FIG. 1 is a block diagram showing an example of the configuration of an IC card as a portable electronic device according to an embodiment. FIG. 2 is a diagram showing an example of setting information stored in a data memory of an IC card as a portable electronic device according to an embodiment. FIG. 3 is a diagram showing an example of authentication information stored in a RAM of an IC card as a portable electronic device according to an embodiment. FIG. 4 is a flowchart showing a first example of biometric authentication processing by an IC card according to an embodiment. FIG. 5 is a sequence diagram including biometric authentication processing executed before command processing (before collision prevention processing) according to an embodiment. FIG. 6 is a flowchart showing a second example of biometric authentication processing by an IC card according to an embodiment. FIG. 7 is a sequence diagram including biometric authentication processing executed before command processing (before select processing) according to an embodiment. FIG. 8 is a sequence diagram including biometric authentication processing executed before command processing (before setting change processing) according to an embodiment. FIG. 9 is a flowchart showing a third example of biometric authentication processing by an IC card according to an embodiment. Embodiment

[0009] Hereinafter, embodiments will be described with reference to the drawings. First, the configuration of an IC card 1 as a portable electronic device according to the embodiment will be described. FIG. 1 is a block diagram showing an example configuration of an IC card as a portable electronic device according to the embodiment. The IC card 1 is an example of a portable electronic device that is activated (made operable) by power supplied from an external device. The IC card 1 executes processing in response to commands from a higher-level device. In this embodiment, the IC card 1 as a portable electronic device has a function of performing authentication using biometric information. For example, the IC card 1 is also referred to as a smart card. Furthermore, the IC card 1 may be implemented by replacing it with one function provided in a mobile terminal such as a smartphone, which is another example of a portable electronic device.

[0010] An IC card 1 as a portable electronic device according to an embodiment has a biometric authentication function that authenticates a person through biometric matching using biometric information acquired from the person. In the embodiment, the IC card 1 is described as having a biometric (fingerprint) authentication function that authenticates a person through fingerprint matching using a fingerprint as an example of biometric information. However, the biometric authentication function of the IC card 1 as a portable electronic device according to an embodiment is not limited to biometric matching using a fingerprint. For example, the portable electronic device exemplified by the IC card 1 may perform biometric authentication using biometric information other than a fingerprint.

[0011] In the exemplary configuration shown in FIG. 1 , the IC card 1 has a main body C. The main body C is formed into a card shape from, for example, plastic. The IC card 1 includes a module M as a control unit 11, a biometric matching unit 12, an LED 13, and the like within the main body C. For example, the module M is integrally formed with one or more IC chips connected to a communication interface. The module M as the control unit 11 is provided in the main body C while connected to the biometric matching unit 12, which has a processor 31 and a biometric sensor 32, and the LED 13.

[0012] In the configuration example shown in FIG. 1, a module M constituting the control unit 11 includes a processor 21 , a ROM 22 , a RAM 23 , a data memory 24 , and a communication interface 25 .

[0013] The processor 21 includes circuits that execute various processes. The processor 21 is, for example, a CPU (Central Processing Unit). The processor 21 controls the entire IC card 1. The processor 21 realizes various processing functions by executing programs stored in the ROM 22 or the data memory 24. For example, the processor 21 is one of the entities that execute a biometric authentication execution timing control method that determines and controls the execution timing of biometric authentication processing. However, some or all of the various functions executed by the processor 21, which will be described later, may be realized by hardware circuits.

[0014] The ROM 22 is a non-volatile memory that functions as a program memory. Control programs, control data, and the like are stored in the ROM 22 beforehand. The ROM 22 is incorporated into the IC card 1 during the manufacturing stage with the control programs, control data, and the like stored therein. The control programs and control data stored in the ROM 22 are incorporated beforehand according to the specifications of the IC card 1. For example, the ROM 22 stores a program that causes the processor 21 to execute processing in response to commands received from an external device (card reader / writer).

[0015] The RAM 23 is a volatile memory that functions as a working memory. The RAM 23 also functions as a buffer that temporarily stores data being processed by the processor 21. For example, the RAM 23 functions as a communication buffer that temporarily stores data to be transmitted and received between the processor 21 and an external device via the communication interface 25.

[0016] The data memory 24 is a non-volatile memory to which data can be written and rewritten. The data memory 24 is composed of, for example, an EEPROM (registered trademark) (Electrically Erasable Programmable Read Only Memory). Programs and various data according to the operational use of the IC card 1 are written to the data memory 24. Program files or data files are defined in the data memory 24, and control programs and various data are written to these files. In addition, some or all of the areas of the data memory 24 are tamper-resistant, allowing data to be stored securely.

[0017] The data memory 24 includes a first memory that stores biometric information (authentication data) of a legitimate user (registered person) and a second memory that stores password registration data for password verification.

[0018] For example, the data memory 24 serving as the first memory stores biometric information (biometric registration data) of the registrant as data for performing biometric authentication. When the IC card 1 performs biometric authentication using a fingerprint, the data memory 24 stores fingerprint data of the registrant (fingerprint registration data). The fingerprint data of the registrant is a fingerprint image or fingerprint feature data for comparison with fingerprint information acquired by a fingerprint sensor serving as the biometric sensor 32. Furthermore, fingerprint data for multiple fingers of one registrant may be registered in the data memory 24. Furthermore, when one IC card 1 is used by multiple users, fingerprint data of multiple registrants who are legitimate users may be registered in the data memory 24.

[0019] The communication interface 25 includes a communication control unit and an interface unit. The communication interface 25 is an interface for communicating with a host device that supplies power and commands to the IC card 1. The communication interface 25 realizes a communication function using a communication method corresponding to the interface of a card reader / writer connected to the host device. The communication interface 25 supports multiple communication methods.

[0020] The communication interface 25 includes a contact communication interface 251 that communicates with an external device by contacting the external device. The contact communication interface 251 includes a contact portion that makes physical and electrical contact with a reader / writer contact portion provided in the card reader / writer, and a communication control circuit that controls the transmission and reception of signals via the contact portion.

[0021] The communication interface 25 includes a contactless communication interface 252 that communicates with the card reader / writer in a contactless (wireless) manner. The contactless communication interface 252 includes an antenna that transmits and receives radio waves, a modulation circuit that generates radio waves to be transmitted from the antenna, and a demodulation circuit that generates a signal from the radio waves received by the antenna.

[0022] When the IC card 1 is realized as a contact-type IC card, the contactless communication interface 252 may not be a required component. Also, when the IC card 1 is realized as a contactless IC card, the contact communication interface 251 may not be required.

[0023] The biometric matching unit 12 has a processor 31 and a biometric sensor 32, and is connected to a module M serving as the control unit 11. The biometric matching unit 12 also has a memory that stores an authentication program and the like that the processor 31 uses to perform biometric authentication by biometric (fingerprint) matching.

[0024] The biometric sensor 32 detects biometric information. In this embodiment, the biometric sensor 32 is a fingerprint sensor that reads the user's fingerprint information (fingerprint image). The fingerprint sensor serving as the biometric sensor 32 is provided so that the sensor that reads the fingerprint is exposed on the surface of the main body C of the IC card 1, and reads the fingerprint of a person's finger that is held over the exposed sensor portion. Note that the biometric sensor 32 is not limited to a fingerprint sensor, and may be one that obtains biometric information other than a fingerprint.

[0025] The processor 31 executes a biometric authentication program to perform biometric authentication using fingerprint information as biometric information acquired by the biometric sensor 32. For example, the processor 31 extracts a fingerprint image from an image read by the fingerprint sensor serving as the biometric sensor 32, and performs fingerprint authentication by comparing the fingerprint image extracted from the image read by the fingerprint sensor with the fingerprint image (or fingerprint feature data) of the registrant registered in the data memory 24.

[0026] 1, the processor 31 provided separately from the processor 21 performs biometric authentication by biometric (fingerprint) matching, but the processor 21 may perform the biometric authentication. When the processor 21 performs the biometric authentication, biometric information read by the biometric sensor 32 may be supplied to the processor 21. For example, the processor 21 may extract fingerprint information from an image supplied from a fingerprint sensor serving as the biometric sensor 32, and match the extracted fingerprint information with the fingerprint information of the registrant registered in the data memory 24.

[0027] The LED 13 has a light-emitting element. The light-emitting state of the LED 13 is controlled by the control unit 11. The LED 13 is provided on the main body C in a state where the lit state can be seen on the surface of the main body C, for example.

[0028] 2 is a diagram showing an example of setting information stored in the data memory of an IC card as a portable electronic device according to an embodiment. The data memory 24 stores setting information for setting the execution timing of biometric authentication processing. The setting information includes, for each communication condition, the execution timing of the authentication processing, whether it can be set, whether the setting information can be changed, and the operation to be performed when authentication fails.

[0029] There are first and second communication conditions, and the first communication condition is to communicate with an external device via a contact communication interface 251, and the second communication condition is to communicate with an external device via a non-contact communication interface 252.

[0030] The execution timing of the biometric authentication process may be "during processing of the first command," "before executing the first command," "during processing of a specified command," or "before executing a specified command."

[0031] "During processing of the first command" is information that causes biometric authentication processing to be executed while the first command received by the IC card 1 is being processed from the start to the end of communication with the card reader / writer. For example, "during processing of the first command" is information that divides the processing of the first command into a first half and a second half, and causes biometric authentication processing to be executed in the middle of the first half. "Before executing the first command" is information that causes biometric authentication processing to be executed before executing the first command received.

[0032] "During processing of a specified command" is information that causes biometric authentication processing to be executed while the specified command is being processed. For example, "during processing of a specified command" is information that divides the processing of a specified command into a first half and a second half and executes biometric authentication processing in the middle of the first half. "Before executing a specified command" is information that causes biometric authentication processing to be executed before the specified command is executed. For example, if the specified command is a collision prevention processing command, "before executing a specified command" is information that causes biometric authentication processing to be executed before the collision prevention processing command is executed.

[0033] The data memory 24 stores the life cycle of the IC card 1. The life cycle is "manufacturing," "issuance," or "operation."

[0034] If the setting possibility at the time of manufacture indicates "possible", the execution timing of the authentication process can be set at the time of manufacture of the IC card 1. If the setting possibility at the time of manufacture indicates "not possible", the execution timing of the authentication process cannot be set at the time of manufacture of the IC card 1.

[0035] If the setting possibility is indicated as "possible" when issued, the execution timing of the authentication process can be set when the IC card 1 is issued. If the setting possibility is indicated as "not possible" when issued, the execution timing of the authentication process cannot be set when the IC card 1 is issued.

[0036] If the setting possibility during operation indicates "possible", the execution timing of the authentication process can be set during operation of the IC card 1. If the setting possibility during operation indicates "not possible", the execution timing of the authentication process cannot be set during operation of the IC card 1.

[0037] If the changeability of the setting information indicates "possible", the settings of the setting information can be changed. If the changeability of the setting information indicates "not possible", the settings of the setting information cannot be changed.

[0038] If the action to be taken when authentication fails indicates "transition to next process," the result of the authentication failure is stored in the data memory 24, and the process proceeds to the next process. If the action to be taken when authentication fails indicates "maintain state," the state is maintained until biometric authentication is successful.

[0039] 3 is a diagram illustrating an example of authentication information stored in the RAM of an IC card as a portable electronic device according to an embodiment. The authentication information includes authentication results for each communication condition. The authentication results include "not performed," "success," or "failure."

[0040] Next, the operation of the IC card 1 according to this embodiment will be described. The IC card 1 according to this embodiment has a function of operating in accordance with an existing communication protocol used for IC cards standardized by international standards, etc. The IC card 1 also has a biometric authentication function using biometric information acquired by the biometric sensor 32, and an authentication function based on password matching. The IC card 1 stores (holds) at least one password data item used for password matching. In this embodiment, the operation using biometric authentication by the IC card 1 will be described, but authentication based on password matching may also be used, or authentication based on password matching may be applied instead of biometric authentication.

[0041] 4 is a flowchart showing a first example of biometric authentication processing by an IC card according to an embodiment. The first example is a case where a second communication condition for communicating with an external device via the contactless communication interface 252 is satisfied. When the IC card 1 enters the magnetic field of the card reader / writer, the contactless communication interface 252 of the IC card 1 receives radio waves (ST121, YES) and supplies power (ST122). Note that if the IC card 1 does not enter the magnetic field of the card reader / writer, the contactless communication interface 252 of the IC card 1 does not receive radio waves (ST121, NO) and remains in standby mode.

[0042] For example, a card reader / writer, which is an external device, repeatedly transmits an anti-collision processing command at a fixed interval and waits for an anti-collision processing response transmitted from the IC card 1. The contactless communication interface 252 of the IC card 1 receives the anti-collision processing command repeatedly transmitted from the external device.

[0043] In response to receiving the collision prevention processing command, the processor 21 of the IC card 1 starts the program in the data memory 24, determines the execution timing of the biometric authentication processing based on the setting information in the data memory 24 (ST123), and controls the execution timing of the biometric authentication processing. In other words, the processors 21 and 31 control the execution timing of the biometric authentication processing based on the biometric information detected by the biometric sensor 32 and the command processing based on the command received by the communication interface 25 in accordance with the execution timing indicated by the determination result, and execute the biometric authentication processing and the command processing at that timing.

[0044] If the execution timing of the biometric authentication process included in the setting information of the data memory 24 indicates "stop operation" (ST124, YES), the processor 21 does not output an execution command for the biometric authentication process, stops the biometric authentication process operation, and executes the collision prevention process based on the collision prevention process command sent from the external device (ST131). In this case, the non-contact communication interface 252 sends a collision prevention process response to the external device that sent the collision prevention process command.

[0045] If the execution timing of the biometric authentication process included in the setting information of the data memory 24 does not indicate "stop of operation" (ST124, NO) but indicates "before execution of a command" (ST125, YES), the processor 21 outputs an instruction to execute the biometric authentication process before execution of the command based on the setting information, does not stop the biometric authentication process operation (ST124, NO), and the processor 31 executes the biometric authentication process before execution of the command (ST126).

[0046] For example, if the execution timing of the biometric authentication process included in the setting information of data memory 24 indicates "before the execution of a collision prevention process command," processor 21 outputs an execution command of the biometric authentication process before the execution of the collision prevention process command based on the setting information. Before the execution of the collision prevention process command, processor 31 compares the fingerprint information detected by biometric sensor 32 with the fingerprint image or fingerprint feature data registered in data memory 24, and determines that the comparison is successful if the comparison result meets a criterion (ST127, YES), or determines that the comparison is unsuccessful if the criterion is not met (ST127, NO). Note that in IC card 1, the roles of processors 21 and 31 may be performed by a single processor.

[0047] If the matching is successful, the processor 21 executes the collision prevention processing based on the collision prevention processing command sent from the external device (ST131), and the non-contact communication interface 252 sends a collision prevention processing response to the external device that sent the collision prevention processing command.

[0048] If the matching fails and the operation to be performed when authentication fails in the biometric authentication process contained in the setting information of the data memory 24 indicates "maintain the state" (ST128, YES), the processor 21 outputs a command to execute the biometric authentication process based on the setting information, and the processor 31 executes the biometric authentication process (ST126).

[0049] If the matching fails and the action to be taken when the biometric authentication process fails, which is included in the setting information of the data memory 24, indicates "transition to the next process" (ST128, NO), the processor 21 stores the authentication failure in the RAM 23 (ST129), executes the next process, which is the collision prevention process (ST112), and the non-contact communication interface 252 transmits a collision prevention process response to the external device that transmitted the collision prevention process command.

[0050] 5 is a sequence diagram including a biometric authentication process executed before command processing (before collision prevention processing) according to the embodiment. As shown in FIG. 5, the card reader / writer repeatedly transmits a collision prevention processing command at a fixed interval (ST111).

[0051] When the IC card 1 enters the magnetic field of the card reader / writer, the contactless communication interface 252 of the IC card 1 receives the collision prevention processing command repeatedly transmitted from the external device. In response to receiving the collision prevention processing command, the processor 21 of the IC card 1 starts the program in the data memory 24, determines the execution timing of the biometric authentication processing based on the setting information in the data memory 24 (ST123), and controls the execution timing of the biometric authentication processing.

[0052] In other words, the processors 21 and 31 perform biometric authentication processing at a predetermined timing based on the setting information in the data memory 24 (ST124 to ST129), perform command processing based on a command at a predetermined timing (ST112), and the non-contact communication interface 252 transmits a collision prevention processing response to the external device that transmitted the collision prevention processing command (ST112a).

[0053] For example, if the execution timing of the biometric authentication process included in the setting information of the data memory 24 indicates "before execution of a collision prevention process command," the processor 21 outputs an execution command for the biometric authentication process based on the setting information before execution of the collision prevention process command, and the processor 31 executes the biometric authentication process. The processor 21 executes the collision prevention process after execution of the biometric authentication process.

[0054] Furthermore, if the setting information in the data memory 24 indicates that the action to be taken when authentication fails in the biometric authentication process is to "maintain the state," the processor 21 outputs a command to execute the biometric authentication process based on the setting information until the biometric authentication is successful, and the processor 31 executes the biometric authentication process.

[0055] 6 is a flowchart showing a second example of biometric authentication processing by an IC card according to an embodiment. The second example is a case where the first communication condition for communicating with an external device is met via the contact communication interface 251. When the contact portion of the contact communication interface 251 of the IC card 1 comes into physical and electrical contact with a reader / writer contact portion provided in a card reader / writer, which is the external device, the contact portion of the contact communication interface 251 receives power from the reader / writer contact portion and supplies power to each portion of the IC card 1.

[0056] The processor 21 receives power supply from the contact portion of the contact communication interface 251 and executes an ATR (Answer To Reset) output process (ST211), and the contact communication interface 251 outputs the ATR as an initial response to the external device.

[0057] The external device receives the ATR from the IC card 1 and outputs a predetermined command to the IC card 1. For example, the external device outputs a select command or a setting change command to the IC card 1.

[0058] The contact communication interface 251 of the IC card 1 receives a select command or a setting change command from an external device, and the processor 21 executes a command reception process (ST222) and determines the timing of execution of the biometric authentication process based on the setting information in the data memory 24 (ST231). The processor 21 identifies the contact communication interface because the select command or the setting change command has been received by the contact communication interface 251. The processor 21 determines the timing of execution of the biometric authentication process based on the first communication condition included in the setting information in the data memory 24.

[0059] If the execution timing of the biometric authentication process included in the setting information of the data memory 24 indicates "operation stopped" (ST232, YES), the processor 21 does not output an execution command for the biometric authentication process, stops the biometric authentication process operation, executes command processing (select processing or setting change processing) based on the command (select command or setting change command) sent from the external device (ST223), executes response processing (ST224), and the contact communication interface 251 sends a response to the external device that sent the select command or setting change command.

[0060] If the execution timing of the biometric authentication process included in the setting information of the data memory 24 does not indicate "stop of operation" (ST232, NO) but indicates "before execution of a command" (ST233, YES), the processor 21 outputs an instruction to execute the biometric authentication process before execution of the command based on the setting information, and the processor 31 executes the biometric authentication process before execution of the command (ST234).

[0061] For example, if the execution timing of the biometric authentication process included in the setting information of data memory 24 indicates "before execution of a select command" or "before execution of a setting change command," processor 21 outputs an execution command for the biometric authentication process before execution of the select command or the setting change command based on the setting information. Before execution of the select command or the setting change command, processor 31 compares the fingerprint information detected by biometric sensor 32 with the fingerprint image or fingerprint feature data registered in data memory 24, and determines that the comparison is successful if the comparison result meets the criteria (ST235, YES), or determines that the comparison is unsuccessful if the criteria are not met (ST235, NO). Note that in IC card 1, the roles of processors 21 and 31 may be performed by a single processor.

[0062] If the match is successful, the processor 21 executes a select process or a setting change process based on the select command or setting change command sent from the external device (ST223), executes a response process (ST224), and the contact communication interface 251 sends a select process response or a setting change response to the external device that sent the select command or setting change command.

[0063] If the matching fails and the operation to be performed when authentication fails in the biometric authentication process contained in the setting information of the data memory 24 indicates "maintain the state" (ST236, YES), the processor 21 outputs a command to execute the biometric authentication process based on the setting information, and the processor 31 executes the biometric authentication process (ST234).

[0064] If the matching fails and the action to be taken when the biometric authentication process fails, which is included in the setting information of the data memory 24, indicates "transition to the next process" (ST236, NO), the processor 21 stores the authentication failure in the RAM 323 (ST237), executes the next process, which is the select process or the setting change process (ST223), executes the response process (ST224), and the contact communication interface 251 transmits a select process response or a setting change process response to the external device that sent the select command or the setting change command.

[0065] If there is a subsequent command process (ST225, NO), processor 21 executes a command reception process (ST226) and executes the command process (ST223). If there is no subsequent command process (ST225, YES), all processes end.

[0066] 7 is a sequence diagram including a biometric authentication process executed before a command process (before a select process) according to the embodiment. As shown in FIG. 7, the processor 21 of the IC card 1 receives power from the contact portion of the contact communication interface 251 and executes an ATR output process (ST211). The contact communication interface 251 outputs an ATR as an initial response to the external device (ST211a).

[0067] The external device receives the ATR from the IC card 1 and outputs a predetermined command to the IC card 1. For example, the external device outputs a select command to the IC card 1.

[0068] The IC card 1 receives the select command, performs command reception processing (ST222), execution timing determination processing (ST231), and biometric authentication processing (ST232 to ST237), performs command processing based on the command at a predetermined timing (ST223), performs response processing (ST224), and outputs a select response (ST224a).

[0069] For example, if the execution timing of the biometric authentication process included in the setting information of the data memory 24 indicates "before the execution of a select command," the processor 21 outputs an execution command for the biometric authentication process before the execution of the select command based on the setting information, and the processor 31 executes the biometric authentication process. After the execution of the biometric authentication process, the processor 21 executes the select process.

[0070] Furthermore, if the setting information in the data memory 24 indicates that the action to be taken when authentication fails in the biometric authentication process is to "maintain the state," the processor 21 outputs a command to execute the biometric authentication process based on the setting information until the biometric authentication is successful, and the processor 31 executes the biometric authentication process.

[0071] 8 is a sequence diagram including a biometric authentication process executed before a command process (before a setting change process) according to the embodiment. As shown in FIG. 8, the processor 21 of the IC card 1 receives power from the contact portion of the contact communication interface 251 and executes an ATR output process (ST211). The contact communication interface 251 outputs an ATR as an initial response to the external device (ST211a).

[0072] The external device receives the ATR from the IC card 1 and outputs a predetermined command to the IC card 1. For example, the external device outputs a setting change command to the IC card 1.

[0073] The IC card 1 receives the setting change command, performs a command reception process (ST222), an execution timing determination process (ST231), and a biometric authentication process (ST232 to ST237), performs command processing based on the command at a predetermined timing (ST223), performs a response response process (ST224), and outputs a setting change response (ST224a).

[0074] For example, if the execution timing of the biometric authentication process included in the setting information of the data memory 24 indicates "before the execution of a setting change command," the processor 21 outputs an execution command for the biometric authentication process based on the setting information before the execution of the setting change command, and the processor 31 executes the biometric authentication process. After the execution of the biometric authentication process, the processor 21 executes the setting change process.

[0075] Furthermore, if the setting information in the data memory 24 indicates that the action to be taken when authentication fails in the biometric authentication process is to "maintain the state," the processor 21 outputs a command to execute the biometric authentication process based on the setting information until the biometric authentication is successful, and the processor 31 executes the biometric authentication process.

[0076] 9 is a flowchart showing a third example of biometric authentication processing by an IC card according to an embodiment. The third example is a case where the first communication condition for communicating with an external device is met via the contact communication interface 251. When the contact portion of the contact communication interface 251 of the IC card 1 comes into physical and electrical contact with a reader / writer contact portion provided in a card reader / writer, which is the external device, the contact portion of the contact communication interface 251 receives power from the reader / writer contact portion and supplies power to each portion of the IC card 1.

[0077] The processor 21 receives power supply from the contact portion of the contact communication interface 251 and executes the ATR output process (ST211), and the contact communication interface 251 outputs the ATR as an initial response to the external device.

[0078] The external device receives the ATR from the IC card 1 and outputs a predetermined command to the IC card 1. For example, the external device outputs a select command or a setting change command to the IC card 1.

[0079] The contact communication interface 251 of the IC card 1 receives a select command or a setting change command from an external device, and the processor 21 executes a command reception process (ST222) and determines the timing to execute the biometric authentication process based on the setting information in the data memory 24 (ST231). Since the select command or the setting change command has been received by the contact communication interface 251, the processor 21 identifies the contact communication interface through an I / F determination process. The processor 21 determines the timing to execute the biometric authentication process based on the first communication condition included in the setting information in the data memory 24.

[0080] If the execution timing of the biometric authentication processing included in the setting information of the data memory 24 indicates "command processing" and also indicates "operation stopped," the processor 21 executes the first half of the command processing based on the setting information (ST223), does not output an instruction to execute the biometric authentication processing (ST232, YES), stops the biometric authentication processing, executes the second half of the command processing (ST224), executes the response response processing (ST225), and the contact communication interface 251 sends a response to the external device that sent the select command or setting change command.

[0081] If the execution timing of the biometric authentication process included in the setting information of the data memory 24 indicates "command processing" and does not indicate "operation stopped," the processor 21 executes the first half of the command processing based on the setting information (ST223) and outputs an instruction to execute the biometric authentication process (ST232, NO), and the processor 31 executes the biometric authentication process while the command is being executed (ST234, YES) (ST235).

[0082] For example, if the execution timing of the biometric authentication process included in the setting information of data memory 24 indicates "during execution of a select command" or "during execution of a setting change command," processor 21 outputs an execution command for the biometric authentication process while the select command or setting change command is being executed based on the setting information. While the select command or setting change command is being executed, processor 31 compares the fingerprint information detected by biometric sensor 32 with the fingerprint image or fingerprint feature data registered in data memory 24, and determines that the comparison is successful if the comparison result meets the criteria (ST236, YES), or determines that the comparison is unsuccessful if the criteria are not met (ST236, NO). Note that in IC card 1, the roles of processors 21 and 31 may be performed by a single processor.

[0083] If the match is successful, the processor 21 executes the second half of the select process or setting change process based on the select command or setting change command sent from the external device (ST224), executes the response process (ST225), and the contact communication interface 251 sends a select process response or setting change response to the external device that sent the select command or setting change command.

[0084] If the matching fails and the operation to be performed when authentication fails in the biometric authentication process contained in the setting information of the data memory 24 indicates "maintain the state" (ST237, YES), the processor 21 outputs a command to execute the biometric authentication process based on the setting information, and the processor 31 executes the biometric authentication process (ST235).

[0085] If the match fails and the action to be taken when the biometric authentication process fails, which is included in the setting information of the data memory 24, indicates "transition to the next process" (ST237, NO), the processor 21 stores the authentication failure in the RAM 323 (ST238), executes the second half of the next process, which is the select process or the setting change process (ST224), executes the response process (ST225), and the contact communication interface 251 transmits a select process response or a setting change process response to the external device that sent the select command or the setting change command.

[0086] The above-described IC card 1 enables biometric authentication processing to be performed at any timing. In other words, when the IC card 1 is implemented in combination with a secure element, the IC card 1 can perform fingerprint authentication processing at any timing without being controlled by a trigger from the secure element. Furthermore, the IC card 1 can perform fingerprint authentication processing at any timing, distinguishing between contact communication and contactless communication with a card reader / writer. For example, the IC card 1 can be configured to perform fingerprint authentication before collision prevention processing, allowing fingerprint authentication processing to be performed at a timing appropriate to the environment in which the IC card 1 is used, thereby improving convenience. In this way, the IC card 1 can perform fingerprint authentication processing at any timing, which also has the advantage of making it easier to achieve compatibility with IC cards that do not implement fingerprint authentication processing.

[0087] The program according to this embodiment may be transferred in a state where it is stored in an electronic device such as an IC card 1, or may be transferred in a state where it is not stored in an electronic device. In the latter case, the program may be transferred via a network, or may be transferred in a state where it is stored in a storage medium. The storage medium is a non-transitory tangible medium. The storage medium is a computer-readable medium. The storage medium may be any medium, such as an optical disk or a memory card, that can store a program and is readable by a computer, and its form is not important. The electronic device downloads the program transferred (provided) via a network and installs it in its memory, or reads the program from the storage medium and installs it in its memory.

[0088] Although several embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included within the scope and spirit of the invention, and are also included in the scope of the invention and its equivalents as defined in the claims.

[0089] REFERENCE SIGNS LIST 1 IC card 11 control unit 12 biometric matching unit 13 LED 21 processor 22 ROM 23 RAM 24 data memory 25 communication interface 31 processor 32 biometric sensor 251 contact communication interface 252 non-contact communication interface

Claims

1. A portable electronic device comprising: a memory that stores setting information for setting the execution timing of biometric authentication processing; a biometric sensor that detects biometric information; a communication interface that receives commands; and a processor that determines the execution timing of the biometric authentication processing based on the setting information, and executes biometric authentication processing based on the biometric information detected by the biometric sensor and command processing based on the command received by the communication interface according to the execution timing indicated by the determination result.

2. The portable electronic device of claim 1, wherein the setting information includes information for executing a biometric authentication process before executing a received command, and the processor executes the biometric authentication process before executing the received command based on the setting information.

3. The portable electronic device of claim 1, wherein the setting information includes information for executing a biometric authentication process before executing a collision prevention processing command, and the processor executes the biometric authentication process before executing the collision prevention processing command based on the setting information.

4. The portable electronic device of claim 1, wherein the setting information includes information for executing a biometric authentication process before executing a select command, and the processor executes the biometric authentication process before executing the select command based on the setting information.

5. The portable electronic device of claim 1, wherein the setting information includes information for executing a biometric authentication process during command processing based on the received command, and the processor executes the biometric authentication process during processing of the received command based on the setting information.

6. The portable electronic device of claim 1, wherein the communication interface includes a contactless communication interface for contactlessly communicating with an external device, the setting information includes information for executing biometric authentication processing before executing a received command when executing a process based on the received command received by the contactless communication interface, and the processor executes biometric authentication processing before executing the received command based on the setting information.

7. The portable electronic device of claim 1, wherein the communication interface includes a contact unit that comes into contact with and communicates with an external device, the setting information includes information for executing biometric authentication processing during execution of a received command when executing processing based on the received command received by the contact unit, and the processor executes biometric authentication processing during execution of the command based on the setting information.

8. A biometric authentication execution timing control method comprising: determining the execution timing of biometric authentication processing based on setting information that sets the execution timing of biometric authentication processing; and executing biometric authentication processing based on biometric information detected by a biometric sensor and command processing based on a command received by a communication interface according to the execution timing indicated by the determination result.

9. A computer-readable storage medium storing a program for causing a computer to execute the following steps: determining the execution timing of biometric authentication processing based on setting information that sets the execution timing of biometric authentication processing; and executing biometric authentication processing based on biometric information detected by a biometric sensor and command processing based on a command received by a communication interface, depending on the execution timing indicated by the determination result.

Images