Patent Application
20070177769
The present application claims priority from Japanese application JP2005-344881 filed on Nov. 30, 2005, the content of which is hereby incorporated by reference into this application.
The present invention relates to an information processing device such as a laptop type personal computer and in particular, to a hardware configuration or a control method for appropriately mounting an authentication device.
Recently, there often arises a problem of leak of personal information and other confidential information due to a theft or a loss of a laptop. Organizations handling personal information such as enterprises and communities care about the social information security.
Conventionally, in a laptop type personal computer, a log-in screen is displayed upon rise of an OS so that only a particular user can use it. The log-in method is a method for inputting a password through a keyboard operation. For this, in order to enhance the security, a password of high concealment should be set and there is a problem that a user has a difficulty to memorize his/her password.
People are highly conscious that it is necessary to prevent an unauthorized access by spoofing by a third person. More and more news are appearing on the use of biometrics information such as a fingerprint and a vein pattern as a key for authentication of an individual's identity. For example, JP-A-2005-128936 discloses a biometrics technology using a part of a human body as a key, i.e., finger vein authentication.
However, the authentication device disclosed in JP-A-2005-128936 is connected outside of an information processing device, which lowers the user-friendliness of the information processing device. Especially in the case of laptop type personal computer, the external size is increased, which lowers the portability. Moreover, since the biometrics processing is performed by an authentication device, the authentication device requires a sophisticated processing device, which increases the device cost.
It is therefore an object of the present invention to provide an authentication control configuration and an authentication procedure which can be appropriately used in an information processing device such as a laptop type personal computer.
In order to achieve the aforementioned object, an information processing device according to the present invention includes: a biometrics device, and interface control unit for controlling the biometrics device, a first storage unit for concealing a user identifier and user authentication information, a second storage unit for storing a program executed by the information processing device, and a processor for releasing the concealment of the first storage unit based on the program stored in the second storage unit and acquiring biometrics information inputted from the biometrics device via the interface control unit, so as to compare it to the user authentication information.
Moreover, the information processing device according to the present invention includes: a first nonvolatile storage unit for storing encrypted biometrics information, a second nonvolatile storage unit for storing an encryption key of the biometrics information, a lock release unit for releasing access lock of the first nonvolatile storage unit and the second nonvolatile storage unit, a decryption unit for decrypting the biometrics information by the encryption key of the biometrics information and recording it in the volatile storage unit, and an authentication unit for comparing the biometrics information decrypted by the volatile storage unit and the biometrics information acquired by a biometrics device, thereby performing authentication.
According to the present invention, the authentication device can be built in a laptop type personal computer without lowering its portability, thereby configuring a laptop type personal computer of high security at a low cost.
Other objects, features and advantages of the invention will become apparent from the following description of the embodiments of the invention taken in conjunction with the accompanying drawings.
Description will now be directed to an embodiment of the present invention with reference to the attached drawings.
In the figures, portions identical or similar to those of other figures in their operations or configurations are referred to by the common symbols, with explanation thereof being omitted.
Moreover, the memory controller 3 is connected to an I/O controller for controlling an I/O device. The processor 2 controls the I/O device via the memory controller 3 and the I/O controller 6.
In the personal computer of the present embodiment, a PCI bus of the I/O controller 6 is connected to a PC card controller 7, a radio LAN 8, and a cable LAN 9. Moreover, an LPC (Low Pin Count) interface is connected to keyboard controller 10, a BIOS-ROM 11, and a security chip 12.
Here, the security chip 12 is a controller having a memory for storing an encryption key, an RSA encryption function, a random number generation function, and an encryption function such as the Hash function. That is, the security chip 12 is hardware for supporting the security management of the personal computer. For example, it is possible to encrypt a file of the storage device such as a hard disc by the encryption function of the security chip 12.
The I/O controller .6 has a built-in CMOS memory 13 backed up by a battery. The CMOS memory 13 contains configuration information on the personal computer 1, a BIOS password, and the like. The log-in procedure using the BIOS password will be detailed later.
Moreover, the I/O controller 6 is connected to the storage device 14 such as a hard disc device (HDD) and a Compact Flash (trade mark) via an IDE bus. These storage devices 14 contain the operating system and the user application program and can store user data encrypted by the security chip 12.
Furthermore, the I/O controller 6 has a built-in controller of universal serial bus (USB) and connected to. a finger vein sensor 15 via the USB. The USB is also connected to a USB connector 17, so that a secure memory card and an external biometrics device can be connected to outside the device.
In the personal computer of the present embodiment, the storage device 14 connected to the IDE bus and a control circuit of the finger vein sensor 15 are formed as a unitary block, i.e., a module configuration 16. Next, explanation will be given on the outline of the finger vein device.
Since the imaging window 24 is arranged open on the upper portion of the personal computer 1, external turbulence and light are also inputted. For this, a visible light cut filter is arranged to reduce the affect of the external turbulence light. Moreover, operation display LED's '22, 23) are arranged to indicate the operation state of the finger vein sensor 20.
Next, referring to
The sensor/CF substrate 16 is connected to an USB interface performing interface with the finger vein sensor 20 and the IDE interface as a control interface of the recording device. The IDE interface is connected to a CF connector 30 to which a CF type recording device formed by a flash memory can be connected. Moreover, the sensor/CF substrate 16 and the finger vein sensor 20 are drive by power supplied from the IDE connector.
In this embodiment, the sensor/CF substrate 16 and the finger vein sensor 20 are formed with a size/capacity equivalent to or smaller than a 2.5-inch HDD. Thus, it is possible to provide the sensor/CF substrate 16 instead of the 2.5-inch HDD. That is, without modifying other components of the personal computer 1, it is possible to mount the biometrics device such as the finger vein sensor 20. As has been described above, the CF type storage device stores a basic operating system and a user application program.
Next, referring to
If the personal computer 1 is left for a predetermined time in the desk top state 35, a monitor power supply is turned off. In order to resume the desk top state 35, the log-on authentication should be performed again. This assures security of the personal computer 1 when the user of the personal computer 1 leaves his/her seat.
Authentication of the personal computer 1 of the present embodiment is performed at two stages: user authentication and log-on authentication. The authentication procedure will be detailed below.
The CPU 2 reads out the authentication code recorded in the personal computer 1 in advance (S302) and compares the read out authentication code to the authentication code inputted by the user (S202). If the comparison results in mismatching, an authentication code input error is caused and re-input is requested. When a predetermined number of input errors are caused, the user authentication processing is terminated and the personal computer 1 enters the standby state.
If the comparison shows that the authentication code has been registered one, it is judged whether the inputted authentication code is an authentication code of an administrator (S203). If the code is the authentication code of the administrator, the authentication code management mode is started. Although details are omitted here, the management mode performs registration of a new user and modification of the authentication code.
Here, as the authentication code, a plurality of digits of alphanumeric characters are inputted through keyboard operation. When the authentication code input is correct, it is possible to access authentication information such as a finger vein template, user ID/password, connection information, and a connection ID which will be detailed below. When the authentication code is complicated, security of the authentication information is increased but operability may be lowered. In order to improve the operability, the authentication information is recorded on a secure memory card, so that access can be performed via a USB connector 17 as shown in
When the registered authentication code is inputted, it is assumed that an authorized user is operating the personal computer and the next log-on authentication is performed.
The CPU 2 requests the user to input finger vein data (S204). In response to this, the user places his/her finger on the imaging window of the finger vein sensor (S205). Upon detection of a finger, the finger vein sensor inputs a camera image of the vein pattern by near infrared rays (S105). The CPU 2 acquires the imaged vein pattern (S205) and reads out the user finger vein template from the authentication information which has been unlocked (S306). A pattern matching is performed between the vein data acquired from the finger vein sensor and the user finger vein template so as to perform finger vein authentication processing (S206). If the result of the pattern matching (S207) is mismatching, it is judged that the authentication of the registered user has failed (S307). If the result of the pattern matching (S207) is matched, it is judged that the user is the registered user and a system log-on process (S208) is performed.
In the system log-on process (S208), a user ID and a password are read out from the authentication information (S308) and the system log-on is performed. Next, network connection information is read out from the authentication information (S309) and connection to the network is performed (S209). After this, a connection ID and a password of a remote server are read out from the authentication information (S310) and the server log-on process is performed (S210).
According to the aforementioned procedure, the user inputs the authentication code, so that the user finger vein authentication is performed and the system log-on process is automatically performed. Since the authentication is performed at the two stages, i.e., the authentication code and the finger vein pattern, it is possible to assure the system security and conceal the finger vein pattern and the connection information.
Next, referring to
Upon a finger vein data input request by the CPU 2 (S211), the control microcomputer 27 of the finger vein authentication sensor controls the near infrared ray LED (21) to blink (S112). In this state, a CCD camera 25 images a vein pattern of the finger of the user placed on the imaging window (24) of the finger vein authentication sensor (S113). The obtained image data is used to judge whether a finger exists (S114). When it is judged that a finger is placed on the imaging window (24), the control microcomputer 27 controls the near infrared ray LED (21) to a continuously ON state (S115) and images the vein pattern of the user's finger placed on the imaging window 24 of the finger vein authentication sensor (S116). The imaged finger vein pattern is transmitted to the CPU 2.
Here, when the near infrared ray LED (21) is controlled to blink, since a high-output LED light emission can be performed, a camera sensitivity may be lowered. Accordingly, it is possible to reduce the affect of the external turbulence light and easily judge whether user's finger is placed.
The CPU 2 receives the vein pattern image from the finger vein authentication sensor (S217) and performs image inclination correction (S217). This is performed for accurately performing the matching process with the user finger vein template. If the inclination cannot be corrected, the finger vein pattern is again acquired (S219).
After the inclination of the vein pattern is corrected, the CPU 2 acquires the user finger vein template from the authentication information (S320) and performs a matching process between the vein pattern acquired from the finger vein authentication sensor and the finger vein template (S320). If the matching process results in a low matching ratio, the authentication has failed (S321). If the matching process results in a predetermined matching ratio or above, the authentication is completed. Moreover, after the inclination of the vein pattern is corrected, the CPU 2 turns OFF the near infrared LED (21) of the finger vein authentication sensor (S120).
Thus, the control microcomputer 27 of the finger vein authentication sensor controls the near infrared ray LED (21), detects a finger, and images a vein pattern image while the CPU 2 of the personal computer performs the matching process of the vein pattern. That is, the pattern matching process requiring a large processing load is not performed by the control microcomputer 27 of the finger vein authentication sensor and accordingly, the control microcomputer 27 may be a low-performance microcomputer, which reduces the cost of the finger vein authentication sensor and the device size.
Next, referring to
The authentication information is formed by: authentication management data 37 including a finger vein template encryption key, a log-on ID, a log-on password, network connection information, a remote log-on ID, and remote server log-on password; and encrypted finger vein template; each of which is access locked by an authentication code. The authentication management data 37 and the encrypted finger vein template information 38 are provided for each of the users using thye personal computer 1.
The authentication management data 37 and the encrypted finger vein template information 38 are recorded on a security chip 12. When the storage capacity of the security chip 12 is small, the encrypted finger vein template information 38 may be stored in the storage device such as an HDD. In this case also, the finger vein template information 38 is encrypted and the encryption key is locked by the authentication code, which assures security.
As has been described in
It should be further understood by those skilled in the art that although the foregoing description has been made on embodiments of the invention, the invention is not limited thereto and various changes and modifications may be made without departing from the spirit of the invention and the scope of the appended claims.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2005-344881 | Nov 2005 | JP | national |
