Abstract:
The object of the present invention is to realize a biological authentication system which has a high authentication success rate and a low improper authentication rate and does not inconvenience users. In a server connected to a client, which creates biological data of a user to be authenticated, over a network and performs the authentication determination on the user, user authentication is performed by comparing identification information stored in the client and the identification information of reference biological data if multiple pieces of reference biological data have the degree of agreement with the biological data transmitted from the client beyond a set value.

Description:
BACKGROUND OF THE INVENTION 
       [0001]    1. Field of the Invention 
         [0002]    The present invention relates to a system, client and server for performing biological authentication by comparing biological data of a user and registered reference biological data. 
         [0003]    2. Description of the Related Art 
         [0004]    Highly precise personal authentication technologies are increasingly important in IT (information technology) systems,. In particular, biological authentication that performs personal authentication by using biological information is gathering attentions. The biological authentication performs authentication of a user by reading biological information such as fingerprints, a palm vein pattern and an iris by using an input device, creating biological data resulting from the extraction of features of the biological information and comparing it with registered reference biological data. The biological authentication is highly familiar to general users and is highly usable because the inconvenience of password input and the load of secret management are not imposed on users, the illegal use is not easy, and the security is high. 
         [0005]    On the other hand, the biological data obtained every time an authentication operation is performed may not provide the strict identity. Therefore, in comparing it with reference biological data, the success or failure of the authentication must be determined by defining a threshold value for the degree of the agreement between data. If the threshold value is defined high here, the created biological data may vary largely in some biological states and/or ways of inputting biological information, which results in the determination of the authentication failure despite of the identity and inconveniences the user. On the other hand, if the threshold value is defined low here in order not to inconvenience users, the comparison with biological data of a different person may highly possibly result in the determination of the authentication success. 
         [0006]    One method is to increase an amount of biological information to be obtained in order to increase the success rate of the authentication and decrease the improper authentication rate. However, since increasing the amount of information to be obtained and compared increases the complexity of the input device and also increases the amount of data to be handled, the prices of the authentication systems and services are increased. Accordingly, some fields may desire authentication systems at low prices. For example, a possible application is that a mobile terminal or a personally-owned terminal connected to a network is used to obtain biological data, and a service provider checks a personal identity through biological authentication to provide a service and/or an access right. In a typical example, the biological authentication may be used for payment processing in an online shopping using a mobile terminal. For such a personally-owned terminal, extremely inexpensive and simple input devices and authentication systems are desired. Therefore, a highly usable biological authentication technology is desired in a low price but with a high authentication success rate, a low improper authentication rate and without the necessity for complex operations such as password input. 
         [0007]    Regarding the biological authentication, technologies such as the one disclosed in Patent Document 1 have been proposed. 
         [0008]    There are, for example techniques described in Japanese Unexamined Patent Application Publication No. 2000-259278. 
       SUMMARY OF THE INVENTION 
       [0009]    One aspect is a biometric authentication method. The method comprises obtaining biometric data of a user by inputting biometric information of the user by a client, sending said biometric data obtained by the client and identification information of the client to a server, performing authentication of the user by the server on the basis of said biometric data and said identification information received by the server and reference biometric data of the user and reference identification information of the client stored in the server. 
         [0010]    According to the present invention, user authentication is performed based on biological data of a user, which is obtained and created in a client, and information from which the client is identifiable. Therefore, a biological authentication system can be realized which has a high authentication success rate and a low improper authentication rate and does not inconvenience users. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0011]      FIG. 1  is a diagram showing an entire hardware configuration of a client. 
           [0012]      FIG. 2  is a diagram showing an entire hardware configuration of a server. 
           [0013]      FIG. 3  is a functional block diagram of reference biological data creating processing in Example 1. 
           [0014]      FIG. 4  is a flowchart of the reference biological data creating processing in Example 1. 
           [0015]      FIG. 5  is a functional block diagram of biological authentication processing in Example 1. 
           [0016]      FIG. 6  is a flowchart (Part  1 ) of the biological authentication processing in Example 1. 
           [0017]      FIG. 7  is a flowchart (Part  2 ) of the biological authentication processing in Example 1. 
           [0018]      FIG. 8  is a functional block diagram of reference biological data creating processing in Example 2. 
           [0019]      FIG. 9  is a flowchart of the reference biological data creating processing in Example 2. 
           [0020]      FIG. 10  is a functional block diagram of reference biological data creating processing in Example 2. 
           [0021]      FIG. 11  is a flowchart (Part  1 ) of the biological authentication processing in Example 2. 
           [0022]      FIG. 12  is a flowchart (Part  2 ) of the biological authentication processing in Example 2. 
       
    
    
     DESCRIPTION OF THE PREFERRED EMBODIMENTS 
       [0023]    With reference to drawings, an embodiment of the present invention will be described below. Though examples will describe a case in which fingerprints are used as biological information, the biological information may be a palm vein pattern, an iris or the like. 
       First Embodiment 
       [0024]    Example 1 describes a case in which a specific user uses a specific client to perform biological authentication. Though a biological authentication system is constructed by connecting a client and a server over a network in Example 1 , a cellular phone, a PDA (Personal Data Assistant) or the like may be used, for example, instead of the client. 
         [0025]    Hardware Configuration Diagram: 
         [0026]      FIGS. 1 and 2  are block diagrams schematically showing examples of hardware configurations of a client  0  and a server  100  constructing a biological authentication system. 
         [0027]    The client  0  is constructed by connecting a CPU (Central Processing Unit)  2  that performs computing processing, an operating section  4  that receives the input of data, a display section  6  that displays information, a ROM (Read Only Memory)  8  that stores a program, a RAM (Random Access Memory)  10  that executes a program and/or stores data, an input device  12  that reads biological information of a user as an image, an external storage device  14  that stores a biological authentication program and unique information, which is information unique to the client  0 , for example, and a network interface  16  that exchanges data with the server  100  over a network through a bus  18 . 
         [0028]    The server  100  is constructed by connecting a CPU (Central Processing Unit)  102  that performs computing processing, an operating section  104  that receives the input of data, a display section  106  that displays information, a ROM (Read Only Memory)  108  that stores a program, a RAM (Random Access Memory)  110  that executes a program and/or stores data, an external storage device  114  that stores a biological authentication program and reference biological data, which is a reference for a user, for example, and a network interface  116  that exchanges data with the client  0  over a network through a bus  118 . 
         [0029]    In the client  0 , in response to a command to perform biological authentication from the operating section  4  by a user, the CPU  2  displays on the display section  6  to use the input device  12  to input biological information. The input device  12  reads biological information of the user as an image. Then, the CPU  2  executes a biological authentication program by loading and expanding the biological authentication program from the external storage device  14  to the RAM, 10 . The biological authentication program creates biological data from the image of the biological information read by the input device  12 . The biological data is transmitted to the server  100  through the network interface  16 . 
         [0030]    Also in the server  100 , the CPU  102  executes a biological authentication program in the same manner by loading and expanding the biological authentication program from the external storage device  114  to the RAM  110 . The biological authentication program performs biological authentication by comparing the biological data transmitted from the client  0  and reference biological data stored in the external storage device  114 . 
         [0031]    Notably, the biological authentication program is not always required to store in the external storage devices  14  land  114  from the beginning. For example, the biological authentication program may be stored from a program provider side to the external storage devices  14  and  114  through a public switched line, the Internet, a LAN, a WAN or the like. The biological authentication program stored in a portable storage medium may be set in the client and the server and be executed by the CPUs  2  and  102 . Storage media in various forms are applicable as the portable storage medium such as a CD-ROM, an optical disk and a DVD. 
         [0032]    Functional Block Diagram (Part  1 ): 
         [0033]      FIG. 3  is a functional block diagram schematically showing an example of a reference biological data creating function. The reference biological data creating function is constructed by the client  0  and the server  100 . The reference biological data creating function of the client  0  is constructed by biological information input means  202 , biological data creating means  204 , reference biological data creating means  206 , unique information determining means  208 , unique information storing means  210 , registration result receiving means  213 , registration result notifying means  214  and client communication means  216 . The reference biological data creating function of the server  100  is constructed by server communication means  316 , unique information overlap checking means  301  and reference biological data storing means  302 . The means of the reference biological data creating function will be described below. 
         [0034]    Biological Information Input Means: 
         [0035]    The biological information input means  202  reads fingerprints, which are biological information of a user, as an image. Then, the biological information input means  202  commands the biological data creating means  204  to create biological data based on the read fingerprint image. 
         [0036]    Biological Data Creating Means: 
         [0037]    The biological data creating means  204  extracts a characteristic point, for example, from the user&#39;s fingerprint image read by the biological information input means  202  and creates biological data to be used for creating reference biological data on which the reference biological data creating means  206  based for the user. The biological data is used by one-to-N comparing means  304  to compare with the reference biological data. The reference biological data creating means  206  and one-to-N comparing means  304  will be described later. 
         [0038]    Unique Information Determining Means: 
         [0039]    The unique information determining means  208  determines unique information to be associated with the biological data for creating the reference biological data by the reference biological data creating means  206 . The unique information is only required to determine a client uniquely. As the unique information, a Mac address, which is a unique value to a client, is applicable. The reference biological data creating means  206  will be described later. 
         [0040]    Reference Biological Data Creating Means: 
         [0041]    The reference biological data creating means  206  creates reference biological data that associates biological data and unique information. The reference biological data is used for comparison by the one-to-N comparing means  304 . 
         [0042]    Unique Information Storing Means: 
         [0043]    The unique-information storing means  210  stores unique information determined by the unique information determining means. 
         [0044]    Registration Result Receiving Means: 
         [0045]    The registration result receiving means  213  determines whether reference biological data has been stored in the reference biological data storing means  302  or not. The reference biological data storing means  302  will be described later. 
         [0046]    Registration Result Notifying Means: 
         [0047]    The registration result notifying means  214  displays on the display section  6  that reference biological data has been stored in the reference biological data storing means  302  and notifies a user that the reference biological data has been registered with the server. 
         [0048]    Client Communication Means: 
         [0049]    The client communication means  216  transmits reference biological data created by the reference biological data creating means  206  to the server. The client communication means  216  further receives the notification that reference biological data has been registered with the server from the server. The client communication means  216  additionally exchanges data with the server. 
         [0050]    Reference Biological Data Storing Means: 
         [0051]    The reference biological data storing means  302  stores reference biological data transmitted from a client. 
         [0052]    Unique Information Overlap Checking Means: 
         [0053]    The unique information overlap checking means  301  determines whether any overlap exists between the unique information of reference biological data transmitted from a client and the unique information of reference biological data already stored in the reference biological means  302  or not. If no overlaps exist in the unique information, the reference biological data is stored in the reference biological data storing means  302 . Then, the unique information overlap checking means  301  transmits the fact that the storing has completed to a client through the server communication means  316 . On the other hand, if some overlap exists in the unique information, the unique information overlap checking means  301  transmits a request for the reset of unique information to a client through the server communication means  316 . The server communication means  316  will be described later. 
         [0054]    Server Communication Means: 
         [0055]    The server communication means  316  receives reference biological data transmitted from a client. The server communication means  316  transmits to a client that the unique information overlap checking means  301  has completely stored reference biological data in the reference biological data storing means  302 . The server communication means  316  additionally exchanges data with a client. 
         [0056]    Flow of Preparation: 
         [0057]    With reference to  FIG. 4 , processing of creating reference biological data, which is a reference for a user in a comparison operation, will be described below. 
         [0058]    In step S 001 , the biological information input means  202  images a fingerprint image of a user, which is input through the input device  12  in the client  0 . The processing moves to step S 002 . 
         [0059]    In step S 002 , the biological data creating section  204  creates biological data based on the user&#39;s fingerprint image imaged by the biological information input means  202 . The processing moves to step S 003 . 
         [0060]    In step S 003 , the unique information determining means  208  determines unique information. Notably, the unique information may be a random number generated by a client or a server instead of the one described above. The processing moves to step S 004 . 
         [0061]    In step S 004 , the reference biological data creating means  206  creates reference biological data that associates biological data and unique information. Based on this, even if multiple pieces of reference biological data are similar to input user&#39;s biological data, the biological authentication can be performed based on the unique information. The processing moves to step S 005 . 
         [0062]    In step S 005 , the client communication means  216  transmits the reference biological data created by the reference biological data creating means to the server communication means  316  to register the reference biological data with the server  100 . The processing moves to step S 006 . 
         [0063]    In step S 006 , the server communication means  316  receives the reference biological data transmitted from the client communication means  216 . The processing moves to step S 007 . 
         [0064]    In step S 007 , the unique information overlap checking means  301  compares the unique information of the reference biological data already stored in the reference biological data storing means  302  and the unique information of the reference biological data received by the server communication means  316  in step S 006  and determines whether the unique information overlaps with each other or not. If the unique information overlaps, the processing moves to step S 008  where the server communication means  316  transmits the fact that the registration has failed to the client communication means  216 . On the other hand, if no unique information overlaps, the processing moves to step S 009 . Thus, the reference biological data having the overlapping unique information can be prevented from being stored in the server  100 . Then, the one-to-N comparing means  304  can perform the biological authentication, keeping the security based on the unique information. 
         [0065]    In step S 009 , the unique information overlap checking means  301  stores the,reference biological data received in step S 006  in the reference biological data storing means  302 . The processing moves to step S 010 . 
         [0066]    In step S 010 , the server communication means  316  transmits the fact that the registration has succeeded to the client communication means  216 . The processing moves to step S 011 . 
         [0067]    In step S 011 , the registration result receiving means  213  determines whether the result transmitted from the server communication means  316  to the client communication means  216  is the registration success or not. If so, the processing moves to step S 012 . If not on the other hand, the processing returns to step S 003 , and the processing above is repeated. 
         [0068]    In step S 012 , the unique information determining means  208  stores the unique information determined in step S 003  in the unique information storing means  210 . The processing moves to step S 013 . 
         [0069]    In step S 013 , the registration result notifying means  214  displays the fact that the reference biological data has been successfully registered on the display section  6  of the client  0 . The processing ends. 
         [0070]    Functional Block Diagram (Part  2 ): 
         [0071]      FIG. 5  is a functional block diagram schematically showing an example of the biological authentication function. The biological authentication function is constructed by the client  0  and the server  100 . The biological authentication function of the client  0  is constructed by biological information input means  202 , biological data creating means  204 , unique information storing means  210 , client communication means  216 , one-to-N comparison result receiving means  218 , and one-to-N comparison result notifying means  220 . The biological authentication function of the server  100  is constructed by server communication means  316 , reference biological data storing means  302 , one-to-N comparing means  304 , one-to-N comparison result determining means  308 , personal identity candidate data storing means  310 , unique information requesting means  312  and unique information comparing means  318 . The means of the biological authentication function will be described below. The same reference numerals are given to the means described on the functional block diagram (Part  1 ) in  FIG. 3 , and the description will be omitted. 
         [0072]    One-To-N Comparison Result Receiving Means: 
         [0073]    The one-to-N comparison result receiving means  218  determines whether the comparison result transmitted from the server  100  is the authentication success or not. Then, the one-to-N comparison result receiving means  218  notifies the comparison result to the one-to-N comparison result notifying means  220 . If the comparison result transmitted from the server  100  is the authentication failure and if obtaining unique information is requested by the server  100 , the one-to-N comparison result receiving means  218  obtains the unique information from the unique information storing means  210 . 
         [0074]    One-To-N Comparison Result Notifying Means: 
         [0075]    The one-to-N comparison result notifying means  220  displays the comparison result notified from the one-to-N comparison result receiving means  218  on the display section  6  of the client  0 . 
         [0076]    One-To-N Comparing Means: 
         [0077]    The one-to-N comparing means  304  calculates the degree of agreement by comparing the biological data transmitted from a client and the reference biological data stored in the reference biological data storing means  302 . The expression, “degree of agreement”, here refers to the degree of agreement between the biological data and the reference biological data. 
         [0078]    One-To-N Comparison Result Determining Means: 
         [0079]    The one-to-N comparison result determining means  308  compares the degree of agreement calculated by the one-to-N comparing means  304  and a threshold value defined by a user and obtains the reference biological data beyond the threshold value. Then, the one-to-N comparison result determining means  308  determines whether the authentication has succeeded or not by determining whether the degree of agreement is equal to or higher than the defined threshold value or not. Notably, the threshold value is desirably defined based on the aimed security level. If the reference biological data beyond the threshold value is unique, the one-to-N comparison result determining means  308  transmits the fact of the authentication success to the client through the server communication means  316 . If multiple pieces of reference biological data are beyond the threshold value, the one-to-N comparison result determining means  308  stores the reference biological data in the personal identity candidate data storing means  310 . Then, the one-to-N comparison result determining means  308  commands the unique information requesting means  312  to obtain unique information stored in the client. If the authentication success is determined based on the unique information, the one-to-N comparison result determining means  308  transmits the fact of the authentication success to the client  0  through the server communication means  316 . The unique information requesting means  312  will be described later. 
         [0080]    Personal Identity Candidate Data Storing Means: 
         [0081]    The personal identity candidate data storing means  310  stores multiple pieces of reference biological data obtained by the one-to-N comparison result determining means  308 . 
         [0082]    Unique Information Requesting Means: 
         [0083]    The unique information requesting means  312  requests unique information to a client through the server communication means  316 . 
         [0084]    Unique Information Comparing Means: 
         [0085]    The unique information comparing means  318  compares the unique information obtained by the unique information requesting means  312  and the unique information of the multiple pieces of reference biological data stored on the personal identity candidate data storing means  310  and determines whether any agreement exists between them or not. If some unique information agrees, the fact is notified to the one-to-N comparison result determining means  308 . 
         [0086]    Flow of Biological Authentication: 
         [0087]    With reference to  FIGS. 6 and 7 , processing of the biological authentication will be described below. 
         [0088]    In step S 101 , the biological information input means  202  images a fingerprint image of a user. The processing moves to step S 102 . 
         [0089]    In step S 102 , the biological data creating means  204  creates biological data based on the user&#39;s fingerprint image imaged by the biological information input means  202 . The processing moves to step S 103 . 
         [0090]    In step S 103 , the client communication means  216  transmits the biological data created by the biological data creating means  204  to the server communication means  316 . The processing moves to step S 104 . 
         [0091]    In step S 104 , the one-to-N comparing means  304  compares the biological data received by the server communication means  316  and multiple pieces of reference biological data already registered with the reference biological data storing means  302  and calculates the degree of agreement. The processing moves to step S 105 . 
         [0092]    In step S 105 , the one-to-N comparison result determining means  308  compares the degree of agreement calculated in step S 104  and a threshold value defined by a user and determines whether any reference biological data is beyond the threshold value or not. If so, the processing moves to step S 106 . If not on the other hand, the processing moves to step S 107 . 
         [0093]    In step S 106 , the one-to-N comparison result determining means  308  determines whether multiple pieces of reference biological data are beyond the threshold value defined by the user or not. If so, the processing moves to step S 109 . If the reference biological data beyond the threshold value is unique on the other hand, the processing moves to step S 108  where the one-to-N comparison result determining means  308  determines the authentication success. Then, the fact of the authentication success is transmitted from the server communication-means  316  to the client communication means  216 . 
         [0094]    In step S 109 , the one-to-N comparison result determining means  308  stores the multiple pieces of reference biological data in the personal identity candidate data storing means  310  as candidates of the reference biological data of the identity of the user. The processing moves to step S 110 . 
         [0095]    In step S 110 , the unique information requesting means  312  requests unique information from the server communication means  316  to the client  0 . The processing moves to step S 107 . 
         [0096]    In step S 107 , the one-to-N comparison result determining means  308  determines the authentication failure and transmits the fact of the authentication failure from the server communication means  316  to the client communication means  216 . The processing moves to step S 111 . 
         [0097]    In step S 111 , the one-to-N comparison result receiving means  218  determines whether the result transmitted from the server communication means  316  to the client communication means  216  is the authentication success or not. If so, the processing moves to step S 112 . If not on the other hand, the processing moves to step S 113 . 
         [0098]    In step S 113 , the one-to-N comparison result receiving means  218  determines whether unique information has been requested from the server  100  or not. If so, the processing moves to step S 114 . If not on the other hand, the processing moves to step S 118 . 
         [0099]    In step S 114 , the one-to-N comparison result receiving means  218  obtains unique information from the unique information storing means  210 . The processing moves to step S 115 . 
         [0100]    In step S 115 , the one-to-N comparison result receiving means  218  transmits the unique information from the client communication means  216  to the server communication means  316 . The processing moves to step S 116 . 
         [0101]    In step S 116 , the unique information comparing means  318  compares the unique information transmitted from the client communication means  216  and the unique information of the reference biological data stored in the personal identity candidate data storing means  310  and determines whether any unique information agrees or not. If so, the processing moves to step S 117  where the authentication success is determined. Then, the unique information comparing means  318  transmits the fact of the authentication success from the server communication means  316  to the client communication means  216 , and the processing moves to step S 112 . On the other hand, if no unique information agrees, the processing moves to step S 118  where the authentication failure is determined. Then, the unique information comparing means  318  transmits the fact of the authentication failure from the server communication means  316  to the client communication means  216 , and the processing moves to step S 119 . Thus, even if multiple pieces of reference biological data are similar to the input user&#39;s biological data as a result of the comparison performed by the one-to-N comparing means  304 , the biological authentication can be performed based on the pre-stored unique information, which does not inconvenience users. 
         [0102]    In step S 112 , the one-to-N comparison result notifying means  220  displays the fact of the authentication success on the display section  6  of the client  0  if the one-to-N comparison result receiving means  218  recognizes that the fact of the authentication success has been received from the client communication means  216 . The processing ends. 
         [0103]    In step S 119 , the one-to-N comparison result notifying means  220  displays the fact of the authentication failure on the display section  6  of the client  0  if the one-to-N comparison result receiving means  218  recognizes that the fact of the authentication failure has been received from the client communication means  216 . The processing ends. 
       Second Embodiment 
       [0104]    Second embodiment describes a case in which an indefinite number of users use a specific client to perform biological authentication. Since the hardware construction of the biological authentication system is the same as the one described with reference to  FIGS. 1 and 2  in Example 1 , the description will be omitted. 
         [0105]    Functional Block Diagram (Part  3 ): 
         [0106]      FIG. 8  is a functional block diagram schematically showing an example of a reference biological data creating function. The reference biological data creating function is constructed by the client  0  and the server  100 . The reference biological data creating function of the client  0  is constructed by biological information input means  202 , biological data creating means  204 , reference biological data creating means  206 , group information selecting/determining means  222 , group information storing means  224 , reference biological data overlap notifying means  226 , registration result receiving means  213 , registration result notifying means  214  and client communication means  216 . The reference biological data creating function of the server  100  is constructed by server communication means  316 , reference biological data overlap checking means  320 , and reference biological data storing means  302 . The means of the reference biological data creating function will be described below. The same reference numerals are given to the means already described with reference to the functional block diagrams (Part  1 ) and (Part  2 ) in Example 1 , and the description will be omitted. 
         [0107]    Group Information Storing Means: 
         [0108]    The group information storing means  224  stores information from which a user is not completely identifiable such as the organization that the user belongs to and birth year of the user. In Example 2 , the organizations (i.e. division) that users belong to such as “Authentication System Research Division” and “Patent Division” are stored in the group information storing means  224 . 
         [0109]    Group Information Selecting/determining Means: 
         [0110]    The group information selecting/determining means  222  selects an organization that a user belongs to from the group information storing means. The selected organization becomes the reference biological data in the reference biological data creating means  206  by being associated with the biological data created by the biological data creating means  204 . 
         [0111]    Reference Biological Data Overlap Notifying Means: 
         [0112]    The reference biological data overlap checking means  320  determines whether any similar reference biological data has been stored already in the reference biological data storing means or not. If so, the reference biological data overlap notifying means  226  displays the fact on the display section  106 . The reference biological data overlap checking means  320  will be described later. 
         [0113]    Reference Biological Data Checking Means: 
         [0114]    The reference biological data overlap checking means  320  calculates the degree of agreement between the reference biological data transmitted from a client and the reference biological data already stored in the reference biological data storing means  302 . If the reference biological data has the same group information and the degree of agreement equal to or higher than a defined threshold value, the fact is transmitted to the client through the server communication means  316 . 
         [0115]    Flow of Preparation: 
         [0116]    With reference to  FIG. 9 , processing of creating reference biological data from which a user is identifiable in a comparison operation will be described below. 
         [0117]    In step S 201 , the biological information input means  202  images a fingerprint image of a user, which is input from the input device  12  of the client  0 . The processing moves to step S 202 . 
         [0118]    In step S 202 , the biological data creating section  204  creates biological data based on the user&#39;s fingerprint image imaged by the biological information input means  202 . The processing moves to step S 203 . 
         [0119]    In step S 203 , the group information selecting/determining means  222  selects the division from the group information storing means  224  based on an operation by a user through the operating section  4  of the client  0 . The processing moves to step S 204 . 
         [0120]    In step S 204 , the reference biological data creating section  206  creates reference biological data that associates the biological data and the division. The processing moves to step S 205 . 
         [0121]    In step S 205 , the client communication means  216  transmits the reference biological data created by the reference biological data creating means  206  to the server communication means  316 . The processing moves to step S 206 . 
         [0122]    In step S 206 , the server communication means  316  receives the reference biological data transmitted from the client communication means  216 . The processing moves to step S 207 . 
         [0123]    In step S 207 , the reference biological data overlap checking means  320  compares the reference biological data already stored in the reference biological data storing means  302  and the reference biological data received by the server communication means  316  in step S 206  and calculates the degree of agreement. Then, the reference biological data overlap checking means  320  determines whether any reference biological data has the degree of agreement beyond a threshold value defined by a user or not. If so, the processing moves to step S 208  where the server communication means  316  transmits the fact of the registration failure to the client communication means  216 . If not on the other hand, the processing moves to step S 209 . Thus, reference biological data having the same division and similar biological data can be prevented from being registered with the server. 
         [0124]    In step S 209 , the reference biological data overlap checking means  320  stores the reference biological data received in step S 206  to the reference biological data storing means  302 . The processing moves to step S 210 . 
         [0125]    In step S 210 , the server communication means  316  transmits the fact of the registration success to the client communication means  216 . The processing moves to step S 211 . 
         [0126]    In step S 211 , the registration result receiving means  213  determines whether the result transmitted from the server communication means  316  is the registration success or not. If so, the processing moves to step S 213 . If not on the other hand, the processing moves to step S 212 . 
         [0127]    In step S 212 , the registration result notifying means  214  displays the fact of the registration failure on the display section  6  of the client  0 . The processing ends. 
         [0128]    In step S 213 , the registration result notifying means  214  displays the fact of the registration success on the display section  6  of the client  0 . The processing ends. 
         [0129]    Functional Block Diagram (Part  4 ): 
         [0130]      FIG. 10  is a functional block diagram schematically showing an example of a biological authentication function. The biological authentication function is constructed by the client  0  and the server  100 . The biological authentication function of the client  0  is constructed by the biological information input means  202 , biological data creating means  204 , one-to-N comparison result receiving means  218 , one-to-N comparison result notifying means  220 , group information storing means  224  and client communication means  216 . The biological authentication function of the server  100  is constructed by server communication means  316 , reference biological data storing means  302 , one-to-N comparing means  304 , one-to-N comparison result determining means  308 , personal identity candidate data storing means  310 , group information requesting means  318  and group information comparing means  322 . The means of the biological authentication function will be described below. The same reference numerals are given to the means already described with reference to the functional block diagrams (Part  1 ) and (Part  2 ) in Example 1 and the functional block diagram (Part  3 ) in Example 2 , and the description will be omitted. 
         [0131]    Group Information Requesting Means: 
         [0132]    The group information requesting means  318  requests group information to a client through the server communication means  316 . The group information in Example 2 is the division information of a user as described above. 
         [0133]    Group Information Comparing Means: 
         [0134]    The group information comparing means  322  compares the group information obtained by the group information requesting means  318  and the group information of the reference biological data stored in the personal identity candidate data storing means  310  and determines whether any agreement exists therebetween or not. If so, the fact is notified to the one-to-N comparison result determining means  308 . 
         [0135]    Flow of Biological Authentication: 
         [0136]    With reference to  FIGS. 11 and 12 , the processing of the biological authentication in Example 2 will be described below. In this example, when a client is started by a user, the group information is defined. The defined group information is stored in the group information storing means  224 . 
         [0137]    In step S 301 , the biological information input means  202  images a fingerprint image of the user. The processing moves to step S 302 . 
         [0138]    In step S 302 , the biological data creating means  204  creates biological data based on the user&#39;s fingerprint image imaged by the biological information input means  202 . The processing moves to step S 304 . 
         [0139]    In step S 304 , the client communication means  216  transmits the biological data created by the biological data creating means  204  to the server communication means  316 . The processing moves to step S 305 . 
         [0140]    In step S 305 , the one-to-N comparing means  304  compares the biological data received by the server communication means  316  and multiple pieces of reference biological data already registered with the reference biological data storing means  302  and calculates the degree of agreement. The processing moves to step S 306 . 
         [0141]    In step S 306 , the one-to-N comparison result determining means  308  determines whether any reference biological data is beyond a threshold value defined by the user or not as a result of the comparison in step S 305 . If so, the processing moves to step S 307 . If not on the other hand, the processing moves to step S 308 . 
         [0142]    In step S 307 , the one-to-N comparison result determining means  308  determines whether multiple pieces of reference biological data have the degree of agreement beyond the threshold value defined by the user or not. If so, the processing moves to step S 310 . If only one reference biological data is beyond the threshold value, the processing moves to step S 309  where the one-to-N comparison result determining means  308  determines the authentication success. Then, the fact of the authentication success is transmitted from the server communication means  316  to the client communication means  216 . 
         [0143]    In step S 310 , the one-to-N comparison result determining means  308  stores the multiple pieces of reference biological data having the degrees of agreement beyond the threshold value defined by the user in the personal identity candidate data storing means  310  as the reference biological data of the identity of the user. The processing moves to step S 311 . 
         [0144]    In step S 311 , the group information requesting means  318  requests group information from the server communication means  316  to the client  0 . The processing moves to step S 308 . 
         [0145]    In step S 308 , the one-to-N comparison result determining means  308  determines the authentication failure and transmits the fact of the authentication failure from the server communication means. 316  to the client communication means  216 . The processing moves to step S 312 . 
         [0146]    In step S 312 , the one-to-N comparison result receiving means  218  determines whether the result transmitted from the server communication means  316  to the client communication means  216  is the authentication success or not. If so, the processing moves to step S 313 . If not on the other hand, the processing moves to step S 314 . 
         [0147]    In step S 314 , the one-to-N comparison result receiving means  218  determines whether group information has been requested from the server  100  or not. If so, the processing moves to step S 315 . If not on the other hand, the processing moves to step S 319 . 
         [0148]    In step S 315 , the one-to-N comparison result receiving means  218  obtains group information from the group information storing means  224 . The processing moves to step S 316 . 
         [0149]    In step S 316 , the one-to-N comparison result receiving means  218  transmits group information from the client communication means  216  to the server communication means  316 . The processing moves to step S 317 . 
         [0150]    In step S 317 , the group information comparison means  322  compares the group information transmitted from the client communication means  216  and the group information of the reference biological data stored in the personal identity candidate data storing means  310  and determines whether any group information agrees. If so, the processing moves to step S 318  whether the authentication success is determined. Then, the group information comparison means  322  transmits the fact of the authentication success from the server communication means  316  to the client communication means  216 , and the processing moves to step S 313 . If not on the other hand, the processing moves to step S 319  where the authentication failure is determined. Then, the group information comparing means  322  transmits the fact of the authentication failure from the server communication means  316  to the client communication means  216 , and the processing moves to step S 320 . Thus, even if multiple pieces of reference biological data are similar to the input user&#39;s biological data as a result of the comparison by the one-to-N comparing means  304 , the biological authentication can be performed based on the pre-stored group information, which does not inconvenience users. 
         [0151]    In step S 313 , the one-to-N comparison result notifying means  220  displays the fact of the authentication success on the display section  6  of the client  0  if the one-to-N comparison result receiving means  218  recognizes that the fact of the authentication success has been received from the client communication means  216 . The processing ends. 
         [0152]    In step S 320 , the one-to-N comparison result notifying means  220  displays the fact of the authentication failure on the display  6  of the client  0  if the one-to-N comparison result receiving means  218  recognizes that the fact of the authentication failure has been received from the client communication means  216 . The processing ends. 
         [0153]    The embodiments above describe the present invention more specifically for better understanding and do not limit the form. Therefore, any changes are possible without departing from the spirit and scope of the present invention. For example, in Example 2 , if multiple pieces of reference biological data-exist as a result of one-to-N comparison and the identity of a user is not identifiable even by using group information, a construction is possible in which the fact that the user belongs to the group may be transmitted to a client and a specific right may be only given to the user, without the determination of the authentication failure. Having described as a client-server system in Example 2 , a stand-alone system having a client only may be adopted, for example. Alternatively, in Examples 1 and 2, the client communication means  216  and server communication means  316  may be configured to encode specific data and transmit the encoded data over a network.