KR102308859B1 - Surrogate authentication service system and method based on biometric information - Google Patents

Abstract

The present invention relates to a surrogate authentication service system based on biometric information and a method thereof and, more specifically, to a surrogate authentication service system based on biometric information and a method thereof for storing and managing biometric information necessary for authentication to prevent tampering of the biometric information and replacing an authentication target terminal without a biometrics means with a surrogate terminal capable of biometrics to perform surrogate authentication for a user of the authentication target terminal by using acoustic telecommunication and biometric information, thereby increasing authentication convenience and security for the user of the authentication target terminal.

Description

Surrogate authentication service system and method based on biometric information}

The present invention relates to a biometric information-based proxy authentication service system and method, and more particularly, by storing and managing biometric information required for authentication in a block chain, preventing forgery and falsification of biometric information and replacing the authentication target terminal without biometric identification means A biometric device that enables a proxy terminal capable of biometric recognition to perform authentication for the user of the authentication target terminal by using sound wave communication and biometric information to increase the authentication convenience and security for the user of the authentication target terminal It relates to an information-based proxy authentication service system and method.

Currently, the security service technology using the user's biometric information is widely used not only in a large-scale system such as an access control system, but also in a small-scale terminal such as a user's mobile terminal.

Biometric means for security, such as fingerprints and iris used for biometric information, are difficult to forge and have high security reliability, so they are highly preferred as a means for user authentication. There is a problem in that authentication using biometric means is limited.

In addition, biometric means for security, such as fingerprints and iris used for biometric information, are difficult to forge and have high security reliability. Since the information must be stored in the device that authenticates the user, access to such biometric information may cause forgery or stealing of the biometric information itself. .

Accordingly, there is a need for a method for increasing security in managing biometric information while supporting authentication using biometric information even in a terminal without biometric recognition means.

Korean Patent No. 10-1960801

The present invention prevents forgery and falsification by registering biometric information for authentication in a block chain, and supports to receive service authentication through another terminal equipped with a biometric means in a specific terminal not equipped with a biometric means. An object of the present invention is to provide support for enhancing security by using an authentication method as biometric information while ensuring the authentication convenience of a user using a terminal.

In addition, an object of the present invention is to greatly increase the convenience of managing biometric information according to security threats by allowing a part of biometric information to be deleted when necessary while increasing security during authentication using biometric information.

In the biometric information-based proxy authentication service method according to an embodiment of the present invention, a biometric authentication server interworking with a service server providing a service to a first terminal stores the user's biometric registration information corresponding to the first terminal as first information and second information, matching the first information with user identification information, and storing it in the DB of the biometric authentication server, and a registration hash that is a hash value of the user identification information, the second information, and the biometric registration information. A registration step of generating the included user registration information and transmitting it to the blockchain system composed of a plurality of nodes and storing it in the blockchain system, and the user extracted from the login information when the service server receives the login information from the first terminal an authentication request step of generating authentication request information including identification information and transmitting it to the biometric authentication server; and issuing a token corresponding to the user identification information when the biometric authentication server receives the authentication request information through the service server A token issuance step of transmitting to the first terminal, and the biometric authentication server from the second terminal equipped with a biometric means for obtaining the token and user identification information through sound wave communication between the first terminal and the second terminal Upon receiving authentication information including the token and user identification information and the user's biometric information generated through the biometrics means, first information is extracted from the DB based on the user identification information of the authentication information, and the second information and A verification step of extracting a registration hash from the block chain system, generating the biometric registration information combining the first information and the second information, and verifying the biometric registration information based on the registration hash; Authentication of the authentication information according to whether the token issued corresponding to the user identification information and the token of the authentication information coincide with each other and whether the biometric information of the authentication information matches the biometric registration information Determination of success and certification of the judgment result and a determination step of transmitting the information to the service server, and an authentication step of providing a service to the first terminal corresponding to the login information when the service server succeeds in authentication based on the authentication result information.

As an example related to the present invention, the biometric information may include at least one of fingerprint information, face recognition information, and iris information.

As an example related to the present invention, in the determining step, the biometric authentication server, the biometric authentication information included in the authentication information while matching the token issued in response to the user identification information included in the authentication information and the token of the authentication information When the information and the biometric registration information match each other, the authentication information is judged as authentication success, otherwise it is judged as authentication failure, and authentication result information for the judgment result is transmitted to the service server. have.

As an example related to the present invention, in the biometric information-based proxy authentication service method, after the token issuance step, a first application unit configured in the first terminal and transmitting login information to the service server corresponds to the login information Generating a sound wave signal corresponding to the received token and the user identification information and transmitting it to the second terminal through a first sound wave interface unit configured in the first terminal, and a second application unit of the second terminal, the second terminal Generates the token and user identification information from the sound wave signal received from the first terminal through the second sound wave interface unit configured in The method may further include generating authentication information including the biometric information, the token, and user identification information and transmitting the generated authentication information to the biometric authentication server.

As an example related to the present invention, the first sound wave interface unit and the second sound wave interface unit may include a microphone and a speaker.

As an example related to the present invention, the biometric authentication server may be configured as a node of the block chain and transmit the user registration information to all nodes participating in the block chain system.

A biometric information-based proxy authentication service system according to an embodiment of the present invention includes a service server for transmitting authentication request information including user identification information included in the login information to a biometric authentication server when receiving login information from a first terminal; The biometric registration information of the user corresponding to the first terminal is divided into first information and second information, the first information is matched with user identification information and stored in the DB of the biometric authentication server, and the user identification information and After generating user registration information including a registration hash that is a hash value of the second information and the biometric registration information, it is transmitted to a blockchain system composed of a plurality of nodes and stored in the blockchain system, and when the authentication request information is received and a biometric authentication server that issues a token corresponding to the user identification information and transmits the token to the first terminal through the service server, wherein the biometric authentication server is configured to perform sound wave communication between the first terminal and the second terminal. When receiving authentication information including the token, user identification information, and biometric information from the second terminal equipped with a biometric means for obtaining a token and user identification information, the first information is generated based on the user identification information included in the authentication information After extracting from the DB, extracting the second information and the registration hash from the block chain system, generating the biometric registration information combining the first information and the second information, verifying based on the registration hash, Upon successful authentication of the biometric registration information, whether the token issued corresponding to the user identification information included in the authentication information and the token of the authentication information match each other, and the biometric information of the authentication information matches the biometric registration information It is determined whether or not the authentication is successful for the authentication information according to whether the service server It may be characterized in that it is transmitted to

As an example related to the present invention, the biometric information-based proxy authentication service system is configured in the first terminal, generates the login information and transmits it to the service server, and when the token is received, the token and the user identification information A first application unit that generates a sound wave signal corresponding to and transmits it to the second terminal through a first sound wave interface unit configured in the first terminal, and a second sound wave interface configured in the second terminal and configured in the second terminal The token and user identification information are generated from the sound wave signal received through a unit, and when the sound wave signal is received, biometric information is generated through the biometric recognition means configured in the second terminal, and then the token, user identification information, and biometric information are It may further include a second application unit that generates the included authentication information and transmits it to the biometric authentication server.

As an example related to the present invention, when an event requiring authentication of the user identification information of the first terminal occurs after login, the service server requests the biometric authentication server to issue a new token for the user identification information in response to the event and transmits the new token received in response to the event to a first application unit of the first terminal, and the first application unit generates a sound wave signal corresponding to the new token and user identification information upon receiving the new token to transmit to the second terminal through the first sound wave interface unit, and the second application unit generates new authentication information including the new token when receiving the sound wave signal received through the second sound wave interface unit, the biometric authentication server and, the biometric authentication server generates authentication result information corresponding to the new authentication information and transmits it to the service server so that the service server determines whether to authenticate the first terminal corresponding to the event. can be done with

The present invention supports a specific terminal not equipped with a biometric means to receive service authentication through another terminal equipped with a biometric means to ensure authentication convenience of a user using the specific terminal, and does not include a biometric means By allowing biometric information to be used as an authentication means in a specific terminal that is not yet available, the security for authentication of a specific terminal can be increased by using the biometric information as an authentication means, as well as for verification of biometric information transmitted for an authentication request. After arbitrarily dividing the pre-registered user's biometric registration information into a plurality of different first and second information, the first information is stored in the biometric authentication server and the second information is stored in the block chain system. It has the effect of increasing the reliability and stability in the authentication process using biometric information while increasing the management security of the previously registered biometric information by dividing and storing it.

1 is a configuration diagram of a biometric information-based proxy authentication service system according to an embodiment of the present invention.
2 and 3 are diagrams illustrating the operation of a biometric information-based proxy authentication service system according to an embodiment of the present invention.
4 is a flowchart of a biometric information-based proxy authentication service method according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

1 is a configuration diagram of a biometric information-based proxy authentication service system according to an embodiment of the present invention. As shown, a biometric authentication server communicating with a first terminal 100 and a second terminal 200 through a communication network 400 and the service server 300 may be included.

In addition, the service server 300 and the biometric authentication server 400 may interact with each other while communicating through a communication network. In this case, it goes without saying that the service server 300 and the biometric authentication server 400 may be configured as one integrated server.

In addition, the communication network described in the present invention may include a wired/wireless communication network, and as an example of such a wireless communication network, a wireless LAN (WLAN), a DLNA (Digital Living Network Alliance), a Wibro (Wireless Broadband: Wibro), Wimax (World Interoperability for Microwave Access: Wimax), GSM (Global System for Mobile communication), CDMA (Code Division Multi Access), CDMA2000 (Code Division Multi Access 2000), EV-DO (Enhanced Voice-Data Optimized or Enhanced Voice- Data Only), Wideband CDMA (WCDMA), High Speed Downlink Packet Access (HSDPA), High Speed Uplink Packet Access (HSUPA), IEEE 802.16, Long Term Evolution (LTE), Long Term Evolution-A (LTE-A) Advanced), Wireless Mobile Broadband Service (WMBS), 5G mobile communication service, Bluetooth (Bluetooth), LoRa (Long Range), RFID (Radio Frequency Identification), Infrared Data Association (IrDA), Ultra Wideband (UWB), ZigBee, Near Field Communication (NFC), Ultra Sound Communication (USC), Visible Light Communication (VLC), Wi-Fi, Wi-Fi Direct may be included. In addition, wired communication networks include wired LAN (Local Area Network), wired WAN (Wide Area Network), Power Line Communication (PLC), USB communication, Ethernet, serial communication, optical/coaxial cables, etc. may be included.

In addition, the first terminal 100 and the second terminal 200 may each be configured as a user terminal, the user terminal, a smart phone (Smart Phone) having a communication function, a portable terminal (Portable Terminal), Mobile Terminal, Personal Digital Assistant (PDA), PMP (Portable Multimedia Player) Terminal, Telematics Terminal, Navigation Terminal, Personal Computer, Notebook Computer, Slate PC (Slate PC), tablet PC (Tablet PC), ultrabook (ultrabook), wearable device (Wearable Device, for example, watch-type terminal (Smartwatch), glass-type terminal (Smart Glass), HMD (Head Mounted Display), etc. including), Wibro terminal, IPTV (Internet Protocol Television) terminal, smart TV, digital broadcasting terminal, AVN (Audio Video Navigation) terminal, A/V (Audio/Video) system, flexible terminal, etc. It may include various terminals.

In addition, the user terminal includes a communication unit for communication with a server and an external device including other terminals, a display unit for displaying various information, a storage unit for storing various data, a user input unit for receiving user input, and overall control of the user terminal It may be configured to include various components such as a control unit that performs a function, and at least one component configured in the user terminal may be configured to be included in another component.

In this case, the control unit executes the overall control function of the terminal by using the program and data stored in the storage unit configured in the user terminal. The controller may include RAM, ROM, CPU, GPU, and a bus, and the RAM, ROM, CPU, GPU, etc. may be connected to each other through a bus.

In addition, the control unit of the user terminal may be stored in advance in the storage unit of the user terminal and may operate as an application unit by executing an application for communication with the service server 300 .

In addition, the biometric authentication server 400 can communicate with the blockchain system 500 consisting of a plurality of nodes operating on a blockchain basis through a communication network, and the biometric authentication server 400 is the blockchain It may be configured as any one node among a plurality of nodes constituting the system 500 .

At this time, the blockchain described in the present invention consists of a plurality of transaction information in blocks, and connects several blocks like a chain using a hash, thereby distributing a peer-to-peer (P2P) network. It is an algorithm that manages security information jointly by distributing and storing information in the digital equipment of nodes that are participants (peers) rather than the central management server in the environment. By using such a block chain, it is impossible to forge and falsify data, so reliable and secure transactions and data processing can be performed even without an authoritative intermediary.

In addition, each of the plurality of nodes may be configured as a terminal or device, and a shared ledger for storing the block may be stored by a plurality of nodes (per terminal) constituting (participating) the blockchain system 500 . have.

Based on the above-described configuration, the present invention registers biometric information for authentication in the block chain to prevent forgery and falsification, and is provided with a biometric means in place of the first terminal 100 without a biometric means based on biometric information In this way, it is possible to provide a system that can support the second terminal 200 to perform authentication on behalf of the first terminal 100 on behalf of the first terminal 100. By allowing authentication using information to be used, authentication convenience for users can be increased, and security for user authentication can be improved by supporting authentication using biometric information for users of the first terminal 100 without biometric recognition means. However, this will be described in detail with reference to the drawings below.

2 and 3 are detailed operational configuration diagrams of a biometric information-based proxy authentication service system according to an embodiment of the present invention.

As shown in FIG. 2 , the first terminal 100 without (not provided) a biometric means capable of generating biometric information may be configured including a component of the user terminal, and In addition to the configuration, a first sound wave interface unit for sound wave communication may be configured in the first terminal 100 .

In addition, the first terminal 100 includes a first control unit operating as the control unit, and the first control unit executes an application stored in the storage unit of the first terminal 100 to perform the first application unit 110 . can operate as

Also, when operating as the first application unit 110 , the first application unit 110 may include a service use unit 111 and an authentication request module 112 .

In this case, the service use unit 111 and the authentication request module 112 may mean a software function (function) supported by the application.

In addition, the first application unit 110 may be a component including a service using unit 111 and an authentication request module 112 composed of hardware, and the service using unit 111 and an authentication request module. 112 may store the application-related data to execute the application-related function or load the application from the storage unit of the first terminal 100 to execute the application-related function.

The service use unit 111 may access the service server 300 , and when accessing the service server 300 , may transmit log-in information to the service server 300 .

In this case, the login information may include a user ID and password corresponding to the user of the first terminal 100 .

In addition, the service use unit 111 may include the user identification information, which is the preset identifier of the first terminal 100 , in the login information and transmit it to the service server 300 .

Here, the user identification information may be identification information of the first terminal 100 or identification information corresponding to the user of the first terminal 100 . In addition, the user identification information may include a mobile directory number (MDN), mobile IP, mobile MAC, subscriber identity module (Sim) card unique information, serial number, user ID, user contact information, and the like.

In addition, the service server 300 may transmit web page information to the service using unit 111 when the service using unit 111 configured in the first terminal 100 is connected, and the first The service use unit 111 of the application unit 110 may display a web page according to the web page information, generate login information through the web page, and transmit it to the service server 300 .

In addition, the authentication request module 112 constituting the first application unit 110 corresponds to the login information and transmits the user authentication (or the first terminal () of the first terminal 100 by the service server 300). 100) for authentication), and upon receiving the token, generate a sound wave signal corresponding to the token and the user identification information for sound wave communication based on the token and preset user identification information can do.

In addition, the authentication request module 112 may transmit the sound wave signal to the second terminal 200 through a first sound wave interface unit for sound wave communication configured in the first terminal 100 .

At this time, the authentication request module 112 may generate a sound wave signal by inserting a code corresponding to the token and the user identification information into an audible sound frequency or an inaudible sound frequency, and includes a first The sound wave signal may be transmitted to the second terminal 200 through the sound wave interface unit.

In addition, the first sound wave interface unit may include a microphone (mic) and a speaker.

On the other hand, the second terminal 200 may be provided with a biometric means capable of generating biometric information, unlike the first terminal 100 , and, like the first terminal 100 , includes a component of the user terminal. In addition to the configuration of the user terminal, a second sound wave interface unit for sound wave communication may be configured in the second terminal 200 .

In addition, a second control unit operating as the control unit of the second terminal 200 is configured, and the second control unit executes an application stored in the storage unit of the second terminal 200 to perform the second application unit 210 . can operate as

In this case, the application executed in the second terminal 200 may be the same application as the application executed in the first terminal 100 .

Also, when operating as the second application unit 210 , the second application unit 210 may include a biometric information collection unit 212 and an authentication module 211 .

In this case, the biometric information collection unit 212 and the authentication module 211 may mean software functions (functions) supported by the application.

In addition, the second application unit 210 may be a component including a biometric information collecting unit 212 and an authentication module 211 composed of hardware, and the biometric information collecting unit 212 and the authentication module. The 211 may store the application-related data to execute a function related to the application or load the application from the storage unit of the second terminal 200 to execute the function related to the application.

Also, the second application unit 210 may receive the sound wave signal transmitted from the first terminal 100 through a second sound wave interface unit including a microphone configured in the second terminal 200 . .

In this case, the second sound wave interface unit may include a speaker and a microphone.

In the above configuration, the first application unit 110 of the first terminal 100 generates a sound wave signal in which an application identifier for execution of the application is inserted in addition to the token and the user identification information in the sound wave signal. It can be transmitted to the second terminal 200 .

Accordingly, when receiving the sound wave signal, the second control unit of the second terminal 200 analyzes the sound wave signal to obtain the application identifier from the sound wave signal, and the second terminal 200 corresponding to the application identifier ) may be activated as the second application unit 210 by executing an application stored in the storage unit.

In addition, the second application unit 210 may obtain the token and user identification information by analyzing the sound wave signal. At this time, the second control unit acquires the token and user identification information together with the application identifier, and then passes it to the application after the execution of the application so that the second application unit 210 obtains the token and user identification information. It might work.

In addition, the authentication module 211 of the second application may receive the sound wave signal through the second sound wave interface unit to obtain the token and user identification information.

Also, the authentication module 211 may activate the biometric information collection unit 212 of the second application unit 210 when the token and user identification information are obtained.

In addition, the biometric information collection unit 212 may activate the biometric means configured in the second terminal 200 upon activation, and collect biometric information through the biometric means or cooperate with the biometric means to obtain the biometric information. Biometric information can be generated.

For example, the biometric information collection unit 212 is configured in the second terminal 200 and includes a camera unit, a fingerprint recognizer for recognizing a fingerprint, an iris recognizer for recognizing an iris, and the like (or biometric recognition unit). ), biometric information including various user biometric information such as iris information, fingerprint information, and face recognition information corresponding to the user of the first terminal 100 may be generated.

In addition, the invention will be described below on the assumption that the biometric information collection unit 212 generates biometric information including any one of the iris information, fingerprint information, and face recognition information. It goes without saying that various types of bio-related information such as information and facial recognition information may be included.

In addition, the authentication module 211 may receive biometric information in response to the sound wave signal from the biometric information collection unit 212, and generate authentication information including the token, the user identification information, and the biometric information. may be transmitted to the biometric authentication server 400 .

Meanwhile, the biometric authentication server 400 may include an authentication unit 410 , a token issuing unit 420 , and a member DB 430 .

In this case, the biometric authentication server 400 may be configured to include a second server control unit including the authentication unit 410 and the token issuing unit 420 , and the second server control unit may include the biometric authentication server ( 400), the second server control unit may include RAM, ROM, CPU, GPU, and a bus, and the RAM, ROM, CPU, GPU, etc. may be connected to each other through a bus.

In addition, the biometric authentication server 400 includes a second communication unit for communicating with the first terminal 100 , the second terminal 200 , and the service server 300 , a second storage unit for storing various information, and an external device. It may be configured to include various components such as a second interface unit for receiving an input, and components configured in the biometric authentication server 400 may be controlled through the second server control unit.

The operation of the biometric authentication server 400, which will be described below, may be performed by the second server controller.

As shown in FIG. 3 , the authentication unit 410 may receive registration application information including user identification information and biometric information for the user of the first terminal 100 .

In this case, the biometric information may be composed of standard biometric data generated by recognizing a user's biometric through a device equipped with a biometric recognition means.

In addition, the authentication unit 410 may receive the registration application information from various devices used by the user other than the first terminal 100 , and for example, the user from the second terminal 200 equipped with a biometric recognition means. may receive registration application information of

In addition, when the authentication unit 410 receives authentication request information including user identification information from the service server 300 to which the first terminal 100 is connected, based on the user identification information included in the authentication request information, the Member information can be searched in the member DB 430, and as a result of the search, member information corresponding to the user identification information does not exist in the member DB 430, so that the user of the first terminal 100 is not registered as a member. In this case, it is possible to transmit the confirmation result information to the service server 300 .

Also, the authentication unit 410 may receive the registration application information from the service server 300 in response to the confirmation result information.

For example, the second application unit 210 of the second terminal 200 provided with the biometric recognition means connects to the service server 300 and then registers for a member registration application provided by the service server 300 . Based on the interface, registration application information including user identification information corresponding to the user of the first terminal 100 and the user's biometric information may be generated and transmitted to the service server 300, and the biometric authentication server 400 The authentication unit 410 of the may receive the registration application information from the service server 300 .

In addition, when the registration application information is received, the authentication unit 410 may generate biometric registration information for registering the corresponding biometric information based on the user's biometric information included in the registration application information, The first information and the second information may be generated by arbitrarily dividing the biometric registration information according to a preset division algorithm.

In this case, the biometric registration information may be the same as the user's biometric information.

Also, the authenticator 410 may generate a registration hash that is a hash value for the biometric registration information by applying the biometric registration information to a preset hash algorithm.

In addition, the authentication unit 410 matches the first information with the user identification information included in the registration application information to generate member information corresponding to the user including the first information and the user identification information. It can be stored in the member DB (430).

In this case, the authentication unit 410 may encrypt the first information based on a preset algorithm, and after generating member information including the encrypted first information and user identification information, it is stored in the member DB 430 . You can also save it.

In addition, the authenticator 410 may extract user identification information from the registration application information and apply the biometric registration information to a preset hash algorithm to generate a registration hash that is a hash value for the entire biometric registration information. .

In addition, the authentication unit 410 may communicate with the block chain system 500 that communicates with the biometric authentication server 400 through a communication network, and the authentication unit 410 includes the user identification information and the second information and After generating the user registration information including the registration hash, the user registration information may be transmitted to the block chain system 500 so that the user registration information is stored in the block chain system 500 .

For example, the authentication unit 410 may transmit the user registration information for each node constituting the block chain system 500 so that the user registration information is stored in each node.

Accordingly, among the nodes constituting the block chain system 500, during the generation period of the specific block to which the user registration information is to be included, a specific node having the right to generate the specific block includes the user registration information as transaction information. A specific block can be generated, and the specific block can be transmitted for each node constituting the block chain system 500, and each node constituting the block chain system 500 is configured according to a well-known preset block chain algorithm. Blocks can be linked and stored like a chain based on previous blocks and block hashes.

In this case, each node constituting the block chain system 500 may store the specific block in its shared ledger.

Through this, the user registration information may be distributed and stored for each node constituting the block chain system 500 .

On the other hand, the authentication unit 410, as described above, after the user's membership registration based on the registration application information including the biometric registration information matching the biometric information is completed, the login information of the first terminal 100 may receive authentication request information including user identification information included in the login information from the service server 300 that has received can

The token issuing unit 420 may issue (issuance) a token in response to the authentication request information, and the token may be a one-time token with a set validity period.

In addition, the authentication unit 410 or the token issuing unit 420 may transmit a token issued in response to the authentication request information to the service server 300, and when issuing the token, the token is issued until an authentication determination is made. The user identification information is matched and temporarily stored, and reception of authentication information corresponding to the token may be queued.

Also, when the validity period of the token expires, the token issuing unit 420 may delete the expired token.

Accordingly, when the authentication information is received from the second terminal 200 , the authentication unit 410 interworks with the token issuing unit 420 to identify a pre-stored token corresponding to the user identification information included in the authentication information. and compare the token included in the authentication information with a token issued for the user identification information and stored in advance in the biometric authentication server 400 (token identified corresponding to the user identification information) to determine whether it matches have.

Also, the authenticator 410 may restore biometric registration information required to verify biometric information included in the authentication information received from the second terminal 200 .

To this end, the authentication unit 410 identifies the member information of the user corresponding to the authentication information based on the user identification information included in the authentication information in the member DB 430, and from the identified member information The first information may be extracted.

In this case, when the first information included in the member information is in an encrypted state, the authenticator 410 may decrypt the encrypted first information according to a preset algorithm.

In addition, the authentication unit 410 communicates with a specific node of any one of the nodes constituting the block chain system 500 based on the user identification information included in the authentication information to register a user including the user identification information. Information may be retrieved, and user registration information corresponding to the user identification information may be received from the specific node.

When the specific node receives the user identification information, the user registration information including the user identification information can be retrieved by searching the shared ledger where the block is stored, and the user registration information retrieved corresponding to the user identification information is extracted and the It can be transmitted to the authenticator 410 .

In this case, when the biometric authentication server 400 configured by the authentication unit 410 is any one of the nodes constituting the block chain system 500 , the authentication unit 410 is the shared ledger of the biometric authentication server 400 . may be retrieved based on the user identification information included in the authentication information, and user registration information corresponding to the user identification information may be extracted from the shared ledger stored in the biometric authentication server 400 .

In addition, when the biometric authentication server 400 configured with the authentication unit 410 is a node of the block chain system 500 , the shared ledger is stored in the member DB 430 or created separately from the member DB 430 . 2 can be stored in the storage unit.

In the above configuration, the authentication unit 410 configured in the biometric authentication server 400 configured as the specific node or a node of the block chain system generates a transaction for retrieval of the user registration information and creates a new transaction including the transaction. A block can be created, the new block can be stored in the shared ledger, and the new block can be transmitted to each node constituting the block chain system so that the transaction is shared and distributed through the block chain. .

Through this, the specific node or the authentication unit 410 creates and stores an access record for the user registration information when searching for the user registration information, so that when forgery or falsification occurs in the data stored in the block chain, it can be tracked. can

Also, the authentication unit 410 may extract the second information and the registration hash from the user registration information obtained (received) from the block chain system 500 in correspondence to the authentication information.

In addition, the authenticator 410 generates biometric registration information for verification by combining the first information and the second information obtained in response to the authentication information, and applies the biometric registration information for verification to a preset hash algorithm. can compare the registered hash with the first hash value obtained by By determining that it is, it can be authenticated (determined) as the biometric registration information of a normal user for which forgery has not occurred.

In addition, when the verification biometric registration information is authenticated, the authenticator 410 may compare the biometric information included in the authentication information with the verification biometric registration information, and the biometric information included in the authentication information and the verification It is possible to determine whether the biometric registration information for each other matches each other.

In addition, the authentication unit 410, while the token issued corresponding to the user identification information included in the authentication information and the token of the authentication information match, the biometric information included in the authentication information and the biometric registration information for verification In the case of mutual agreement, the authentication information may be determined as authentication success, otherwise, it may be determined as authentication failure, and authentication result information for the determination result may be transmitted to the service server 300 .

In this case, the authentication unit 410 may include the user identification information included in the authentication information in the authentication result information to enable identification of an authentication target corresponding to the authentication result information and transmit it to the service server 300 . .

In addition, the token issued corresponding to the user identification information handled by the authentication unit 410 is a member DB 430 of the biometric authentication server 400 or a separate storage unit of the biometric authentication server 400 (eg, a separate storage unit of the biometric authentication server 400 ). , a token stored in the second storage unit).

For example, the authentication unit 410 may be configured to match the biometric information included in the authentication information and the verification biometric information in a state in which a token issued corresponding to the user identification information included in the authentication information and a token of the authentication information coincide with each other. When the registration information is identical to each other, authentication result information on successful user authentication may be generated corresponding to the authentication information and the authentication request information and transmitted to the service server 300 .

In addition, the authentication unit 410 registers the biometric information included in the authentication information and the verification biometric information in a state in which the token issued corresponding to the user identification information included in the authentication information and the token of the authentication information coincide with each other. When the information does not match with each other, authentication result information on user authentication failure may be generated corresponding to the authentication information and the authentication request information and transmitted to the service server 300 .

In addition, the authentication unit 410 compares the biometric information included in the authentication information with the biometric registration information for verification when the token issued corresponding to the user identification information included in the authentication information and the token of the authentication information do not match each other In response to the authentication information and the authentication request information, authentication result information on authentication failure may be generated and transmitted to the service server 300 .

Accordingly, the service server 300 provides a service by transmitting service data requiring user authentication to the first terminal 100 only when the user authentication of the first terminal 100 is successful based on the authentication result information. can do.

On the other hand, in the above configuration, the authentication unit 410, when the first hash value obtained from the verification biometric information and the registration hash do not match each other, the user's member information and block chain stored in the member DB 430 It is determined that forgery has occurred in at least one of the user registration information stored in the system 500 , and the member information stored in the member DB 430 may be deleted.

Alternatively, the authentication unit 410, in conjunction with the block chain system 500, when the hash value of the block in which the user registration information is stored in the block chain system 500 is changed, a block corresponding to the user registration information It is determined that forgery has occurred, and member information corresponding to user registration information in which forgery has occurred may be deleted from the member DB 430 .

Through this, the authentication unit 410 changes the user's biometric registration information used for user authentication so that the biometric registration information cannot be restored only by deleting the member information, so that an intruder entering the service server 300 is detected. It can be blocked, and through this, the management convenience and security of biometric information can be improved.

Meanwhile, the service server 300 may include a service providing unit 310 and an authentication requesting unit 320 .

In this case, the service server 300 may be configured to include a first server control unit including the service providing unit 310 and the authentication request unit 320 , and the first server control unit is the service server 300 . , and the first server control unit may include RAM, ROM, CPU, GPU, and a bus, and the RAM, ROM, CPU, GPU, etc. may be connected to each other through a bus.

In addition, the service server 300 includes a first communication unit for communicating with the first terminal 100 and the second terminal 200 and the biometric authentication server 400, a first storage unit for storing various information, and an external device. It may be configured to include various components such as a first interface unit for receiving an input, and components configured in the service server 300 may be controlled through the first server control unit.

The operation of the service server 300, which will be described below, may be performed by the first server control unit.

The service providing unit 310 provides information (eg, the web page information) necessary for logging in to the first terminal 100 when the first terminal 100 accesses the service server 300 to the first terminal ( 100 ), and when receiving login information from the first terminal 100 , user identification information included in the login information may be transmitted to the authentication request unit 320 .

In addition, the authentication request unit 320 generates authentication request information including the user identification information upon receiving the user identification information, and transmits the authentication request information to the biometric authentication server 400 to request token issuance. to be transmitted to the token issuing unit 420 , and a token issued in response to the authentication request information may be received from the biometric authentication server 400 .

Also, the authentication request unit 320 may transmit the token to the first terminal 100 upon receiving the token.

In addition, after transmitting the token to the first terminal 100 in conjunction with the authentication request unit 320, the service providing unit 310 may wait for reception of the authentication result information in response to the login information. In addition, when authentication result information is received from the biometric authentication server 400 , the authentication result information corresponding to the log-in information may be identified through the log-in information and user identification information included in the authentication result information.

In addition, when the authentication result according to the authentication result information based on the authentication result information is authentication success, the service providing unit 310 is configured to perform authentication for the user of the first terminal 100 or the first terminal 100 . It can be determined that it is successful, and when authentication is successful, service-related data can be transmitted to the first terminal 100 to provide the service provided by the service providing unit 310 to the first terminal 100 .

Through the above-described configuration, the present invention supports to receive service authentication from a specific terminal not equipped with a biometric means through another terminal equipped with a biometric means while ensuring the authentication convenience of the user using the specific terminal, By enabling biometric information to be used as an authentication method even in a specific terminal that is not equipped with a biometric means, it is possible to increase the security for authentication of a specific terminal by using the biometric information as an authentication means, as well as After arbitrarily dividing the biometric registration information of a pre-registered user for verification of biometric information into a plurality of different first and second information, the first information is stored in the biometric authentication server 400, and the second information is stored in a block chain system By dividing and storing the biometric registration information in the method of storing in 500, it is possible to increase the reliability and stability in the authentication process using the biometric information while increasing the management security of the previously registered biometric information.

In addition, through the method described in the present invention, instead of separately using a dongle that supports biometric recognition such as an expensive fingerprint/iris/face recognizer, an arbitrary terminal equipped with a biometric means, or a contract equipped with a biometric means is over It is a smartphone that supports biometric recognition such as a revoked smartphone and another person's smartphone equipped with biometric recognition means for user's biometric authentication, and supports biometric recognition such as fingerprint recognition/iris recognition/facial recognition It is possible to support the terminal to perform biometric information-based authentication.

On the other hand, in the above configuration, the token activation time (or token holding time) is minimized while supporting the authentication using the second terminal 200 equipped with the biometric means for the first terminal 100 smoothly. This can increase the security of the token, which will be described in detail.

First, the second control unit configured in the second terminal 200 executes an application stored in the storage unit of the second terminal 200 according to a user input and activates it as the second application unit 210 , and the second application The unit 210 may activate the second sound wave interface unit when activated.

At this time, the first control unit configured in the first terminal 100 also executes the application stored in the storage of the first terminal 100 according to a user input and activates it as the first application unit 110 , and the first application The unit 110 may activate the first sound wave interface unit when activated.

Also, the first application unit 110 of the first terminal 100 may generate a test signal when generating the login information and transmit it to the second terminal 200 through the first sound wave interface unit.

In addition, the second application unit 210 of the second terminal 200 generates a response signal when receiving the test signal through the second sound wave interface unit and transmits it to the first terminal 100 through the second sound wave interface unit. can

In addition, the first application unit 110 may transmit the login information to the service server 300 when the response signal is received through the first sound wave interface unit.

Based on the above configuration, the present invention provides an authentication process for the first terminal 100 between the first terminal 100 and the second terminal 200 before the token is transferred to the first terminal 100 . It is possible to activate sonic communication for security of the token in advance, and through this, the time required to activate sonic communication in the token delivery process is shortened and the token activation time is minimized by minimizing the token activation time to the token required for authentication of the first terminal 100 security can be improved.

On the other hand, in addition to the above-described configuration, the proxy authentication service according to the present invention to perform authentication of the first terminal 100 using biometric information generated by the second terminal 200 equipped with a biometric recognition means. Proxy authentication using biometric information of the second terminal 200 for the first terminal 100 of the system is provided by the service server 300 as well as the login to the service server 300 of the first terminal 100 It can also be applied while using the service, which will be described in detail.

First, when an event requiring authentication for user identification information of the first terminal 100 occurs after login, the service server 300 issues a new token for the user identification information in response to the event. ) and transmit the new token received in response to the event to the first application unit 110 of the first terminal 100 .

In addition, the first application unit 110 may generate a sound wave signal corresponding to the new token and user identification information upon receiving the new token and transmit it to the second terminal 200 through the first sound wave interface unit.

In addition, the second application unit 210 obtains the new token and user identification information from the sound wave signal when receiving the sound wave signal received through the second sound wave interface unit, and the new token and user identification information and the second Second, new authentication information including biometric information acquired through the biometric recognition means of the second terminal 200 may be generated and transmitted to the biometric authentication server 400 .

Also, the biometric authentication server 400 may generate authentication result information corresponding to the new authentication information and transmit it to the service server 300 in the same manner as in the process of generating authentication result information for the above-described authentication information.

In addition, when the service server 300 receives the authentication result information from the biometric authentication server 400 in response to the event, the user of the first terminal 100 responds to the event based on the authentication result information. determines whether to authenticate the event, and when the authentication of the user of the first terminal 100 for the event is successful, a service corresponding to the event is transmitted to the first terminal 100 or subsequent processing corresponding to the event and may transmit result information on the subsequent processing to the first terminal 100 .

In this case, the event is a payment-related event while using the service provided by the service server 300 , or a right through user identification of the first terminal 100 for content that requires the use right provided by the service server 300 . It may include various events such as authentication.

4 is biometric information according to an embodiment of the present invention for the second terminal 200 to perform proxy authentication for the first terminal 100 based on the biometric information on behalf of the first terminal 100 It is a flowchart of a proxy authentication service method of the based proxy authentication service system.

First, the first application unit 110 configured in the first terminal 100 accesses the service server 300 and sends login information including user identification information that is an identifier of the first terminal 100 to the service server 300 . ) can be transmitted to (S1).

Also, when receiving the login information, the service server 300 may generate authentication request information including user identification information included in the login information and transmit it to the biometric authentication server 400 ( S2 ).

In addition, the biometric authentication server 400 pre-registered with biometric information corresponding to the second terminal 200 issues a token corresponding to the user identification information upon receiving the authentication request information to the service server 300 . It can be transmitted (S3).

Also, the service server 300 may transmit the token to the first application unit 110 of the first terminal 100 (S4).

In addition, the first application unit 110 of the first terminal 100 generates a sound wave signal corresponding to the token and the user identification information through the first sound wave interface unit configured in the first terminal 100. It can be transmitted to the second terminal 200 (S5).

In addition, the second application unit 210 of the second terminal 200 generates the token and user identification information from the sound wave signal received through the second sound wave interface unit configured in the second terminal 200, and the sound wave Upon receiving a signal, biometric information is generated through the biometric means configured in the second terminal 200 (S6), and authentication information including the biometric information, the token, and user identification information is generated to generate the biometric authentication server 400 ) can be transmitted to (S7).

In addition, the biometric authentication server 400 is the second terminal 200 equipped with a biometric means for obtaining the token and user identification information through sound wave communication between the first terminal 100 and the second terminal 200 . When receiving authentication information including the token, user identification information, and biometric information corresponding to the user generated through the biometric recognition means from ), the first information is transferred to the member based on the user identification information included in the authentication information The biometric registration information (for verification) is extracted from the DB 430 (S8), the second information and the registration hash are extracted from the block chain system 500 (S9), and the first information and the second information are combined. biometric registration information), it can be verified based on the registration hash (S10).

Accordingly, the biometric authentication server 400 determines whether the token issued corresponding to the user identification information included in the authentication information and the token of the authentication information match each other, and whether the biometric information of the authentication information is the biometric registration information ( Biometric registration information for verification) may be determined to determine whether the authentication is performed (S11), and authentication result information for the determination result may be transmitted to the service server 300 (S12).

In addition, the service server 300 authenticates the first terminal 100 corresponding to the login information when the authentication is successful based on the authentication result information, approves the login of the first terminal 100, and Service data requested by the first terminal 100 may be transmitted to the first terminal 100 (S13).

The various devices and components described herein may be implemented by hardware circuitry (eg, CMOS-based logic circuitry), firmware, software, or a combination thereof. For example, it may be implemented using transistors, logic gates, and electronic circuits in the form of various electrical structures.

Those of ordinary skill in the art to which the present invention pertains may modify and modify the above-described contents without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical spirit of the present invention, but to explain, and the scope of the technical spirit of the present invention is not limited by these embodiments. The protection scope of the present invention should be construed by the following claims, and all technical ideas within the scope equivalent thereto should be construed as being included in the scope of the present invention.

100: first terminal 110: first application unit
111: service use unit 112: authentication request module
200: second terminal 210: second application unit
211: authentication module 212: biometric information collection unit
300: service server 310: service provider
320: authentication request unit 400: biometric authentication server
410: authentication unit 420: token issuing unit
430: member DB 500: blockchain system

Claims (9)

A biometric authentication server interworking with a service server providing a service to the first terminal divides the user's biometric registration information corresponding to the first terminal into first information and second information, and divides the first information into user identification information and A blockchain system composed of a plurality of nodes after matching and storing in the DB of the biometric authentication server, and generating user registration information including the user identification information, the second information, and a registration hash that is a hash value of the biometric registration information a registration step of transmitting to and storing in the block chain system;
an authentication request step of generating, by the service server, authentication request information including user identification information extracted from the log-in information when receiving log-in information from the first terminal, and transmitting it to the biometric authentication server;
a token issuing step of issuing, by the biometric authentication server, a token corresponding to the user identification information when receiving the authentication request information, and transmitting the token to the first terminal through the service server;
The biometric authentication server receives the token and user identification information and the biometric identification means from the second terminal equipped with a biometric means for obtaining the token and user identification information through sound wave communication between the first terminal and the second terminal. Upon receiving the authentication information including the biometric information of the user generated through a verification step of generating the biometric registration information by combining the first information and the second information and then verifying the biometric registration information based on the registration hash;
When the biometric authentication server succeeds in authenticating the biometric registration information, whether the token issued in response to the user identification information and the token of the authentication information match each other, and whether the biometric information of the authentication information matches the biometric registration information a determination step of determining whether or not authentication of the authentication information is successful according to whether or not and transmitting authentication result information on the determination result to the service server; and
an authentication step of providing, by the service server, a service to the first terminal corresponding to the login information when authentication is successful based on the authentication result information;
A biometric information-based proxy authentication service method comprising a.
The method according to claim 1,
Wherein the biometric information includes at least one of fingerprint information, face recognition information, and iris information.
The method according to claim 1,
The determination step is
The biometric authentication server,
When the token issued corresponding to the user identification information included in the authentication information matches the token of the authentication information, and the biometric information included in the authentication information and the biometric registration information match each other, the authentication information is successfully authenticated. The biometric information-based proxy authentication service method, characterized in that the determination and, otherwise, the authentication failure is determined, and authentication result information for the determination result is transmitted to the service server.
The method according to claim 1,
After the token issuance step,
The first application unit configured in the first terminal and transmitting the login information to the service server generates a token received corresponding to the login information and a sound wave signal corresponding to the user identification information, the first configured in the first terminal transmitting the sound wave interface to the second terminal; and
A second application unit of the second terminal generates the token and user identification information from the sound wave signal received from the first terminal through a second sound wave interface unit configured in the second terminal, and when the sound wave signal is received, the second generating biometric information through a biometric recognition means configured in a terminal, generating authentication information including the biometric information, the token, and user identification information, and transmitting the biometric information to the biometric authentication server;
Biometric information-based proxy authentication service method, characterized in that it further comprises.
5. The method according to claim 4,
The first sound wave interface unit and the second sound wave interface unit biometric information-based proxy authentication service method, characterized in that it comprises a microphone and a speaker.
The method according to claim 1,
The biometric authentication server is configured as a node of the block chain and transmits the user registration information to all nodes participating in the block chain system.
a service server for transmitting authentication request information including user identification information included in the login information to a biometric authentication server upon receiving login information from the first terminal; and
The biometric registration information of the user corresponding to the first terminal is divided into first information and second information, the first information is matched with user identification information and stored in the DB of the biometric authentication server, and the user identification information and After generating user registration information including a registration hash that is a hash value of the second information and the biometric registration information, it is transmitted to a blockchain system composed of a plurality of nodes and stored in the blockchain system, and when the authentication request information is received a biometric authentication server that issues a token corresponding to the user identification information and transmits it to the first terminal through the service server;
including,
The biometric authentication server includes the token, user identification information, and biometric information from the second terminal equipped with a biometric means for obtaining the token and user identification information through sound wave communication between the first terminal and the second terminal. Upon receiving authentication information, the first information is extracted from the DB based on the user identification information included in the authentication information, the second information and the registration hash are extracted from the block chain system, and the first information and the second information are combined. After generating the biometric registration information, it is verified based on the registration hash, and when authentication is successful for the biometric registration information according to the verification, a token issued corresponding to the user identification information included in the authentication information and the authentication information It is determined whether or not the authentication is successful for the authentication information according to whether the tokens match each other and whether the biometric information of the authentication information matches the biometric registration information, and the service server determines whether the authentication result is based on the determination result to transmit the authentication result information to the service server to determine whether to authenticate the first terminal with a biometric information-based proxy authentication service system.
8. The method of claim 7,
A first sound wave interface configured in the first terminal, generating the login information and transmitting it to the service server, and generating a sound wave signal corresponding to the token and the user identification information when receiving the token, and configured in the first terminal a first application unit for transmitting to the second terminal through a unit; and
Biometric recognition means configured in the second terminal, generating the token and user identification information from the sound wave signal received through a second sound wave interface unit configured in the second terminal, and configured in the second terminal when receiving the sound wave signal After generating biometric information through a second application unit that generates authentication information including the token, user identification information, and biometric information and transmits it to the biometric authentication server
Biometric information-based proxy authentication service system, characterized in that it further comprises.
9. The method of claim 8,
When an event that requires authentication of the user identification information of the first terminal occurs after the login, the service server requests the biometric authentication server to issue a new token for the user identification information in response to the event, and receives in response to the event transmits the new token to the first application unit of the first terminal,
The first application unit generates a sound wave signal corresponding to the new token and user identification information when receiving the new token and transmits it to the second terminal through the first sound wave interface unit,
The second application unit generates new authentication information including the new token when receiving the sound wave signal received through the second sound wave interface unit and transmits it to the biometric authentication server,
The biometric authentication server generates authentication result information corresponding to the new authentication information and transmits it to the service server so that the service server determines whether to authenticate the first terminal corresponding to the event. based proxy authentication service system.

Images