KR20060040155A - Fingerprint authentication based data security system and method - Google Patents

Abstract

The present invention relates to a technology that allows only authorized users to access data such as executable programs or files stored in computers in a multi-user connection environment based on fingerprint authentication.

To this end, the present invention comprises a first process for providing information on the data to be protected; A second step of registering information for fingerprint authentication and user authority authentication for the user when the user registration is requested by the administrator; A third process of performing fingerprint authentication and user authority authentication on the user when user access to specific data is detected; And a fourth process of allowing data access of the user only when both the fingerprint authentication and the user authority authentication succeed.

Description

System and method for securing data based on fingerprint authentication}

1 is a block diagram of a fingerprint authentication-based data security system according to an embodiment of the present invention.

2 is a detailed configuration diagram of the data security server 30 shown in FIG.

3 to 4 are flowcharts for explaining a fingerprint authentication-based data security method according to an embodiment of the present invention.

5 to 6 is a block diagram illustrating a fingerprint authentication based data security system according to an embodiment of the present invention.

The present invention relates to a data security system and method based on fingerprint authentication, and more specifically, based on fingerprint authentication, only a user who is authorized to access data such as an executable program or a file stored in a computer in a multi-user connection environment can access it. It's about technology that makes it possible.

As the value of information increases, the need for information protection is greatly demanded. In recent years, in order to efficiently manage information, it is common to process information by using a predetermined program activated through a computer, and then store the information in a file format and manage the information.

In the case of managing information in the above-described manner, it is convenient to use the information, but since the copying is easy due to the characteristics of digital data, data corresponding to important information is likely to be leaked by a malicious user. In view of this, a security method has been proposed to allow only authorized users to access data corresponding to sensitive information. The most common data security method uses a user ID and password to After authentication, only successful users can access specific data.

However, in the above method, since the data access is allowed to everyone who enters the ID and password for authentication, the user who obtained the ID and password in an improper way cannot restrict the data access, Even if a user forgets the ID and password, access to specific data is restricted, so there is a problem in that desired data cannot be used normally.

In this method, since the ID and password are dependent on the memory of the person, they cannot be authenticated if they are forgotten. They are authenticated only by the ID and password. Therefore, anyone who knows the ID and password can use it. With permission, it is impossible to prevent the leakage of secured data.

In order to solve the problems described above, an authentication method using a different method is required, and in response to the request, an authentication method using physical characteristics (eg, iris, fingerprint, blood vessel, etc.) can be used instead of relying on the user's memory. Research is actively underway.

In the case of fingerprints, the user's fingerprints remain unchanged and uniqueness is recognized because their identity with other people is very low, and the fingerprint is actively researched as an authentication technique for user verification.

On the other hand, if the fingerprint authentication for the user is successful by encrypting a specific file or folder stored in the computer using the fingerprint authentication method as described above, by decrypting the encrypted file or folder and providing it to the user, more securely manage the file or folder It is proposed how to.

However, in the above scheme, if the fingerprint authentication succeeds after the encryption process for a specific file and folder, a process of decrypting the file and folder is necessary. Therefore, the data processing time is relatively long. .

In addition, since it is provided only limited to the information stored in the computer (local storage) of the local environment, there is a disadvantage that you can not secure the program, files and data stored in the computer building the network environment. In particular, in an intranet environment corresponding to a network environment, resource management of an entire PC, user management of an entire PC, and protection of data and programs existing in an intranet should be collectively performed, but such a process cannot be performed in a conventional manner. In other words, there are no protection measures for accessing remote data through a network, executing a program, or using a program that inputs and checks important information through the network. Since no authority is given, it is difficult to efficiently manage the data to be protected.

In view of the above circumstances, an object of the present invention is to identify an identity of a user through a fingerprint when accessing executable programs and important data in a plurality of user-accessed computer environments, and access rights for specific programs and data are determined by the user. It ensures that only the authorized data can be accessed if it exists, so that important data stored on the computer is protected.

In addition, the present invention enables the user identification through fingerprint authentication and access control according to user's authority for all data and programs in the intranet through the construction of a client / server environment in addition to the protection purpose of the computer itself. It is another purpose to strengthen the security of the connection.

Fingerprint authentication-based data security system according to the present invention for achieving the above object, a plurality of PCs having a fingerprint input device; A data security server is connected to the PCs through a communication network to control user access to data stored in the PCs, and the data security server includes a fingerprint input device for user authentication.

Advantageously, said data security server comprises: first means for managing information of data mounted on said PCs; Second means for managing information on a user who allows access to data mounted on each of the PCs; Third means for managing access-specific user information for each data mounted on the PCs; And a fourth means for performing user authentication by using the second means and the third means when the user access of predetermined data is detected from the PCs.

According to an aspect of the present invention, there is provided a fingerprint authentication-based data security method, comprising: a first process including information on data to be protected; A second step of registering information for fingerprint authentication and user authority authentication for the user when the user registration is requested by the administrator; A third process of performing fingerprint authentication and user authority authentication on the user when user access to specific data is detected; And a fourth process of allowing data access of the user only when both the fingerprint authentication and the user authority authentication succeed.

In addition, a fingerprint authentication based data security system according to the present invention for achieving the above object, the data management means for monitoring the user access to the data stored in the PC; First means for managing information of data stored in the PC to be protected; Second means for managing user information allowing access to the data; Third means for managing access permission user information for each data; And a fourth means for performing user authentication by using the second means and the third means when the user access to the predetermined data is detected by the data management means.

Hereinafter, with reference to the accompanying drawings will be described an embodiment of the present invention in more detail.

1 is a network diagram of a fingerprint authentication based data security system according to an embodiment of the present invention.

As shown in FIG. 1, the PCs 10 and 20 and the data security server 30 are networked through the intranet 1, and the data security server 30 is stored in the PCs 10 and 20. Fingerprint authentication is performed on a user accessing an executable program, a file, and data, and it is determined whether the fingerprint authenticated user is registered for a specific executable program, a file, and data. Make programs, files, and data available. In addition, in the present invention, the data security server 30 preferably includes a GUI (Graphic User Interface) for registering a program accessible by each user.

In FIG. 1, for convenience of illustration, only two PCs 10 and 20 are connected to each other via the intranet 1, but the PCs can be connected to an acceptable number of intranets.

Each of the PCs 10 and 20 and the data security server 30 connected to the data security server 30 through the intranet 1 receives a fingerprint input device 12, 22, or 32 for receiving an image corresponding to the fingerprint from the user. Each).

2 is a detailed configuration diagram of the data security server 30 shown in FIG.

As shown in FIG. 2, the data security server 30 includes a GUI 300, a command analysis unit 302, a protection target setting unit 304, a protection target information storage unit 306, and a user authority setting unit 308. , User authorization information storage unit 310, user registration unit 312, user information storage unit 314, user authentication unit 316, log information storage unit 318, log result generation unit 320, network matching unit 322, and a fingerprint data processing unit 324.

The GUI 300 is a graphical user interface in which an operator inputs a predetermined command and displays a processing result of the input command on a screen in a form desired by the operator. Commands such as user registration, user authority setting, protection target setting, log checking, etc. may be input through the GUI 300, and the processing result of the command is displayed on the screen. When a predetermined command is input from the operator through the screen, the GUI 300 transmits a code value corresponding to the command to the command analyzer 302.

The command analyzer 302 analyzes the command input from the operator based on the code value transmitted from the GUI 300, and activates a related block to perform a process corresponding to the analyzed command. In addition, the command analysis unit 302 operates to perform authentication for the user in association with the user authentication unit 316, when authentication for a specific user is requested through the network matching unit 322.

The protection target setting unit 304 sets a file, an execution program, and data (hereinafter, referred to as a "protection target") to allow access to each registered user, and sets identification information on the protection target information. The storage unit 306 stores the result.

The user authority setting unit 308 registers a protection target to allow access to registered users, and stores it in the user authority information storage unit 310. The user authority information storage unit 310 is configured with an accessor list for each data to be protected, and the user ID for the access permission target is stored in the accessor list.

The user registration unit 312 stores the basic information, fingerprint information, user ID, and the like of the user who will use the protection target based on fingerprint authentication in the user information storage unit 314 to perform user registration.

If the user authentication unit 316 is requested to authenticate the user through the network matching unit 322, the protection target information storage unit 306, user authority information storage unit 314, user information storage unit 314, and log information In association with the storage unit 318 performs the authentication for the user, and transmits the result of the authentication to the PC requesting the authentication. The user authentication unit 316 stores the authentication result in the log information storage unit 318, when the GUI 300 checks the log result for a specific PC, the GUI of the authentication result of the user requesting access to the PC. Provided by 300.

The network matching unit 322 performs an interface function for communication with the PCs 10 and 20 connected through the intranet 1 and transmits the fingerprint authentication to the command analyzer 302 when a fingerprint authentication is requested from a specific PC. Then, the processing result of the command analyzer 302 is transmitted to the PC.

The data security server 30 configured as described above receives an administrator's fingerprint and ID information at an initial stage of operation, undergoes an administrator registration process, and then accesses a user to allow access through the PCs 10 and 20 on the network. Perform the registration process.

A user registration process applied to a fingerprint authentication based data security method according to an embodiment of the present invention will be described in detail with reference to the flowchart shown in FIG. 3.                     

When the user registration is requested from the GUI 300, the command analyzer 302 requests a fingerprint input through the GUI 300 and receives a fingerprint through the fingerprint input device 32. If the image input to the fingerprint input device 32 is above a certain level, the image is converted into fingerprint data through processing such as feature point extraction and the like, and is transmitted to the user authentication unit 316 through the command analyzer 302.

The user authentication unit 316 compares the fingerprint data transmitted from the command analyzer 302 with the fingerprint data stored in the user information storage unit 314 to determine whether the same fingerprint data exists, and then the same fingerprint data exists. Then, it is checked whether the user ID corresponding to the fingerprint data is an administrator account.

As a result of the check, if the fingerprint data is registered in the user information storage unit 314, and the user ID is confirmed as the administrator account, it is determined that the user registration requester is the administrator, and the administrator authentication success procedure is performed (S2). success").

However, unlike the above-described case, if the fingerprint data is not registered in the user information storage unit 314 or if the user ID is not an administrator account even if the fingerprint data is registered, it is determined that the user registration requester is not an administrator and the administrator authentication fails. Perform the procedure ("failure" in S2).

If the administrator authentication fails, the user authentication unit 316 notifies the GUI 300 of the administrator authentication failure through the command analysis unit 302 (S4), and terminates a series of processes according to user registration.

On the contrary, when the administrator authentication is successful, the user information storage unit 314 receives basic user information through the GUI 300 (S6) and the user to the fingerprint input device 32 through the screen guidance of the GUI 300. The fingerprint is input (S8).

The basic user information input in step S6 is a user ID, a name, a telephone number, a telephone number, an address, and the like.

The fingerprint data processing unit 324 extracts the feature points of the image of the user fingerprint received through the fingerprint input device 32 in step S8 and converts the feature points into fingerprint data, and analyzes the fingerprint data to obtain the quality of the input fingerprint. It is determined whether it is good (S10).

As a result of the determination, when the number of feature points in the fingerprint data is less than a predetermined number, and it is determined that the quality of the fingerprint corresponding to the fingerprint data is poor (No in S10), the fingerprint data processing unit 324 uses the command analysis unit 302. Request the fingerprint re-entry to the GUI (300).

However, when it is determined in S10 that the number of feature points in the fingerprint data is greater than or equal to a certain number, and it is determined that the quality of the fingerprint corresponding to the fingerprint data is good (YES in S10), the administrator 300 informs the user about the user. A data ID allowing access is input and the user ID setting unit 308 stores the user ID of the user in an accessor list of each data ID. Preferably, in the present invention, the accessor list for each data ID is stored in the user rights information storage unit 310.

Subsequently, when the user registration unit 312 notifies the GUI 300 of the user registration completion through the command analysis unit 302, the GUI 300 inquires of the administrator for additional user registration, and when the user additional registration is requested ( Yes in S14), the process proceeds to S6 described above and performs a user registration process corresponding to S6 to S12. However, if the user addition registration is not requested (No in S14), the series of procedures for user registration are terminated.

Through the above-described procedure, an authorized administrator can register a user.

On the other hand, the authorized administrator can register the protected object and the object accessible to the protected object through the protected object setting unit 304. The protected object is preferably managed by the name, path name, data ID, registry information, and the like through the protected object information storage unit 306.

Next, a fingerprint authentication based data security method according to an embodiment of the present invention will be described in detail with reference to the flowchart shown in FIG. 4.

First, the operator registers the right to allow access to the protected object through the GUI 300, and stores in the user rights information storage unit 310. The user rights information storage unit 310 is configured of a data ID field, an accessor list field, and the like, and stores a right to allow access to each protected object. The accessor list is composed of a user ID allowing access, and the number may be stored in singular or plural.

As described above, in a state in which the protection target and the right to access each protection target are registered, when data access is requested from a specific user in a specific PC 10 established on a network (S20), the PC 10 inputs a fingerprint. After receiving the fingerprint through the device 12 (S22), if the quality of the fingerprint is good, generates fingerprint data for the fingerprint (S24).

The PC 10 transmits the data ID of the fingerprint data and the data to be accessed to the data security server 30 through the intranet 1, and requests user authentication for the user (S26). At this time, the PC 10 preferably transmits its identifier to the data security server 30 so that the data security server 30 can recognize it.

Subsequently, the data security server 30 transmits the user authentication request message transmitted through the network matching unit 322 to the user authentication unit 316, and the user authentication unit 316 authenticates the user based on the transmitted fingerprint data. Perform (S28).

The user authentication unit 316 determines whether the same fingerprint data as the fingerprint data exists in the user information storage unit 314 (S30). If the same fingerprint data exists, it is determined that the fingerprint authentication is successful (Yes in S30). If the same fingerprint data does not exist, it is determined that fingerprint authentication has failed (No in S30).

After extracting the user ID corresponding to the fingerprint data, the user authority information storage unit 310 inquires the data ID transmitted with the user authentication request message, and checks whether the user ID is registered in the accessor list of the data ID. Check and perform the user right authentication (S34).

If the user ID is not registered in the accessor list of the data ID in S34 (No in S34), the user authentication failure is notified to the PC 10 through the command analyzer 302 and the network matching unit 322 ( S36) If the user ID is registered in the accessor list of the data ID in S34 (Yes in S34), the PC 10 is notified of the success of user authentication for the access acceptance of the data corresponding to the data ID (S42). ).

At the same time, the user authentication unit 316 records the log state for the event in the log information storage unit 318 (S44).                     

Meanwhile, the PC 10 notified of the successful authentication from the data security server 30 allows access to specific data (S46), so that the user can use the data (S46).

Through a series of procedures described with reference to FIG. 4, it is possible to secure data stored in a plurality of PCs on a network.

1 to 4 described above, an embodiment of the present invention for securely securing data stored in a plurality of PCs in a network environment has been described.

Hereinafter, a fingerprint authentication based data security system in a local environment according to an embodiment of the present invention will be described in detail.

As shown in FIG. 5, a data authentication system based on fingerprint authentication in a local environment according to an exemplary embodiment of the present invention is mounted in the PC 100.

As shown in FIG. 6, the data security system 200 includes a GUI 201, a command analysis unit 202, a protection target setting unit 204, a protection target information storage unit 206, and a user authority setting unit 208. , User authorization information storage unit 210, user registration unit 212, user information storage unit 214, user authentication unit 216, log information storage unit 218, log result generation unit 220, data management unit ( 222, and a fingerprint data processing unit 224.

The administrator operates the protected object setting unit 204 through the GUI 201, stores the information of the protected data in the protected object information storage unit 206, and operates the user registration unit 212 to access specific data. The basic information and fingerprint data of the user to be authorized are stored in the user information storage unit 214, and the user permission setting unit 208 is operated to store access permission data for the user registered by the user registration unit 312.

After the user registration process is completed through the above-described process, if the access of the specific data stored in the PC 100 is detected through the data management unit 222, and authentication of the user requesting access to the data is requested, the fingerprint input device The user fingerprint is input through 110, and fingerprint authentication and user authority authentication for the user are performed.

The user's fingerprint is registered in the user information storage unit 214, and the user's ID is registered with respect to the data ID as a result of inquiring the user authority information storage unit 210 of the ID of the data accessed by the user. If so, the user is determined to be an accessible user, and access to the data is allowed.

However, unlike the case described above, the fingerprint of the user is not registered in the user information storage unit 214, or as a result of querying the user rights information storage unit 210 for the ID of the data accessed by the user, If the ID of the user is not registered for the data ID, the user is determined to be inaccessible, and access to the data is not allowed.

According to this embodiment of the present invention, only registered users can access data (for example, executable programs, files, pure data, etc.) stored in the local PC.

According to the present invention as described above, by performing a fingerprint-based enhanced identity verification process for important programs and data in a computer environment that multiple users access, there is an effect that can provide a more secure and convenient security function.                     

On the other hand, the present invention is not limited to the above-described embodiment, but can be modified and modified within the scope not departing from the gist of the present invention, such modifications and changes should be regarded as belonging to the following claims. will be.

Claims (16)

A plurality of PCs having a fingerprint input device; A data security server connected to the PCs through a communication network to control user access to data stored in the PCs; The data security server is a fingerprint authentication based data security system, characterized in that it comprises a fingerprint input device for user authentication. The method of claim 1, wherein the data security server First means for managing information of data mounted on each of the PCs; Second means for managing information on a user who allows access to data mounted on each of the PCs; Third means for managing access-specific user information for each data mounted on the PCs; And a fourth means for performing user authentication by using the second means and the third means when a user's access to predetermined data is detected from each of the PCs. The method of claim 2, wherein the second means, Store fingerprint information and user ID for the user, The third means, Fingerprint authentication based data security system, characterized in that for storing the accessor list consisting of a user ID to allow access by data. The method of claim 3, wherein the fourth means, Perform fingerprint authentication on the user using the fingerprint information, If the fingerprint authentication is successful, the user ID of the user is inquired by the third means to perform user authority authentication. Fingerprint authentication-based data security system, characterized in that only when the user authorization is successful, notifying the successful authentication of the user's access to the PC, so that the user who requested access to the data can use the data. The method of claim 2 or 4, wherein the fourth means, Fingerprint authentication based data security system, characterized in that for storing the result of the authentication to the log information storage unit. The method of claim 1, wherein the data supplement server And a log result generation unit for processing and outputting the contents stored in the log information storage unit in a form requested by the administrator in response to the request of the administrator. The method of claim 1 or 2, wherein the PC, When a user accesses a predetermined data, a fingerprint is input from the user to generate fingerprint data for the input fingerprint image, and the generated fingerprint data and the ID of the data are transmitted to the data security server. Fingerprint authentication based data security system, characterized in that for requesting authentication. A first step of providing information on data to be protected; A second step of registering information for fingerprint authentication and user authority authentication for the user when the user registration is requested by the administrator; A third process of performing fingerprint authentication and user authority authentication on the user when user access to specific data is detected; And And a fourth process of allowing access of the user's data only when both the fingerprint authentication and the user authority authentication are successful. The method of claim 8, wherein the information on the data provided in the first process, Fingerprint authentication based data security method comprising a data name, path name, data ID, registry information. The method of claim 8, wherein the second process Step 2-1 of receiving a user fingerprint through a fingerprint input device; Step 2-2 of converting the input fingerprint image into fingerprint data to determine the quality; If the quality of the fingerprint data is good, registering the fingerprint data and the user ID of the user as information for fingerprint authentication; And And a step 2-4 of registering the user ID in an accessor list of data to allow access of the user. The method of claim 8 or 10, wherein the third process Step 3-1 of receiving a fingerprint from a user whose access is detected; Step 3-2 of determining whether fingerprint data of the input fingerprint image is previously registered; If it is determined that the fingerprint data is pre-registered, step 3-3 of searching for a user ID corresponding to the fingerprint data; Step 3-4 of determining whether the searched user ID is included in an accessor list of data corresponding to a protected object; And And if the user ID is included in the accessor list of the data, step 3-5 of determining that both the fingerprint authentication and the user authority authentication are successful. Data management means for monitoring user access to data stored in the PC; First means for managing information of data stored in the PC to be protected; Second means for managing user information allowing access to the data; Third means for managing access permission user information for each data; And And a fourth means for performing user authentication by using the second means and the third means when the user access to the predetermined data is detected by the data management means. . The method of claim 12, wherein the second means, Store fingerprint information and user ID for the user, The third means, Fingerprint authentication based data security system, characterized in that for storing the accessor list consisting of a user ID to allow access by data. The method of claim 13, wherein the fourth means, Perform fingerprint authentication on the user using the fingerprint information, If the fingerprint authentication is successful, the user ID of the user is inquired by the third means to perform user authority authentication. Fingerprint authentication-based data security system, characterized in that only if the user authority authentication is successful, by notifying the PC that the user access is detected authentication success, so that the user who requested data access to use the data. The method according to claim 12 or 14, wherein the fourth means, Fingerprint authentication based data security system, characterized in that for storing the result of the authentication to the log information storage unit. The method of claim 12, And a log result generation unit for processing and outputting the contents stored in the log information storage unit in a form requested by the administrator according to a request of an administrator.

Images