KR101235608B1 - Method and System on Multi Factor Certification Using Device Identification Information and Multimedia Identification Information - Google Patents

Abstract

The present invention relates to a method for implementing multi-factor authentication and a multi-factor authentication system that simultaneously utilizes terminal identification information and multimedia identity information input from a multimedia input device such as a camera, a microphone, and a touch panel. (A) receiving, by the multi-factor authentication system, terminal identification information and at least one or more multimedia identification information of the user terminal from the user terminal where the multi-factor authentication client is installed through the multi-factor authentication client; (B) constructing user authentication information for each user terminal using the obtained terminal identification information and multimedia identification information; (C) receiving user authentication request information from the user terminal or a third system associated with the user terminal; (D) transmitting to the user terminal a request for inputting any one of the multimedia identification information selected from the at least one multimedia identification information; (E) receiving the input requested multimedia identity information from the user terminal; (F) performing user authentication for each user terminal with the obtained multimedia identification information and terminal identification information obtained through the multi-factor authentication client after the step (C) or the step (C); It is characterized by processing information.
According to the present invention, the security of the mobile multimedia terminal can be enhanced, and the damage of misuse when lost can be reduced, and the authentication accuracy can be greatly increased when used independently or in addition to the existing authentication method.

Description

Method for processing multi-factor authentication information using terminal identification information and multimedia identity information and multi-factor authentication system {Method and System on Multi Factor Certification Using Device Identification Information and Multimedia Identification Information}

The present invention relates to a method for implementing multi-factor authentication and a multi-factor authentication system using terminal identification information and multimedia identification information. More particularly, the present invention relates to terminal identification information and a multimedia identity input from a multimedia input device such as a camera, a microphone, and a touch panel. The present invention relates to a multi-factor authentication method and a multi-factor authentication system using information simultaneously.

In the existing access authentication method, ID information is inputted using ID / PW or PKI-based personal certificate. However, the mobile multimedia terminal used by the user has the disadvantage of the method of inputting a character, but it has a disadvantage that proper identification is difficult when the terminal is randomly used by a third party because the identity information once entered is automatically stored and reused. .

Personal network access terminals are being converted into tablet PCs and smartphones via desktop PCs and laptop PCs. Such a change in the personal work terminal requires a change in the existing authentication system that securely manages the network environment in the enterprise due to the mobility of the terminal and the openness of the OS environment.

As mobile terminals (smartphones, tablet computers, etc.) increase and business environments in the enterprise change through these terminals, users are required to access internal security networks or work areas that require user authentication. Convenience requires increased authentication. This is because the security threats of theft, loss, and theft are increased compared to the fixed terminals due to the characteristics of the mobile terminal.

Mobility should be applied to a stronger authentication method to check the correspondence between the actual user and the user terminal by causing a situation such as loss, theft, rental of the terminal. In addition, unlike the existing smartphones, because of adopting an open OS, applications with malicious purposes may be run, and applications executed by malicious users may lead to leakage of important information in the enterprise.

Therefore, the necessity of a useful authentication method for companies and service providers that require security and convenience has increased, and the authentication process for the actual user and the terminal has been enhanced for unauthorized access to the network and unauthorized use of the terminal application. There is an urgent need for a method of implementing authentication to allow for control.

The first problem to be solved by the present invention is to propose a multi-factor authentication information processing method for each user terminal.

The second problem to be solved by the present invention is to propose a multi-factor authentication system for each user terminal.

In order to achieve the technical problem to be achieved by the present invention, in the information processing method of the multi-factor authentication system for performing the user authentication for each user terminal, the multi-factor authentication system (A) from the user terminal with the multi-element authentication client is installed Receiving terminal identification information and at least one multimedia identity information of the user terminal through a multi-factor authentication client; (B) constructing user authentication information for each user terminal using the obtained terminal identification information and multimedia identification information; (C) receiving user authentication request information from the user terminal or a third system associated with the user terminal; (D) transmitting to the user terminal a request for inputting any one of the multimedia identification information selected from the at least one multimedia identification information; (E) receiving the input requested multimedia identity information from the user terminal; (F) performing user authentication for each user terminal with the obtained multimedia identification information and terminal identification information obtained through the multi-factor authentication client after the step (C) or the step (C); Provided is a multi-factor authentication information processing method for each user terminal.

(a1) transmitting the multi-factor authentication client to the user terminal and allowing the multi-factor authentication client to be installed in the user terminal before performing step (A); The element authentication client preferably identifies the type of multimedia input device included in the user terminal.

In the step (A), the terminal identification information is preferably at least one of the MAC address of the user terminal, SIM information and the unique number assigned to the user terminal.

Preferably, the multimedia identification information includes at least two of first multimedia identification information and at least one second multimedia identification information, and the at least two multimedia identification information have priority.

A first method of designating the priority by the requirement of the user terminal;

Preferably, the multi-factor authentication system is determined by any one of a second method of receiving the two or more pieces of multimedia identification information and determining the content according to a prioritization policy.

The priority is determined by the multi-factor authentication system using at least one of a third method, which is determined as an inherent accuracy attribute for each multimedia identity information, and a fourth method, which is determined from a quality of multimedia identification information received from the user terminal. Alternatively, the multi-factor authentication system may be determined by transmitting a priority proposal to the user terminal and receiving priority approval information from the user terminal with respect to the transmitted priority proposal.

The multi-factor authentication system preferentially transmits, to the user terminal, an input request for multimedia identity information having higher priority among the two or more multimedia identity information, or simultaneously makes an input request for two or more multimedia identity information. It is preferable to control so that the multimedia information of high priority is first exposed to the user terminal.

The multimedia identity information is preferably one or more of image identity information, sound identity information, and handwritten identity information.

(B1) step (B) preferably further comprises generating a unique code for each of the multimedia identification information, and correspondingly storing the unique code and the terminal identification information.

(d1) In step (D), when the multimedia identity information is one, the request for inputting the multimedia identity information is transmitted. When the multimedia identity information is two or more, priority is given to the multimedia identity information. If there is a priority, and transmits the request of inputting the highest priority multimedia identity information, or simultaneously transmits the request of inputting the highest priority multimedia identity information and multimedia identity information having the next highest priority. It is preferable to.

The multimedia identification information obtained in step (A) is two or more, and the multimedia identification information obtained in step (E) is first multimedia identification information, and the user of step (F) is used as the first multimedia identification information. If authentication fails, (G) transmitting a request for inputting the second multimedia identity information to the user terminal; further comprising the steps (E) and (F) is performed with the second multimedia identity information It is preferable that it is.

Preferably, the first multimedia identity information and the second multimedia identity information are different types of multimedia identity information.

The multimedia identification information obtained in step (A) is two or more, and the multimedia identification information obtained in step (E) is first multimedia identification information, and the user of step (F) is used as the first multimedia identification information. If the authentication is insufficient, (H) notifying of the insufficient user authentication and transmitting a request for input of the second multimedia identity information to the user terminal; further comprising the first multimedia identity information and the second multimedia identity information Step (F) is performed, and the first multimedia identification information and the second multimedia identification information are preferably different types of multimedia identification information.

When the user authentication is insufficient with the second multimedia identification information, the composite user authentication may be performed with the first multimedia identification information and the second multimedia identification information.

The information processing method of the multi-factor authentication system may be performed independently of authentication through ID / PW or certificate, or may be performed secondary to authentication through ID / PW or certificate.

In order to achieve the technical problem to be achieved by the present invention, in a multi-factor authentication system for performing user authentication for each user terminal, the user terminal directly from a user terminal equipped with a multi-factor authentication client or via a predetermined third system A multimedia identification information acquisition module for receiving terminal identification information and at least one multimedia identification information of the mobile station; A multimedia identity information processing module configured to construct user authentication information for each user terminal using the obtained terminal identification information and multimedia identity information; And a multimedia identification information authentication module configured to perform user authentication for each user terminal using the multimedia identification information and the terminal identification information obtained when the user authentication request is received from the user terminal or the third system. We present a multi-factor authentication system that performs user authentication for each terminal.

The third system is connected to a user terminal provided with the multi-factor authentication client through a wired or wireless network, and preferably a system for mediating user authentication of the user terminal.

And generating a unique code for each of the received multimedia identification information and correspondingly storing the unique code and the terminal identification information.

Multimedia identity information management module for operating multimedia identity information for multi-factor authentication, wherein the multimedia identity information is at least two as the first multimedia identity information and at least one or more second multimedia identity information, the two or more multimedia The identity information is one having a priority, and the multimedia identity information priority is preferably controlled by a multimedia identity information operation module.

The received multimedia identification information is two or more, and the multimedia identification information is two or more as the first multimedia identification information and the at least one second multimedia identification information, and when the user authentication fails with the first multimedia identification information, the second It is to perform user authentication with multimedia identification information, and the first multimedia identification information and the second multimedia identification information are preferably different types of multimedia identification information.

The obtained multimedia identification information is two or more, and the multimedia identification information is two or more with first multimedia identification information and at least one second multimedia identification information, and user authentication is insufficient with the first multimedia identification information. 2 If the user authentication is insufficient due to the multimedia identity information, the composite user authentication is performed with the first multimedia identity information and the second multimedia identity information, and the first multimedia identity information and the second multimedia identity information It is preferably another kind of multimedia identity information.

First, the identity of a user who uses the terminal can be accurately identified by using various input devices attached to the terminal.

Second, a third party can effectively respond to a security threat disguised as access to a specific system or network using a terminal and an account.

Third, the accuracy of authentication can be increased by using a multi-factor authentication method using both terminal identification information and multimedia identity information of the present invention. In particular, in the case of a mobile terminal having a high risk of loss, when the user-based multimedia identity information is used for authentication, a risk due to the lost terminal can be greatly reduced.

Fourth, if the authentication through the multimedia identity information of the present invention is used in addition to the existing ID / PW or certificate method, the accuracy of the authentication can be greatly increased. In particular, when the ID / PW or the password of the certificate is exposed or entered into the third party, the damage of the user can be greatly reduced.

Fifth, when accessing an internal security network or accessing a work area that requires user authentication in an enterprise's work environment using a mobile terminal (smartphone, tablet computer, etc.), an environment requiring enhanced security and user convenience Has a special effect.

1 is a diagram of an exemplary configuration of a multi-factor authentication system of the present invention.
2 is a diagram illustrating an exemplary configuration of an information processing method of a multi-factor authentication system according to the present invention.
FIG. 3 is a diagram illustrating an exemplary configuration of a method of applying priority in multiple authentication of a multi-factor authentication system according to the present invention.
4 is a diagram illustrating an exemplary configuration of an information processing method of a multi-factor authentication system of the present invention in which two or more pieces of multimedia identity information are sequentially used.
FIG. 5 is a diagram illustrating an exemplary configuration of an information processing method of a multi-factor authentication system of the present invention for performing complex authentication using two or more pieces of multimedia identity information.
FIG. 6 is a diagram illustrating an exemplary configuration of a multiple authentication procedure of the multi-factor authentication system of the present invention. FIG.

Hereinafter, the present invention will be described in more detail with reference to the drawings.

1 is a diagram of an exemplary configuration of a multi-factor authentication system 1000 of the present invention. In the multi-factor authentication system 1000 of the present invention, the terminal identification information of the user terminal 2000 is directly from the user terminal 2000 in which the multi-factor authentication client 2100 is installed or via a preset third system 3000. And a multimedia identification information acquisition module 1200 for receiving at least one multimedia identification information, and the multimedia identification information processing module 1300 for configuring user authentication information for each user terminal 2000 using the obtained terminal identification information and multimedia identification information. The multimedia identity information authentication module 1400 performs user authentication for each user terminal 2000 by using the multimedia identification information and the terminal identification information obtained when the user authentication request is received from the user terminal 2000 or the third system 3000. And multiple authentication information DB 1600 used for multiple authentication. The multi-factor authentication system 1000 is connected to the user terminal 2000 and the wired / wireless network 4000 directly or via a third system 3000.

The user terminal 2000 of the present invention generally refers to a multimedia terminal capable of processing multimedia (text, voice, image, video, etc.), such as a tablet PC or a smartphone, which is an access terminal. Such a multimedia terminal has a text input / output device, a voice input / output device, a video input / output device, etc. to support a multimedia function. The present invention performs an enhanced authentication method that receives individual and unique attribute information of a user through such various input / output devices and identifies the user's identity through this. Static information such as user IDs / PWs and public certificates used in the past are stored and reused once in a mobile terminal, so that identification of the user may be unclear, such as loss at the point of use of the terminal or unauthorized use by others without proper authority. Can be. Therefore, in the present invention, additional user input information is added to conventional static information such as user ID / PW and public certificate, or a multi-factor authentication method is performed to increase authentication accuracy independently of existing static information.

In the case of a multimedia terminal, information input for user identification is input using various input devices attached to the multimedia terminal. For example, the terminal to which the camera is attached allows the user to determine the user's identity from the pattern information of the image by capturing an image for identifying the user's identity using the camera. The microphone or the touch screen of the user terminal 2000 may determine whether the user is a voice, a handwriting, or the like.

The multi-factor authentication method using the input information is shown in Table 1 below.

Multi-factor Authentication Scheme Using Multimedia User Terminal 2000 Camera of the user terminal 2000 Iris recognition Register the user account using the user iris information and transmit the iris information photographed using the camera of the corresponding user terminal 2000 to the authentication server to authenticate the user by combining the user terminal 2000 and the property of the user. Example> shooting with smartphone camera

Facial recognition Register user account by using user face information and transmit user's face information taken by camera of user terminal 2000 to authentication server to authenticate user by combining user terminal 2000 and user's attributes gesture Register user account by using user gesture information and transmit user's gesture information taken by camera of user terminal 2000 to authentication server when user authentication is performed. Microphone of the user terminal 2000 Voice recognition Register the user account using the user's voice information and transmit the gesture information taken using the camera of the corresponding user terminal 2000 to the authentication server to authenticate the user by combining the user terminal 2000 and the user's attributes. Example> Voice input using smartphone microphone
Touch screen input method Handwriting recognition Register the user account using user handwriting information (sign, etc.) and send the handwriting information input using the touch screen of the corresponding user terminal 2000 to the authentication server when the user is authenticated, combining the user terminal 2000 and the user's attributes Perform authentication Example> Handwriting using the smartphone screen input window

2 is a diagram illustrating an exemplary configuration of an information processing method of the multi-factor authentication system 1000 according to the present invention.

The multi-factor authentication system 1000 includes (A) terminal identification information of the user terminal 2000 and at least one of the multi-factor authentication client 2100 from the user terminal 2000 on which the multi-factor authentication client 2100 is installed. Receiving the above-mentioned multimedia identification information (S11), (B) configuring the user authentication information for each user terminal 2000 using the obtained terminal identification information and the multimedia identification information (S12), (C) the user terminal ( 2000) or receiving user authentication request information from a third system 3000 associated with the user terminal 2000 (S13), (D) at least one multimedia identity information selected from the at least one multimedia identity information. Transmitting an input request to the user terminal 2000 (S14), (E) the input requested multimedia identity from the user terminal 2000; The user terminal (S15), (F) the received multimedia identification information and the terminal identification information obtained through the multi-factor authentication client 2100 after the step (C) or the step (C) after receiving the information (S15) The authentication information is processed through the step S16 of performing user authentication per 2000).

The multi-factor authentication client 2100 is installed in the user terminal 2000, which may be transmitted directly from the multi-factor authentication system 1000 to the user terminal 2000. The multi-factor authentication client 2100 is transmitted through the multi-factor authentication client transmission module 1100, and the multi-factor authentication client transmission module 1100 includes a multi-factor authentication client program 1110. On the other hand, the user terminal 2000 is installed in another system connected to the user terminal 2000 and the wired and wireless network 4000, or copied to the user terminal 2000 through a mobility memory (USB, for example). Or may be installed in the user terminal 2000 when the user terminal 2000 is released. The multi-factor authentication client 2100 transmitted to the user terminal 2000 is installed in the user terminal 2000, and the multi-factor authentication client 2100 of the user terminal 2000 is connected to the user through a wired / wireless network 4000. The terminal 2000 transmits or recognizes that the multi-factor authentication client 2100 is installed. The multi-factor authentication system 1000 always registers account information regarding the user terminal 2000. The multi-factor authentication client 2100 may be a type (eg, a video input device such as a camera, a voice input device such as a microphone, a touch screen, or the like) of the multimedia input device 2200 included in the user terminal 2000. And the like). The multi-factor authentication client 2100 includes a multi-factor authentication client acquisition module 2110 that obtains a multi-factor authentication client program transmitted by the multi-factor authentication client transmission module 1100. The multi-factor authentication client 2100 acquires multimedia identification information of the client side. The client-side multimedia identity information acquisition module 2120, a multimedia identity information transmission module 2130 for transmitting multimedia identity information, and a client-side user DB 2140 for storing client-side user information may be included. Meanwhile, the client side may generate a unique code for the multimedia identity information. In this case, the client-side multimedia identity information acquisition module 2120 may generate a unique code for the client-side multimedia identity information. It may further include a code generation module 2121. In this case, the client-side user DB 2140 may further include a client-side multimedia identity information unique code data 2142. Of course, the client side user DB 2140 may include client side terminal identification information data 2141.

The third system 3000 may be a system that is connected to the user terminal 2000 where the multi-factor authentication client 2100 is installed through a wired / wireless network 4000 and mediates user authentication of the user terminal 2000. have. Meanwhile, the multi-factor authentication system 1000 may be a system that performs authentication for the user terminal 2000 of customers accessing the third system 3000 for the third system 3000. have.

As in step (A), the multi-factor authentication system 1000 receives identification information of the user terminal 2000. The terminal identification information may be at least one of a MAC address of the user terminal 2000, SIM information, and a unique number assigned to the user terminal 2000. The multi-factor authentication client 2100 grasps the MAC address of the user terminal 2000, the SIM information, and a unique number assigned to the user terminal 2000, and transmits the identified information to the multi-factor authentication system 1000. send. Meanwhile, the terminal identification information checked by the multi-factor authentication client 2100 may be stored in the client side terminal identification information data 2141, and the stored terminal identification information may be transmitted to the multi-factor authentication system 1000. .

The technical advantages of using MAC address and SIM information are as follows. Due to the characteristics of the multimedia user terminal 2000, the obtained user identification information may not be made as unique user identification information at the same level as the existing iris recognition system. That is, different people may have the same input value (the value extracted by using specific patterns from the input image information), in which case there is a problem that the user can not be identified only by the input value. Therefore, in authentication, there should be a unique value corresponding to the user, and it is determined whether the user matches the unique value. The MAC address or the SIM information corresponds to the unique value.

The multi-factor authentication system 1000 receives multimedia identification information from the user terminal 2000 through the multimedia identification information acquisition module 1200. The multimedia identity information processing module 1300 of the multi-factor authentication system 1000 processes the received multimedia identity information. The obtained multimedia identification information extracts and encodes a characteristic from the multimedia identification information data. The identification encoding is performed by the multimedia identity information unique code generation module 1310. The multimedia identification information unique code may be stored in multimedia identification information data of the multi-authentication information DB 1600. On the other hand, the obtained multimedia identity information may be stored in the multimedia identity information data of the multi-authentication information DB 1600. The multimedia identification information unique code and the terminal identification information constitute user authentication information.

The multi-authentication information DB 1600 includes a user DB 1610 that stores information about a user, a user terminal 2000 DB 1620 that stores user terminal information, and multimedia identity information related to an operation policy of multimedia identity information. There is an operation policy DB 1630. The user terminal 2000 DB 1620 stores terminal identification information data 1630, which is identification information of a user terminal, and multimedia identity information data 1622, which is user's multimedia identification information. The multimedia identity information management policy DB 1630 includes multimedia identity information management policy data 1631 and priority policy data 1632.

The multi-factor authentication system 1000 receives user authentication request information from the user terminal 2000 or a third system 3000 associated with the user terminal 2000, and at least one or more from the user terminal 2000. The terminal may receive multimedia identification information and perform user authentication for each user terminal 2000. In addition, the multi-factor authentication system 1000 may include image identity information (face, iris, vein, gesture, etc. may each be image identity information), sound identity information (voice recognition information, etc.) and handwriting. The user requests to input any one of the multimedia identification information selected from at least one multimedia identification information among various types of multimedia identification information such as identification information (signature recognition information, handwriting recognition information on a designated character string, etc.). The terminal 2000 may transmit the received multimedia identity information to the terminal 2000.

The multi-factor authentication system 1000 may receive two or more pieces of multimedia identity information. The two or more multimedia identity information may be of the same kind (eg, image identity information such as face, iris, vein, gesture, etc.), or may be of different kinds (image identity information + sound identity information). On the other hand, the two or more multimedia identity information may be obtained sequentially. When receiving two or more pieces of multimedia identity information, the multimedia identity information unique code generation module 1310 generates multimedia identity information unique codes for each multimedia identity information.

When two or more pieces of multimedia identity information are registered, a method of using the two or more pieces of multimedia identity information will be described. When two or more pieces of multimedia identity information are mediated, the management of the two or more pieces of multimedia identity information is handled by the multimedia identity information operation module 1500 of the present invention. The multimedia identity information operation module 1500 processes the operation of multimedia identity information according to the multimedia identity information authentication when two or more pieces of multimedia identity information are mediated with reference to the multimedia identity information operation policy DB 1630.

3 shows an exemplary configuration of an information processing method of the multi-factor authentication system 1000 that receives two or more pieces of multimedia identity information. The multimedia identity information acquisition module 1200 of the multi-factor authentication system 1000 obtains first multimedia identity information through a multi-factor authentication client 2100 of the user terminal 2000 (S21), and a first multimedia identity. Perform information authentication and store the first multimedia identity information (S22). Subsequently, the user terminal 2000 requests to obtain additional multimedia identity information, and if there is no additional multimedia identity information for the request, the multimedia identity information registration is closed (S24). (S25).

On the other hand, the multimedia identity information acquisition module 1200 requests the user terminal 2000 to obtain the multimedia identity information operation priority, and if the information on the priority is not transmitted, the multi-factor authentication system 1000 is multimedia. The identification information management priority is determined (S27), and if information on the priority is transmitted, the multimedia identification information management priority determined by the user is applied (S28). The priority is stored in the priority policy data 1632. When the multi-factor authentication system 1000 determines the priority of operating multimedia identity information, the quality of the received multimedia identity information (the same facial image and the quality of the image for each user (differences of the image capturing apparatus such as resolution, vibration, etc.) Depending on various variables of the city and the influence of the imaging environment, the quality of the transmitted multimedia identity information may be different, and the average authentication accuracy by type of multimedia identity information (when iris recognition is more common than facial recognition, the accuracy is high. While the average accuracy is higher than that of facial recognition, but less accurate than iris recognition, cameras mounted on smartphones generally have much lower performance than cameras used in general iris recognition systems. Iris information alone can help In most cases, if you use a camera attached to a smartphone, facial recognition may be more advantageous for user identification because it provides more pixel information. In addition, since the user needs to input a voice for authentication, it may be affected by the noise of the surroundings, and because the voice needs to be uttered in the surroundings, it may cause inconvenience to the surroundings or perform an authentication process around the public. Thus, depending on the user, authentication through voice recognition may be arranged from priority to subordinate to the accuracy of voice recognition.

If the authentication is not sufficient as the first multimedia identification information according to the multimedia identification information operation priority, the authentication may be performed using the second multimedia identification information. 4 illustrates an embodiment configuration for a method of performing authentication with two or more multimedia identity information. The multi-factor authentication system 1000 obtains first multimedia identity information through the multi-factor authentication client 2100 of the user terminal 2000 (S31), and performs user authentication with the first multimedia identity information (S32). However, if user authentication is insufficient with the first multimedia identity information, the user terminal 2000 is notified of the insufficientness, another kind of second multimedia identity information request for obtaining multimedia identity information (S33), and the user terminal ( 2000, the second multimedia identification information is obtained (S34), and authentication is performed using the second multimedia identification information (S35). Meanwhile, if user authentication is insufficient with the first multimedia identity information, the first multimedia identity information may be repeatedly requested. However, even if the first multimedia identity information is repeatedly requested, authentication may not be possible using the first multimedia identity information. In this case, the information processing as shown in FIG. 4 may shine even more.

When the multimedia identification information is two or more as first multimedia identification information and at least one or more second multimedia identification information, the priority is assigned to the first method of the user terminal 2000 and the multi-factor authentication system 1000. ) Is determined by any one of the second method of receiving the two or more pieces of multimedia identification information and determining the content according to the prioritization policy. The priority is the multi-factor authentication using any one or more of a third method, which is determined as an intrinsic accuracy attribute for each multimedia identity information, and a fourth method, which is determined from a quality of multimedia identification information received from the user terminal 2000. The system 1000 determines, or the multi-factor authentication system 1000 sends a priority proposal to the user terminal 2000 and receives priority approval information from the user terminal 2000 with respect to the transmitted priority proposal. It is preferred to be determined through.

The multi-factor authentication system 1000 preferentially transmits, to the user terminal 2000, an input request for high priority multimedia identity information of the two or more multimedia identity information, or inputs two or more multimedia identity information. While simultaneously making the request, it is preferable to control so that the multimedia terminal information with high priority is first exposed to the user terminal 2000. For example, if face recognition is to be performed first, and if authentication is not performed with face recognition, the input request for multimedia identity information is ranked to request voice input for voice recognition, or the exposure priority can be controlled. Can be.

The multimedia identification information operation module 1500 determines whether the multimedia identification information has priority when the multimedia identification information is two or more, and requests to input the multimedia identification information having the highest priority when the multimedia identification information exists. It is preferable to transmit or to simultaneously transmit a request for inputting multimedia identification information having the highest priority and multimedia identification information having the next highest priority.

On the other hand, authentication through multimedia identity information does not always succeed. The existing authentication method used only one type of multimedia identity information, and when authentication of the multimedia identity information failed, it was common to request input of the same type of multimedia identity information repeatedly. For example, in the case of fingerprint recognition, when fingerprint recognition fails, there is a problem of requesting fingerprint recognition again. According to the present invention, in addition to using the terminal identification information such as the MAC address and the multimedia identity information at the same time, when authentication fails with the first multimedia identity information, two methods may be further used.

First, different types (different types are different series (image recognition, speech recognition, handwriting recognition are different series) or different forms (for example, iris and face recognition are the same image recognition series, but different types) To say). An example is shown in FIG. 4. The multimedia identification information obtained in the step (A) is two or more, the multimedia identification information obtained in the step (E) is the first multimedia identification information, and the multi-factor authentication system 1000 performs the first multimedia identification. When the user authentication of the step (F) fails with the information, (G) the first multimedia identity information and the second multimedia identity information to the user terminal 2000 to request a different type of second multimedia identity information Perform the step of transmitting. The multi-factor authentication system 1000 performs steps (E) and (F) with the second multimedia identification information.

Second, a combination of the first multimedia identity information and the second multimedia identity information is used. In general, the multimedia identity information input for authentication is compared with the stored multimedia identity information (actually, a comparison of unique code values for patterns) to calculate probability values to determine the identity of both. In this case, the multimedia identity information authentication module 1400 may be configured even if the first multimedia identity information does not reach a preset threshold probability value and the second multimedia identity information of another type does not reach a preset threshold probability value. Once within a certain high probability range, the information can be processed in such a way as to determine the authentication success.

5 illustrates an exemplary configuration of a complex authentication scheme of the multi-factor authentication system 1000. When the multimedia identification information authentication module 1400 determines that user authentication is insufficient with the first multimedia identification information (S41), and determines that user authentication is insufficient with the second multimedia identification information (S42), a first multimedia Using both the identity information and the second multimedia identity information, if both of them fall within a predetermined predetermined high probability range, the user authentication procedure is performed using a combination of both in a manner of determining the authentication success (S43).

For information processing as shown in FIG. 5, when the user authentication of the step (F) is insufficient with the first multimedia identity information, the multi-factor authentication system 1000 notifies (H) that the user authentication is insufficient and the user The first multimedia identification information and the second multimedia identification information may be transmitted to the terminal 2000 by a request for inputting different types of second multimedia identification information. Preferably, step (F) is performed with the first multimedia identification information and the second multimedia identification information, and the first multimedia identification information and the second multimedia identification information are different types of multimedia identification information.

Meanwhile, all information processing between the user terminal 2000 and the multi-factor authentication system 1000 may be performed through the multimedia identity information authentication module 1400. The multimedia identity information authentication module 1400 may exist in the multi-factor authentication system 1000 as shown in FIG. 1, but may exist in a system existing between the multi-factor authentication system 1000 and the user terminal 2000. have.

FIG. 6 is a diagram illustrating an exemplary configuration of a multi-authentication procedure of the multi-factor authentication system 1000 of the present invention. 6 shows an example in which communication between the multi-factor authentication system 1000 and the user terminal 2000 is performed.

1. The user performs identity information registration using the multi-factor authentication client 2100 installed in the user terminal 2000 of the user. The multi-authentication information DB 1600 may be operated online or offline, which is related to the reliability of generating user identity information. That is, the security officer of each area requiring authentication maintains a multi-authentication information DB 1600 by providing a procedure for confirming whether a user matches when registering with initial user identity information. For example, if you register as Online, you may be asked for information that you have learned that you can be confident of, along with multi-factor identity information.

2. When the multi-factor identity information requested for registration is confirmed, the multi-factor authentication system 1000 recognizes the face of the user's face photographed image in the form of information capable of authenticating the multi-factor identity information (for example, facial recognition information). Change to distinct data type according to security technology.

3. When the user terminal 2000 possessed by the user attempts to access the service area, the multimedia identity information authentication module 1400 starts a multi-factor authentication process with respect to the user terminal 2000.

4. When the multimedia identity information authentication module 1400 checks whether the user terminal 2000 is connected to the multi-factor authentication system 1000, the multi-factor authentication system 1000 is multiplied by the user terminal 2000. Respond to initiate the element authentication request.

5. The multimedia identity information authentication module 1400, which has been instructed to start multi-factor authentication from the multi-factor authentication system 1000, sends a multi-factor authentication request to the user terminal 2000.

6. The user generates and inputs his or her identity information registered in advance according to the multi-factor authentication request displayed on his user terminal 2000. This process is performed using the multimedia input tool of the user terminal 2000 according to the various multi-factor authentication methods shown in [Table 1].

7. The multi-factor authentication information input by the user is transferred to the multimedia identity information authentication module 1400 through the function of the multi-factor authentication client 2100 of the user terminal 2000.

8. The identity information of the user received from the multi-authentication client of the user terminal 2000 is confirmed by the multimedia identity information authentication module 1400. In this case, the authentication standard defined in the authentication protocol (EAP) set up with each other is determined. The authentication procedure according to the authentication protocol).

9. The multimedia identity information authentication module 1400 checks whether the transmitted identity information and the identity information of a user registered in advance match.

10. The multi-factor authentication system 1000 transmits the identity authentication result to the user terminal 2000.

In this case, the multi-factor authentication system 1000 may instruct to control whether the user terminal 2000 is connected according to the authentication result. That is, when the multi-factor authentication system 1000 is located at a gate of a system that performs a specific service, service usage of the user terminal 2000 may be restricted without authentication through the multi-factor authentication system 1000. It can also be. On the other hand, the multi-factor authentication system 1000 may be in place of a separate authentication process in a separate system. The scheme as shown in FIG. 6 is moreover when the multi-factor authentication system 1000 is present and functioning in a particular third party service system that performs a particular service (eg, data storage service, personal information storage service, mail service, etc.). More effective. In this case, the multi-factor authentication system 1000 may function as a system that performs an authentication service for one or various third systems 3000. In the description related to FIG. 6 or FIG. 6, the authentication requestor may exist together with an authentication server in the multi-factor authentication system 1000, wherein the authentication requestor exists in the third system 3000, and only the authentication server is multiplied. It may be present in the element authentication system 1000. 6 or 6, the identity information registry may exist in the multi-factor authentication system 1000 or in another storage system connected to the multi-factor authentication system 1000 and the wired / wireless network 4000.

The information processing method of the multi-factor authentication system 1000 may be performed independently of authentication through ID / PW or certificate, or may be performed secondary to authentication through ID / PW or certificate.

The invention can be used throughout the IT industry where authentication is required. In particular, it can be better applied to a smart terminal such as a mobile terminal or a smart phone.

1000: multi-factor authentication system
1100: multi-factor authentication client transport module
1110: multi-factor authentication client program
1200: Multimedia identification information acquisition module
1300: Multimedia identity information processing module
1310: unique code generation module for multimedia identity information
1400: multimedia identity information authentication module
1410: composite multimedia identity authentication module
1500: multimedia identity information operation module
1600: multiple authentication information DB
1610: user DB
1620: user terminal DB
1621: terminal identification information data
1622: multimedia identity data
1630: Multimedia Identity Information Management Policy DB
1631: Multimedia identity information management policy data
1632: priority policy data
1900: communication module
2000: user terminal
2100: multi-factor authentication client
2110 multi-factor authentication client acquisition module
2120: client side multimedia identity information acquisition module
2121: Client side multimedia identity information unique code generation module
2130: multimedia identity information transmission module
2140: client side user DB
2141: client side terminal identification information data
2142: Client-side multimedia identity information unique code data
2200: multimedia input device
3000: third system
4000: wired and wireless network

Claims (21)

In the information processing method of the multi-factor authentication system for performing user authentication for each user terminal,
The multi-factor authentication system
(A) receiving terminal identification information and at least one or more multimedia identification information of the user terminal from the user terminal installed with the multi-factor authentication client;
(B) constructing user authentication information for each user terminal using the obtained terminal identification information and multimedia identification information;
(C) receiving user authentication request information from the user terminal or a third system associated with the user terminal;
(D) transmitting to the user terminal a request for inputting any one of the multimedia identification information selected from the at least one multimedia identification information;
(E) receiving the input requested multimedia identity information from the user terminal;
(F) performing user authentication for each user terminal with the obtained multimedia identification information and terminal identification information obtained through the multi-factor authentication client after the step (C) or the step (C); Will be
Before the step (A), the step of transmitting the multi-factor authentication client to the user terminal, and causing the multi-factor authentication client to be installed in the user terminal;
The multi-factor authentication client is to determine the type of multimedia input device included in the user terminal multi-factor authentication information processing method for each user terminal. delete The method of claim 1,
In the step (A), the terminal identification information is one or more of the MAC address and the SIM information of the user terminal, characterized in that the multi-element authentication information processing for each user terminal. The method of claim 1,
The multimedia identification information is at least two as first multimedia identification information and at least one second multimedia identification information.
And the at least two pieces of multimedia identity information have a priority. 5. The method of claim 4,
The priority is
A first method designated by a required share of the user terminal and
Multi-factor authentication information processing method for each user terminal, characterized in that the multi-factor authentication system receives the two or more pieces of multimedia identification information, and is determined by any one of a second method of determining according to a priority determination policy. . 5. The method of claim 4,
The priority is determined by the multi-factor authentication system using a fourth method, which is determined from the quality of multimedia identity information received from the user terminal, or the multi-factor authentication system sends a priority proposal to the user terminal, and The method for processing multi-factor authentication information for each user terminal, wherein the priority proposal transmitted is determined by receiving priority approval information from the user terminal. 5. The method of claim 4,
The multi-factor authentication system preferentially transmits, to the user terminal, an input request for multimedia identity information having higher priority among the two or more multimedia identity information, or simultaneously makes an input request for two or more multimedia identity information. The multi-factor authentication information processing method for each user terminal, characterized in that the control to expose the priority priority to the multimedia identity information to the user terminal. The method of claim 1,
The multimedia identification information is one or more of image identification information, sound identification information and handwritten identity information, characterized in that the multi-element authentication information processing method for each user terminal. The method of claim 1,
(B1) step (B) is a step of generating a unique code for each of the multimedia identification information, and correspondingly storing the unique code and the terminal identification information; multi-element for each user terminal further comprising a How authentication information is handled. The method of claim 1,
(d1) in the step (D),
When the multimedia identity information is one, the request for inputting the one multimedia identity information is transmitted.
If the multimedia identification information is two or more, it is determined whether the multimedia identification information has priority, and if the priority is present, the request for input of the highest priority multimedia identification information is transmitted, or the multimedia having the highest priority. A method for processing multi-factor authentication information for each user terminal, wherein the request for inputting the identity information and the multimedia identity information having the next priority order are simultaneously transmitted. 5. The method of claim 4,
The multimedia identification information obtained in step (A) is two or more,
When the multimedia identification information obtained in step (E) is first multimedia identification information and the user authentication of step (F) fails with the first multimedia identification information,
(G) transmitting a request for inputting second multimedia identity information to the user terminal;
Step (E) and step (F) is performed as the second multimedia identification information, characterized in that the multi-element authentication information processing for each user terminal. The method of claim 11,
And wherein the first multimedia identity information and the second multimedia identity information are different types of multimedia identity information. The method of claim 1,
The multimedia identification information obtained in step (A) is two or more,
When the multimedia identification information obtained in the step (E) is the first multimedia identification information, and the user authentication of the step (F) is insufficient as the first multimedia identification information,
(H) notifying the user terminal due to insufficient user authentication, and transmitting a request for input of second multimedia identity information to the user terminal;
After the step (H), the step (F) is performed with the second multimedia identification information obtained from the user terminal.
And wherein the first multimedia identity information and the second multimedia identity information are different types of multimedia identity information. The method of claim 13,
If the user authentication in step (F) is insufficient due to the second multimedia identity information,
Step (F) is a multi-factor authentication information processing method for each user terminal, characterized in that for performing a composite user authentication using the first multimedia identity information and the second multimedia identity information together. In the multi-factor authentication system for performing user authentication for each user terminal,
A multimedia identity information acquisition module for receiving terminal identification information and at least one multimedia identity information of the user terminal directly from a user terminal provided with a multi-factor authentication client or via a preset third system;
A multimedia identity information processing module configured to construct user authentication information for each user terminal using the obtained terminal identification information and multimedia identity information;
And a multimedia identification information authentication module for performing user authentication for each user terminal using the multimedia identification information and the terminal identification information obtained when the user authentication request is received from the user terminal or the third system.
The multi-factor authentication client has undergone a step in which the multi-factor authentication system transmits the multi-factor authentication client to the user terminal and is installed in the user terminal.
The multi-factor authentication client performs user authentication for each user terminal, characterized in that the type of the multimedia input device included in the user terminal. 16. The method of claim 15,
The third system is a system that is connected to a user terminal in which the multi-factor authentication client is installed through a wired or wireless network, and mediates user authentication of the user terminal.
And a multi-factor authentication system performing user authentication for each user terminal, wherein the multi-factor authentication system has a relationship for performing an authentication procedure for a terminal of a customer connected to the third system. 16. The method of claim 15,
And generating a unique code for each of the received multimedia identification information, and generating a unique identification code for generating the unique identification code and the terminal identification information. Perform a multifactor authentication system. 16. The method of claim 15,
Further comprising: a multimedia identity information management module for operating multimedia identity information for multi-factor authentication,
The multimedia identification information is at least two as first multimedia identification information and at least one second multimedia identification information.
The at least two multimedia identity information has a priority,
The multimedia identity information priority is a multi-factor authentication system for performing user authentication for each user terminal, characterized in that the multimedia identity information management module is controlled. 16. The method of claim 15,
The received multimedia identity information is two or more,
The multimedia identification information is at least two as first multimedia identification information and at least one second multimedia identification information.
If user authentication fails with the first multimedia identity information,
To perform user authentication with the second multimedia identity information,
And the first multimedia identification information and the second multimedia identification information are different types of multimedia identification information. 16. The method of claim 15,
The received multimedia identity information is two or more,
The multimedia identification information is at least two as first multimedia identification information and at least one second multimedia identification information.
Insufficient user authentication with the first multimedia identity information,
If the user authentication is insufficient due to the second multimedia identity information,
Performing composite user authentication with the first multimedia identity information and the second multimedia identity information;
And the first multimedia identification information and the second multimedia identification information are different types of multimedia identification information. 16. The method of claim 15,
Authentication information processing of the multi-factor authentication system may be performed independently of authentication through ID / PW or certificate, or may be additionally performed through authentication through ID / PW or certificate. Multi factor authentication system.

Images