KR20080075956A - A user authentication device and method using biometrics information - Google Patents

Abstract

A user authentication apparatus and method using biometric information are provided to recognize biometric information of a user and use the biometric information as a protection master key to achieve a safe authentication apparatus including no password. A user authentication apparatus(100) includes a biometric sensor(102), a central processor(104), a security and authentication module(103), a communication module(105), a program memory(106), and a storage unit(107). The biometric sensor collects biometric information(101) of a user. The central processor controls the authentication apparatus, extracts a characteristic of the biometric information and digitalizes the characteristic. The security and authentication module authenticates the user by using the characteristic of the biometric information and generates OTP(One Time Password) or processes electronic signatures. The communication module transmits/receives data to/from a host device. The program memory stores an encoding algorithm and an operating program. The storage unit stores encoded key values.

Description

A user authentication device and method using biometrics information}

1 is a block diagram showing the configuration of a user authentication device using portable biometric information according to the present invention.

FIG. 2 is a flowchart illustrating an initial initialization and user registration procedure of the portable user authentication device of FIG. 1.

Figure 3 is a flow chart illustrating a procedure for a user to register the OTP authentication apparatus according to the present invention in the first relevant service server.

4 is a flowchart illustrating a procedure performed between each device in the case of using an OTP authentication device registered in advance in a service server according to the present invention.

Figure 5 is a block diagram showing the configuration of a user authentication device with a built-in HSM according to another embodiment of the present invention.

6 is a flow chart showing the flow of setting the initial key value of the public key or secret key based authentication apparatus according to another embodiment of the present invention.

FIG. 7 is a flowchart illustrating a process of performing user authentication and digital signature when an HSM-based user authentication apparatus is actually used. FIG.

The present invention relates to a user authentication device and an authentication method using biometrics, and more particularly, to secure the safety of electronic authentication and electronic payment signatures for authentication and financial transaction activities, payment behaviors, etc. To provide an authentication device equipped with a biometric sensor, and to authenticate the user in real time using the user's biometric information at every login, obtain a secret key value to securely store and operate other key values By providing a method, the present invention relates to a user authentication device and an authentication method for further strengthening a tamper-proof function and security level of a user authentication device.

The Internet is a network aggregation of computer networks all over the world, which has led to rapid proliferation due to its non-face-to-face, openness, broadcast type, globality, and accessibility. It has security vulnerability such as password decryption. Due to these vulnerabilities, damages such as credit card number theft, personal information leakage, cyber security account hacking, etc. are being reported. Therefore, in the case of electronic transactions through the Internet, for the secure electronic commerce that the trading partners can trust each other, it is necessary to guarantee the confidentiality through encryption transmission and decryption of data, user identification, and timing of electronic transactions. It is required.

As a way to meet the demand for secure and convenient Internet transactions, digital signatures based on PKI (Public Key Infrastructure) have begun to be introduced in earnest. PKI is an information protection standard that implements encryption and decryption of data using a public key and a private key.It trades digital signatures encrypted with the private key of the data creator. When given to the other party, the counterparty can confirm the identity of the person who created the data and whether the electronic document has been changed by verifying the received electronic signature using the public key of the data creator (sender). To this end, a trusted third party, which is a trusted third party authorized by the state, registers a public key and its owner information that can verify the value of the signer's digital signature through an accredited certificate, which is a seal certificate for cyber transactions. Provide to users who need verification.

Therefore, in order to secure electronic commerce, the private key (secret key) must be securely maintained from all hacking means, so there is a need for a method that can guarantee the safety of the private key to the maximum.

In addition, PKI provides a more secure security technology than passwords commonly used in electronic transactions in cyberspace. PKI uses a complex mathematical algorithm based on a hash function to generate a public signature, which is an asymmetric key for verifying digital signatures. It provides much more secure function than symmetric key method of password. Therefore, in the form of transaction that delivers personal information and financial transaction information non-face-to-face through the virtual space of the Internet such as internet banking and cyber securities transaction, PKI guarantees the other party's identity and electronically guarantees the integrity of financial transactions. It is widely used as a method.

Meanwhile, paper card is being used as an authentication means to ensure the safety of the electronic financial services of the Internet-based account transfer of the financial sector, which is one of the representative online electronic transactions based on PKI. In other words, the paper card used as one of the user authentication means provides about 30 different random numbers in the form of random numbers for each user, but this method is difficult because it is difficult to secure safety due to the limited number of random numbers. As a more advanced method, one-time password generators, that is, one time password (OTP) devices are used, or financial authentication IC devices incorporating PKI-type financial IC chips equipped with HSM (Hardware Security Module) modules are used. . Today, when using a certain number of electronic financial transactions, domestic e-commerce laws restrict the use of a separate H / W authentication device such as an OTP device or a financial authentication IC device with a built-in HSM.

However, in the case of these two types of user authentication devices, the financial IC device must provide a method to securely manage the user secret digital signature key for the PKI-based user digital signature in the financial IC device. In this case, the secret master shared key shared between the financial transaction server and the user's OTP device must also be securely managed. However, the OTP device or the financial IC device, which is a separate authentication device for user authentication, which has been provided in the financial sector so far for electronic transactions, is insufficient to provide the above-mentioned security function.

Therefore, a safe and convenient secret key management method is required in a user authentication device for user authentication in electronic financial transactions. In particular, in the case of an OTP device, a secure key management of a secret shared key between server and clients and a method for providing user convenience are required.

An object of the present invention is to overcome the disadvantages of the conventional user authentication apparatus and authentication method described above.

The present invention provides a user authentication device and an authentication method using a portable biometric information that can securely encrypt and manage a user's unique secret key value in real time based on a unique value obtained from a user's biometric information. It has a purpose to provide.

In addition, the user's convenience is provided by providing a means for securely and automatically inputting, generating, storing, managing, and registering a user's own primary key value from a user's biometric information remotely from an authentication device to a service server without a separate manual key input function. It has another object to provide a user authentication device and an authentication method using biometric information that can support the.

In order to achieve the above object, the user authentication device includes a biosensor (102, 502) for collecting the user's biometric information (101, 501); A central processing unit (104, 504) for controlling the entire authentication device, extracting features of the biometric information, and performing digitization; A security and authentication module (103, 503) for authenticating a user using feature points of the biometric information and generating an OTP or processing an electronic signature; Communication module units 105 and 505 for transmitting and receiving data with the host device; Program memories 106 and 506 storing encryption algorithms and operating programs; And storage units 107 and 507 for storing encrypted key values.

In addition, the user authentication method comprises: an authentication device setup step of initializing a user authentication device and registering a user by receiving biometric information of a user in real time, encoding the digital value, encrypting and storing it as an important user secret key value; An authentication device registration step of allowing a user to remotely register the set-up OTP authentication device to a service server of a financial institution through online; Characterized in that it comprises a; using the authentication device for performing an electronic financial transaction by remotely accessing the OTP authentication device registered in the service server through the registration step to the service server.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram showing the configuration of a user authentication device using portable biometric information according to the present invention.

As shown, the user authentication device 100 using the biometric information includes a biosensor 102 for collecting the biometric information 101 of the user, a central control unit for controlling the entire authentication device, extracting features of the biometric information, and performing digitization. A processing module 104, a security module unit 103 for authenticating a user using feature points of biometric information, generating an OTP, and performing encryption, a communication module unit 105 for transmitting and receiving data with a host device, an encryption algorithm and operation The program consists of a program memory 106 in which a program is stored and a storage unit 107 for storing encrypted key values.

In the present invention, a fingerprint recognition sensor is used as the biosensor 102, but in addition, a sensor for measuring various biometric information such as an iris or voice may be used. In addition, the communication module 105 for transmitting and receiving data may selectively use a wired or wireless USB module, Zigbee module, Bluetooth module, CDMA module, WiBro module, and the like.

As a preferred embodiment of the present invention, the operation of each component when the user authentication device 100 employing the USB module as the communication module 105 is used for electronic commerce after completing all the initial registration process As follows.

First, when the USB interface of the user authentication device 100 is inserted into a USB slot of a host device including a PC connected to the Internet, power is supplied from the host device to drive the user authentication device 100. At this time, if the fingerprint information, which is one of the user's biometric information 101, is input to the biometric sensor 102, the feature point of the biometric information is extracted by the central processing unit 104 and supplied to the security module 103 after digitization is performed. do. The security module unit 103 authenticates the authenticity of the user based on the digitized biometric information and generates an OTP value. The generated OTP value is transmitted to the host device through the communication module unit (USB interface) 105. In addition, it is continuously transmitted to the service server through the network connected to the host device to perform PKI-based e-commerce.

Here, it can be seen that the user authentication apparatus 100 according to the present invention is characterized in that the generated OTP value is automatically transmitted to the host device without being manually input by the user and transmitted to an external server.

In general terms, the main level of safety on the user side of an OTP authenticator (dongle, portable device) is the user's own secret key / code value to create a unique OTP value that is randomly generated at each use. It depends on how to manage, and all conventional OTP authentication device injects different unique values into the OTP authentication device at the time of manufacture. However, this is not only vulnerable to various hacking / cracking attacks, but also cannot be excluded from the case of the manufacturer's employee directly participating in the hacking. In the case of the existing OTP authentication device, the user can directly input the OTP generation value synchronized with the service organization by using the unique secret key and time information on the service page of the host device (PC, etc.), and the service. When the challenge value from the server was input to the OTP authentication device, the OTP value output by the OTP authentication device as the response value was manually input to the host device. In all of these cases, it was inevitable to provide a user with the inconvenience of having to repeatedly input six (or more) numbers of the OTP authentication apparatus. However, the OTP authentication device using the USB-based biometric information according to an embodiment of the present invention is an authentication for performing a financial transaction by automatically inputting an OTP value after the initial setup step and remote registration step of the first user OTP authentication device. Has a device usage level.

FIG. 2 is a flowchart illustrating an initial initialization and user registration procedure of the portable user authentication device of FIG. 1.

As shown, the user authentication apparatus 100 extracts a feature point from the user's biometric information, a protection master key generation step, a user master key generation step, an OTP generation secret key generation step, and a remote registration master. It can be divided into the key generation step.

First, the biometric feature point extraction step of the OTP authentication device will be described. First, the body part of the user is measured by the biometric sensor (S201), the biometric information is recognized from the output of the sensor (S202), the feature point of the biometric information is extracted from the recognized user biometric information (S203), and then a digital value is obtained. After conversion, the main feature points are recorded in the table (S204), and the processes from S201 to S204 are repeated a predetermined number of times (generally 2 to 4 times) to obtain key common digital feature values from the feature point list of S204 (S205). .

Next, perform the following procedure to create a protection master key value.

In the general authentication device, in order to securely manage the user secret key and the secret signing key value, the protected kit values are encrypted by inputting a password directly from the user or injecting a separate manufacturer's master key / code into the device itself. Manage (store) However, this is a problem raised by many experimenters and cryptographers so far that it can be easily leaked by an external active attack. So-called differential power analysis (DPA) attacks or dictionary attacks.

The present invention is characterized by extracting the user's biometric information in real time and encrypting various secret protection kit values with the digitized value, rather than using a user input password method or a device built-in master key, which are susceptible to attack. The key / code used for encrypting the above-mentioned protected kit values is defined as BK (Blinding Key) separately, and the generation of the master key for users and the secret key for OTP of the present invention uses BK, which is a protection master key. Do it.

 First, BK for encryption to protect the secret key for OTP generation by generating a hash value by connecting the unique serial value injected at the time of manufacturing the OTP authentication device and the digital value generated in S205. It is used as a value (S207). Here, the hash function used to generate the BK of S207 is merely an example of use, and the generation procedure may be implemented in various ways as in the above-described example.

When the BK value is calculated in S207 as described above, the hash value for this value is calculated to generate a master key for the user (S208), and the BK value is safely used to use it as a reference value for user authentication at each user login time. Encrypted data is used (S209), and the encrypted value is recorded in the storage unit 107 (S210).

In addition, the second hash value is calculated with reference to the value of S208 to generate a secret key for generating the OTP (211), and this value is actually used as the secret key required for generating the OTP, and is encrypted with the BK value of S207 for safe management. In operation S212, the OTP generation secret key is safely recorded in the storage unit.

In addition, the channel encryption master key of the OTP authentication device may be required for the safety of the registration of the remote OTP authentication device which will be described in the future. For this purpose, the hash value derived from the unique serial value of the OTP authentication device built in at the time of manufacture may be used. Can also be managed by storing (S220) as a master key value for remote registration.

As described above, when the user's OTP authentication device completes the initial (initialization) key setup at the time of issuing, the user can not only register the use of his OTP authentication device at the same time at the same time, but also remotely register it online via the Internet. This is possible.

3 is a flowchart illustrating a procedure in which a user registers an OTP authentication apparatus according to the present invention with a first related service server.

First, the user registration procedure of the OTP authentication device performs user authentication based on the biometric characteristic value for user authentication securely recorded / stored at the time of key setup of the first OTP authentication device (S350). That is, when the user authentication device is driven, user biometric information input is required. Accordingly, when the user biometric information is input, the feature point of the user biometric information is extracted in real time. A step of authenticating the authenticity of the user is performed by comparing the calculated and stored user biometric characteristic value. In this step, the user ID is transmitted from the user OTP authentication apparatus to the service server.

The next step is to request a response. In order to register a user, a secure encryption channel based on SSL and PKI is generally established between the host device on the user's side and the service server of the financial institution, and when a secure channel is formed, the service server attempts a random random challenge for user authentication. ) The value 'N' is generated and transmitted to the user host device with its own server ID securely.In addition, the user host device sends the ID of the service server to the OTP authentication device and responds to the random number attempt value 'N'. The generation of the value is requested (S351).

Next, as a secret key and master key calculation step, the OTP authentication apparatus performs the user biometric information-based authentication of S250 described above, and transmits the secret key value "TK" and the cipher for generating the OTP in advance from the biometric value. Compute the master key value "MK" for (S352).

In practice, registering an OTP of a user registers the above-mentioned "TK" value. The "MK" is used to verify the authenticity of a true OTP authenticator and secure transmission of the channel between the OTP authenticator and the host device and the service server. Pass it by encrypting it with a value. That is, encrypting the "TK" value using the "MK" value as a key is primarily for the safety of the channel to be handed over, and the decryption of the user information must be correctly performed on the second handed over device. It will be certified.

Here, S351 and S352 may be performed in a reversed order.

After that, as a basic response value calculation step, the OTP authentication apparatus calculates a hash value H: = Hash (ID _s , TK, N) with respect to the ID (ID _s ) and the random attempt value 'N' of the service server received from the host device. In order to securely transmit the calculated value, a value T: = Enc (TK; MK) encrypted with the master key “MK” extracted in S252 is calculated (S353).

The following is the registration authentication step of the OTP authentication device. When the calculated "H" and "T" and the response value "RS" that combines the service server ID (ID _s ) and the user ID (ID _u ) are transmitted to the host device, The device transmits to the service server through the PKI encryption channel already opened with the server, and the service server obtains the customer's OTP master key from the customer ID information in advance, calculates the "MK" value and sends it as a kit value. Calculate the result value "TK ^* " obtained from the decoding process from T ". Calculate the hash value "H ^* : = Hash (ID _s , TK ^* , N)" for the authentication check again using "TK ^* " and your ID value and compare it with the received "H" value. If = H ^*, TK is registered. Otherwise, registration is rejected to authenticate the OTP authentication device.

If the authentication is successful, the service server finally sends a completion response message to the OTP authentication device via the user host device, and the OTP authentication device receiving the received securely records / stores the internally registered service server ID. By performing the step S354, service server registration of the OTP authentication apparatus is completed.

Next, as described above, after the user's OTP authentication device has completed both the initial key setup step and the registration step for the service server, the OTP authentication device using the portable biometric information of the present invention can be easily used.

4 is a flowchart illustrating a procedure performed between devices in the case of using an OTP authentication device registered in advance in a service server according to the present invention.

As shown, the OTP authentication apparatus according to the present invention can perform a challenge and response (Challenge & Response) authentication process at the time of use, the authentication and authentication method of the challenge and response method is as follows.

First of all, the user authentication step using biometric information is performed. In order to receive OTP authentication at the time of login completion or log-in after the user connects to the service server to receive his or her electronic financial transaction service, the user detects his / her biometric information on the user's OTP authentication device. In step S471, the OTP authentication apparatus authenticates the biometric information of the user using the value of S208 of FIG. 2 that has been calculated and stored in the initial setup step of FIG. 2 (S472).

When the biometric authentication procedure is successfully passed, a secret key recovery step is performed. In the initial setup step, the encrypted stored code value (S210 in FIG. 2) is decrypted (S473), and the protection master kit value BK (S207 in FIG. 2). The secret key "TK" for generating the OTP is extracted by generating (S474).

Meanwhile, the service server transmits the server ID and the random challenge value “N” to the user host device (S475). The user host device transmits the server ID and the random attempt value “N” received from the service server to the OTP authentication apparatus. In step S476, an authentication response request step for requesting a response value is transmitted.

Finally, the OTP authentication apparatus uses the OTP-generated secret key "TK" calculated above, the received server ID, and the random attempt value "N" as a response value "R" as shown in the embodiment "R: = Hash ( ID _s , N, TK) "and outputs and transmits the response value to the user host device together with its ID value.

In a subsequent final authentication step, the service server which has loaded the OTP-generated secret key "TK ^* " of the already registered user OTP authentication apparatus (S478) and received the "R" and "ID _u " values through the host device, Compute the hash value "R ^* : = Hash (ID _s , N, TK ^* )" using the same procedure as the OTP authentication device (S480) and compare the value "R ^* " with the response value "R" received from the user. Finally, authenticity of the authentication device is authenticated (S481).

5 shows a configuration of a user authentication device in which a hardware security module (HSM) is built, which is another embodiment of the present invention.

As shown, the HSM-based user authentication apparatus 500 using the biometric information has a configuration similar to that of the OTP authentication apparatus 100. That is, the biometric sensor 502 collects the biometric information 501 of the user, a central processing unit 504 that controls the entire authentication device, extracts the features of the biometric information, and performs digitization, and includes the biometric sensor ( Authentication and signature processing unit 503 for performing encryption and authentication using the biometric information received from the 502, the communication module unit 505 for data transmission and reception with the host device, the program memory 106 that stores the encryption algorithm and operating program The storage unit 507 stores encrypted key values and an input / output I / O unit 508 exchanging data with an external device.

In addition, although the present invention shows an example of using the fingerprint sensor as the biometric sensor 502, various biometric information such as iris and voice may be used. In addition, the communication module 505 for communication with the host device may be selectively used, such as a USB module, Zigbee module, Bluetooth module, CDMA module, WiBro module.

When the HSM-based user authentication apparatus 500 employing the USB module as the interface module 505 is actually used for electronic commerce after completing all initial registration processes, the operation of each component will be described below.

First, when the USB interface of the user authentication device 500 is inserted into a USB slot of a host device including a PC connected to the Internet, power is supplied from the host device to drive the user authentication device 500. In this case, when the fingerprint information, which is one of the user's biometric information 501, is input to the biometric sensor 502, the feature point of the biometric information is extracted by the central processing unit 504, and the digitization is performed to the authentication and signature processing unit 503. Supplied. The authentication and signature processing unit 503 authenticates the authenticity of the user based on the digitized biometric information, generates a protection master device, decrypts the private key value, and uses the generated private key as the digital signature key value. An electronic signature is performed on the signature target data input from the outside through the O unit 508.

A user authentication device based on HSM, which is another embodiment of the present invention, will be described with respect to BK generation, PKI signature key generation, and storage procedures required for initial key setup of the authentication device. In addition, the following describes a procedure for extracting a user's authentication, a signature key, and generating a signature value at the time of using a user authentication device based on an actual HSM.

6 is a flowchart illustrating a flow of setting an initial key value of an authentication device based on a public key or a private key according to another embodiment of the present invention.

As shown in the figure, for the initial key setup step of the HSM-based user authentication apparatus 500, user biometric information is received and recognized as shown in S601 and S602, and the user's feature points are extracted from the biometric information and converted into digital values. By converting (S603) and recording the values in the feature point list table (S604), the processes from S601 to S604 are repeated a predetermined number of times (generally 2 to 4 times) to generate the main common digital feature values from the feature point list of S604. (S605).

A user authentication device based on this HSM generally sets a unique serial value of the device at the time of manufacture (S620), and takes a hash value by concatenating the unique serial value with the value of S605 to protect a secret key or the like. Calculating a protection master key (BK) for encryption of the signing key. Here, the hash function used to generate the BK is just an example, and the creation procedure can be implemented in various ways. For example, a value obtained by encrypting a B value generated in S605 with a unique serial value prepared in S620 as a kit value (that is, Enc (B; S)) may be used (S607).

Once the BK is generated through the above-described S607, the user authentication device 500 generates a user's digital signature key (personal secret signature key: = K_prv) and a public key corresponding thereto (S630). After registering the public key (K_pub) for the private secret digital signature key with the public certification authority (server) through the city input / output I / O unit, and receiving an electronic certificate (S631), the K_prv generated in S607 and B_ created in S607 The encryption is performed using the kit value (S608), and finally, the private key and the official certificate encrypted with the body information are safely recorded and stored in the internal storage unit 507 (S640).

On the other hand, in order to use the user authentication device as a basic data for fast and secure authentication when determining whether the user is the true owner at the time of using the user authentication device as his authentication key in the future, the main biometric characteristic point data of S605 is In addition, a data storage step for authenticating the body information which is securely recorded in the internal storage unit 507 is performed as a result value calculated using a hash function or a cryptographic function.

Now, when the user actually uses the authentication device that has completed the initial key setup through the procedure as shown in FIG. 6, a process of extracting the user's authentication processing procedure and the digital signature key and performing the electronic signature on the data requested through the input / output I / O unit is performed. I will explain.

7 is a flowchart illustrating a process of performing a user authentication and an electronic signature by an HSM-based user authentication apparatus in actual use.

As shown, once the user connects the authentication device to a host device (eg, PC, laptop, etc.) (USB or Zigbee, etc.) and the user authentication device is driven, user biometric information input is required. The main feature point B of the user biometric information is extracted in real time through the procedure of S705 (S705).

Subsequently, a comparison value (here, a hash value) is calculated through a processing function such as S609 of FIG. 6 (S764), and compared with a value previously calculated and safely stored (the value of S650 of FIG. 6) at the time of initial authentication device key setup. Done. By comparing such biometric data, if the registered value matches the value measured in real time, the user is authenticated as a real user and proceeds to the next process. Otherwise, the user authentication step outputs the authentication failure guide value and returns to the process of S201. Is performed (S771).

If the user authentication is successfully performed by the above procedure and the target data (: = D) to be digitally signed through the input / output I / O unit is input, the user authentication device uses the value of S705 and the unique serial value prepared in S780. To generate a protection master key BK value (for example, BK: = Hash (S, B)) (S707).

Thereafter, during the initial setup, the electronically encrypted private secret signature key value K_prv is extracted by decrypting the securely stored value EK through S608 (S766). Using the digital signature kit value, the digital signature value for the digital signature target data D first received by the authentication and signature processing unit is calculated, and the digital signature value (Signature: = Sign (D; K_prv) is also obtained through the input / output I / O unit. , Cert_K) is output (S767).

According to the above method, the absolute secret key value of the user is not simply a secret code stored in the authentication device or a simple password input from the user, but is input from the user in real time to authenticate the user and simultaneously generate a BK from the user. It can be said to be much safer than previous key management methods.

In conclusion, the features of the present invention are summarized as follows.

1) Receives the user's biometric information in real time, encodes it into a digital value, and uses it as a code value for encrypting, storing and managing important user secret kit values, and using this value as a secret key for generating a user's own OTP value in an OTP authentication device. .

2) During the initial setup of the authentication device, the user's biometric information is converted into a code value in digital form through several repeated inputs, and instead of receiving a password from the user, other key data in the authentication device is encrypted and It is used as the kit value to decode.

3) Generate a response value using a hash function or a cryptographic function corresponding to the random number attempt value through input / output I / O in real time based on the biometric information sensed by the user when the OTP value is generated as one of the user authentication means in the authentication device. box.

4) A unique secret digital signature kit value (Private Key) or other fixed secret encryption / decryption kit value of the user in a PKI-type HSM authentication device is generated by receiving the user's biometric information in real time. Encrypted and managed securely.

5) An OTP value (Response value) created by the OTP authentication device in a challenge & response manner through the USB and other short-range wireless communication interfaces between the OTP authentication device and its host device when configuring the OTP authentication device as a means for user authentication. Send system directly and securely directly from the module installed in the OTP authentication device without the user inputting directly to the host device.

6) When configuring an OTP authentication device for user authentication, the user's biometric information is directly collected without using a fixed master key injected or derived at a separate manufacturing time to generate a user's own OTP value inside the authentication device. Sense and generate an OTP value based on the digitized code value.

As described above, in the detailed description of the present invention, specific embodiments have been described, but various modifications are possible without departing from the scope of the present invention. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be defined by the claims below and equivalents thereof.

As described above, the user authentication device using the biometric information according to the present invention is a user authentication device or an OTP authentication device including a PKI-based HSM module, and recognizes the user's biometric information and restores the main secret kit values in real time. By using as a protection master key that does not require the built-in password, it is easy to carry and has the effect of implementing a secure authentication device.

In addition, the user biometric information securely manages the OTP master key, generates the OTP value, and tamper-proof to secure external software and physical infringement that must be securely managed in the secret key-based HSM. This function has the effect of managing the secret key and signature key using user biometric information to have the function.In the case of OTP authentication device, OTP authentication is easy and safe without the hassle of directly inputting user-generated random OTP value to host device. Automatically input the generated value to the service page of the host device, it is also possible to maximize the user's convenience.

Claims (11)

An authentication apparatus for performing electronic authentication of a user in an online electronic financial transaction, Biometric sensors 102 and 502 for collecting biometric information 101 and 501 of a user; A central processing unit (104, 504) for controlling the entire authentication device, extracting features of the biometric information, and performing digitization; A security and authentication module (103, 503) for authenticating a user using feature points of the biometric information and generating an OTP or processing an electronic signature; Communication module units 105 and 505 for transmitting and receiving data with the host device; Program memories 106 and 506 storing encryption algorithms and operating programs; And Storage units 107 and 507 for storing encrypted key values; User authentication device using biometric information, characterized in that consisting of. The method of claim 1, And the user authentication device further includes an input / output I / O unit for exchanging data with an external device to enable input / output of data for electronic payment signature.  The method of claim 1, The biometric sensor is a user authentication device using biometric information, characterized in that one of the sensor selected from the fingerprint sensor, iris sensor, voice recognition sensor. The method of claim 1, The communication module unit is a user authentication device using a biometric information, characterized in that for using a single module selected from a wired or wireless USB module, Zigbee module, Bluetooth module, CDMA module, WiBro module. In a method of authenticating a user using an authentication device for electronic authentication of a user in an online electronic financial transaction, An authentication apparatus setup step of initializing a user authentication apparatus and registering a user by encrypting and storing the biometric information of the user in real time and encoding the digital value into an important user secret key value; An authentication device registration step of allowing a user to remotely register the set-up OTP authentication device to a service server of a financial institution through online; A step of using an authentication device for performing an electronic financial transaction by remotely accessing an OTP authentication device registered in a service server through the registration step; User authentication method using biometric information, characterized in that the point made. The method of claim 5, wherein the authentication device setup step, A biometric information point extraction step of recognizing biometric information from an output of the biometric information sensor and obtaining common digital feature values by repeating a feature point of the biometric information a predetermined number of times from the recognized user biometric information; Generating a protection master key for encrypting a secret key by connecting a unique serial value of the OTP authentication apparatus and the digital feature value to take a hash value; Calculating a hash value for the protection master key value, and generating and storing the hash value by encrypting the hash value using the protection master key value; Generating a second hash value with reference to the hash value, and generating an OTP secret key for encrypting and storing the second hash value using the protection master key value; And Generating a master key for remote registration encrypting and storing a hash value derived from a unique serial value of an OTP authentication device using the protection master key value; User authentication method using biometric information, characterized in that the made made. The method of claim 5, wherein the authentication device registration step, Authenticating the user by receiving the user biometric information and comparing a value extracted from the feature point of the biometric information in real time with a user biometric information value calculated and stored at the time of initial key setup of the OTP authentication apparatus; Forming an encryption channel between a host device of a user side and a service server of a financial institution, and requesting generation of a response value from the OTP authentication apparatus by transmitting an ID and a random number attempt value of the service server through the channel;  A secret key and master key calculating step of calculating a secret key for generating an OTP and a master key for remote registration using the biometric value after performing user authentication based on the biometric value; A basic response value calculation step of the OTP authentication apparatus generating a hash value for the ID of the service server, the secret key value for generating the OTP and the random trial value, and encrypting the secret key value for generating the OTP with the master key for remote registration; The basic response value and a response value combining the service server ID and the user ID are transmitted to the service server through an encryption channel, and the service server calculates a hash value for authentication check from the customer ID information and the response value, and receives the received basic value. A registration authentication step of the OTP authentication device for determining whether to authenticate the user by comparing the hash value of the response value calculation step with the hash value for the authentication check; And If the authentication is successful in the authentication step of the OTP authentication device, the service server transmits a completion response message and stores the registered service server ID in the OTP authentication device; User authentication method using biometric information, characterized in that the made made. The method of claim 5, wherein the authentication device using step, Authenticating a user by providing biometric information to a user OTP authentication apparatus after accessing a service server and extracting feature points of the biometric information in real time; A secret key recovery step of decrypting the encrypted master key stored in the initial setup step and generating a protection master key to extract an OTP generation secret key; A response request step for requesting a response while transmitting an ID and a random number attempt value of the service server to the OTP authentication apparatus; A response value transfer step of an OTP authentication apparatus calculating a response value using the OTP-generated secret key, the received server ID, and a random challenge value, and outputting the response value to a host device; And A final authentication step of the service server loading the OTP-generated secret key of the user OTP authentication device, receiving the response value and the user ID, calculating an authentication hash value, and comparing the received response value with the received response value to authenticate the authentication device; User authentication method using biometric information, characterized in that the made made. A method for authenticating a user using an authentication device for electronic authentication or electronic payment signature for a user in an online electronic financial transaction, An authentication apparatus setup step of initializing a user authentication apparatus and registering a user by encrypting and storing the biometric information of the user in real time and encoding the digital value into an important user secret key value; Using an authentication device by remotely accessing an HSM-based authentication device with an authentication key embedded in a service server through the authentication device setup step; User authentication method using biometric information, characterized in that the made made. The method of claim 9, wherein the authentication device setup step, A biometric information point extraction step of recognizing biometric information from an output of the biometric information sensor and obtaining common digital feature values by repeating a feature point of the biometric information a predetermined number of times from the recognized user biometric information; Generating a protection master key for encrypting a secret key by taking a hash value by connecting a unique serial value of the user authentication device and the digital feature value; After creating the user's digital signature private key and the corresponding public key, register the public key for the private key with the public certification authority, receive an electronic certificate, encrypt the digital signature private key with the protection master key, and finally Storing a private key encrypted with body information and a public certificate in a user authentication device; And A body information authentication data storing step of calculating the biometric information points using a hash function or a cryptographic function and storing the biometric information points in a user authentication device; User authentication method using biometric information, characterized in that the made made. The method of claim 9, wherein the using of the authentication device comprises: Remotely accessing a user authentication device to a service server and providing biometric information to the user authentication device to extract a feature point of the biometric information in real time; A user authentication step of determining whether the user is a true user by calculating the biometric characteristic point using a hash function or an encryption function, and comparing the calculated value with the body information authentication data stored at the time of initial authentication device setup; Generating a protection master key using the biometric information point and a unique serial value when the target data to be digitally signed is input; And An electronic signature step of extracting an electronic signature key value by decrypting the encrypted private key upon initial setup, calculating an electronic signature value for the electronic signature target data using the electronic signature key value, and outputting the digital signature value to an input / output I / O unit; User authentication method using biometric information, characterized in that the made made.

Images