KR20140029067A - Methods and apparatus for electronically identifying personal identity - Google Patents

Abstract

The present invention relates to an electronic identity verification device that satisfies essential security requirements, such as confidentiality, authentication, integrity, etc., and selects only the items requiring personal information of the user from among a plurality of identity information items, and then selects the selected identity on the user terminal. Identity information confirmation item setting unit for confirming whether or not to agree to the provision of personal information corresponding to the information item; An authentication arbitration unit for arbitrating authentication between the external server storing the user's personal information and the user terminal when receiving a consent to receive from the user terminal; and receiving a one-time volatile URI from the external server when the authentication is completed, And a personal information receiver configured to receive, receive, and display on the screen personal information corresponding to the selected identity information item based on URI information.

Description

Electronic identification device and method {Methods and Apparatus for electronically identifying personal identity}

The present invention relates to a secure electronic identity verification apparatus and method for requesting only the information required for identification by the electronic identity verifier, and provides only the information specified by the user of the user terminal to the person requesting identity verification.

Existing IDs (resident registration card, driver's license, passport, etc.) recorded the main information of the ID card on the surface in human readable form. The information recorded on these IDs can cause serious damage if they are leaked to the outside with sensitive personal information such as name, gender, date of birth, address, and photo.

However, on-line and off-line identification differs in the information that must be exposed in some cases. For example, if you are buying alcoholic beverages or buying tobacco at a store, it is sufficient to only check for ages 19 and over.However, if you create an account and withdraw money from a bank, additional verification such as name and social security number may be required. . However, current identification based on identification has the problem of exposing the main information such as name, gender, date of birth, address, and photo at the same time.

In order to solve these problems, the introduction of the electronic resident registration card (Patent No. 1999-0012099 "User Identification Method Using the Electronic Resident Card", etc.) is being promoted. There is a risk that all the information can be leaked, especially if the security system of the card is broken there is a problem that personal information can be leaked by a contactless reader.

For example, contactless smart cards are vulnerable to eavesdropping by wireless communication, and the problem of eavesdropping and hacking in smart cards is that the hacking of Mifare RFID card widely used as a public transportation card in Korea is reported in the news. I can see the seriousness. In addition, since hacking cases such as electronic passports and similar electronic ID cards are already well known, this type of electronic ID card has proved that its safety cannot be sufficiently secured.

The technical problem to be solved by the present invention is to provide an electronic identity verification apparatus and method having a high security by providing an electronic identity verifier that meets the essential security requirements such as confidentiality, authentication, integrity.

In order to solve the above technical problem, an electronic identification device according to an embodiment of the present invention includes a confirmation item input and output unit for transmitting a plurality of information items related to user identification to the user terminal; A provision item input / output unit configured to receive a provision item selected by the terminal based on the plurality of information items and transmit the received provision item to an external server managing a plurality of personal information; And a personal information receiver configured to receive personal information of the user corresponding to the provided item from the external server.

According to another preferred embodiment of the present invention, the electronic identity verification apparatus selects only items requiring personal information of the user from among a plurality of identity information items, and then provides the personal information corresponding to the selected identity information items to the user terminal. Identity information confirmation item setting unit for confirming whether to agree; An authentication mediation unit for arbitrating authentication between the external server storing the user's personal information and the user terminal when receiving the intention of consent from the user terminal; and receiving the disposable volatile URI from the external server when the authentication is completed. And a personal information receiver configured to receive, receive, and display on the screen personal information corresponding to the selected identity information item based on the URI information.

Electronic identification method according to an embodiment of the present invention comprises the steps of transmitting a plurality of information items relating to the user identification to the user terminal; Receiving a selected offer item from the terminal based on the plurality of information items and transmitting the selected offer item to an external server managing a plurality of personal information; And receiving the personal information of the user corresponding to the provided item from the external server.

According to the present invention, since the electronic identity checker performs only simple transfer of the user's personal information from the user terminal to the external server managing the personal information, the problem of exposing the main information of the individual through the electronic identity checker can be solved. In addition, problems such as MITM and wireless section eavesdropping can be solved.

In addition, since the electronic identity checker does not hold personal information in the user's terminal as a preferred embodiment of the present invention, even if the terminal is lost and transferred to the malicious hacker, the hacker cannot grasp the personal information. Accordingly, the present invention can maintain high security by providing essential security requirements such as confidentiality, authentication, integrity, nonrepudiation, etc. in identity verification.

1A is a diagram illustrating an embodiment of an electronic identity verification system according to the present invention.
Figure 1b is a view showing a configuration in which the authentication server and the DB server as an embodiment of the electronic identity verification system according to the present invention.
2 is a view showing a screen in which an identification process is performed in an electronic identification device and a user terminal according to the present invention.
3 is a block diagram showing the configuration of a user terminal according to the present invention.
4A and 4B are block diagrams showing the configuration of the electronic identity checker according to the present invention.
5 is a block diagram showing the configuration of an external server according to the present invention.
6A, 6B and 6C are flowcharts illustrating an electronic identity verification method according to an embodiment of the present invention.
7 is a flowchart illustrating a method of electronic identity verification through a DB server according to an embodiment of the present invention.
8 is a flowchart illustrating an electronic ID payment procedure using an EAP-TLS authentication procedure in an active electronic identity checker according to an embodiment of the present invention.
9 is a preferred embodiment of the present invention, the EAP-Request (Identity), EAP-Response (Identity), EAP-Success (Identity) of the existing EAP protocol by modifying the EAP-TLS type electronic identity card as shown in Table 2 The procedure for performing authentication and authentication is shown.
FIG. 10 shows a simplified flowchart of an electronic ID authentication and authentication procedure based on EAP-AKA among various EAP-based authentication protocols.
FIG. 11 is a flowchart illustrating a case where an authentication rejection occurs while authenticating an electronic ID using the EAP-AKA method.
12 shows a procedure of confirming actual identification information using information such as MSK, which is additionally generated information when the electronic identification providing server and the electronic identification card authentication period EAP-AKA authentication method are followed.
FIG. 13 illustrates an embodiment of performing authentication between the electronic ID providing server 400 and the electronic ID checker 200 to enhance security with the electronic ID checker.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. 1A is a schematic diagram of an electronic identity verification system according to the present invention.

Referring to FIG. 1A, the electronic identity verification system of the present invention includes a user terminal 100, an electronic identity checker 200, and an external server 300.

In FIG. 1A, the user terminal 100 is implemented to mount a Universal Subscriber Identity Module (USIM) card mainly used for a smartphone, and the like, based on the NFC (Near Field Communication) included in the USIM card. Communication is possible. Detailed functions of the user terminal 100 will be described with reference to FIG. 3.

For example, if the user terminal 100 uses an electronic identity card employing NFC, NFC-based electronic identity checker 200 can also be configured to install the application software required for the smartphone employing NFC, The electronic identity checker 200 communicates with the electronic ID by NFC, verifies the actual electronic ID, performs authentication, and informs the authentication result of the external server 300 which communicates with a smartphone through various wired and wireless networks. It is possible to implement to perform

The electronic identity checker 200 performs authentication by verifying the electronic identity card, and when the authentication is completed, receives the corresponding information from the external server 300 and displays it to the user.

The electronic identity checker 200 should be able to receive the information from the server and display it to the user when the authentication for the electronic identity card is completed. To this end, the electronic identity checker 200 is implemented to enable the connection with the user identification information providing server 300 after completion of the authentication or separately configured electronic identification card authentication server.

As shown in FIG. 1, the electronic identity checker 200 may be implemented by installing applications (eg, electronic identification APP, see FIG. 2) in various terminals such as a smartphone, a handheld device, a notebook computer, and the like. .

Referring to FIG. 2, the electronic identity checker 200 may include a button for input by a user, a control button, and the like, and display information on an identification result through a display. The identity verification result displays information such as the user's name, social security number, photo, address, and gender.

In this case, the user input device such as a button may be replaced with buttons in a touch screen display device that receives input from a screen display device, and replaced with a functional device that enables input of necessary information by various other means (PC connection, etc.). Can be.

In addition, the electronic identity checker 200 may be equipped with a short-range communication module, a long-distance communication module, and the like, and a person having ordinary knowledge in the field to which the present invention belongs, such as a central processing unit, an input / output device, a storage device, and an OS. It can contain basic modules that can be implemented.

The electronic identity checker 200 may perform real-time authentication processing with the external server 300 through a telecommunication module, and display information provided by the external server 300 on the display of the electronic identity checker 200. Can be. Other detailed configurations of the electronic identity checker 200 refer to FIGS. 4A and 4B.

1B is a schematic diagram of an electronic identity verification system in which an authentication server 301 and a DB server 303 are separated according to an embodiment of the present invention.

Referring to FIG. 1B, the electronic identity verification system of the present invention includes a user terminal 100, an electronic identity checker 200, an authentication server 301, and a DB server 303.

The authentication server 301 informs the DB server 303 that the authentication is completed when the authentication for the user terminal 100 is completed, and the DB server 303 is a URI (Uniform Resource) corresponding to DB location information with personal information. Identifier) may be generated and provided to the electronic identity checker 200. Accordingly, the electronic identity checker 200 accesses the URI corresponding to the DB location information, receives the personal information from the DB server, and displays the received personal information on the screen display device of the electronic identity checker 200 to verify the identity. You can complete

The external server (FIG. 1,300) to the authentication server 301 performs authentication based on the identification code of the user terminal 100, and when the authentication for the user terminal 100 is completed, the personal identity to the electronic identity checker 200 Send DB location information with information. At this time, according to an embodiment of the present invention, the external server 300 may encrypt the DB location information with the session key information necessary for encryption and provide it to the electronic identity checker 200.

The authentication procedure of the user terminal 100 may utilize a unique identification code that can distinguish the user terminal 100. The identification code of the user terminal 100 may use a value that can be changed at any time.

The authentication server 301 must separately manage the personal information of the identity provider corresponding to the identification code of the user terminal 100 securely, and when the authentication of the identification code is completed, it is determined that the authentication of the user terminal 100 is completed. Providing personal information to the electronic identity checker 200.

As one preferred embodiment of the present invention, in order to verify an electronic identity card, security requirements such as confidentiality, authentication, and integrity must be satisfied. To this end, the electronic identification system should provide a very high level of authentication. However, the authentication level can be determined according to the importance of the user.

For example, there may be a difference in security level between providing sensitive information such as social security number, and providing only a general date of birth, and depending on necessity, may use the authentication process used in internet banking or 3G network. You can use authentication methods such as AKA in use at However, it is practically difficult for the active electronic identity checker 200 to perform various functions like a PC.

Therefore, in the present invention, an EAP-TLS authentication procedure using a certificate between a terminal and an authentication server for network access authentication, or various authentication methods such as AKA and SIM of GMS used in 3G can be utilized to use an efficient and flexible method. Use the method you have. For this, see FIGS. 8 to 13.

 2 illustrates a screen in which an identity verification procedure is performed in the user terminal 100 and the electronic identity checker 200 according to an embodiment of the present invention.

The user of the electronic identity checker (FIGS. 1 and 200) selects an item necessary for identity verification from the items displayed on the screen of the electronic identity checker (FIGS. 1 and 200) (103). The user terminal (FIGS. 1 and 100) displays the name of the electronic identity checker (FIGS. 1 and 200) and the requested item on the screen of the user terminal (FIGS. 1 and 100), and asks the user to provide personal information about the item. A screen that can be determined is displayed (105). If the user agrees to provide personal information on the item, the user terminal (FIGS. 1 and 100) performs authentication by an external server (FIGS. 1 and 300) via the electronic identity checker (FIGS. 1 and 200). Done.

When the authentication of the user terminal is completed, the electronic identity checker (FIGS. 1 and 200) receives personal information from an external server (FIGS. 1 and 300), and when the identification is completed, the electronic identity checker (FIGS. 1 and 200) is identified. The display device of the electronic identity checker (FIGS. 1 and 200) indicates that the verification is completed normally (107).

The electronic identity checker should be able to verify the identity information from the authenticated server or from an external server. To this end, the electronic identity checker displays the received information based on the URI information received from an external server or an authentication server.In this case, when a request is made to a URI, the external server verifies it based on information such as a session key. Upon completion, the information is sent to the electronic identity checker. In this case, the URI used uses a volatile URI that can be used only once and is discarded immediately after the use is completed. In addition, the external server or certificate server should log the URI request if any and provide the service based on the information.

Specifically, in order to perform authentication of the electronic identity checker, unique identification value information such as IMEI (International Mobile Equipment Identity) or IMSI (International Mobile Subscriber Identity) of the electronic identity checker should be used. Must be encrypted with the secret key of the electronic identity checker and recorded on the server.

To this end, a preferred embodiment of the present invention uses a unique identification key value (eg, Identity) that can distinguish an active credit card for authentication in the authentication procedure.

The authentication server must separately manage the information of the identity provider corresponding to the identity and securely. When the authentication of the identity is completed, the authentication server must determine that the authentication of the identity provider is completed and process the information so that it can be provided. Therefore, the identity itself has no problem even when exposed to the outside, and can be implemented as a value that can be transmitted in a wireless section.

3 is a block diagram schematically showing the internal configuration of the user terminal 100 according to an embodiment of the present invention.

Referring to FIG. 3, the user terminal 100 of the present invention includes a confirmation request input unit 110, a terminal authentication unit 120, and a public item transmission unit 130.

The confirmation request input unit 110 receives a confirmation item required for identification from the electronic identity checker 200, and from the user of the user of the user terminal 100, the item to be disclosed among the check items requested by the electronic identity checker 200 from the user. It receives the input and transmits it to the electronic identity checker 200.

Referring to FIG. 2, when the electronic identity checker 200 requests information by checking a name, gender, date of birth, and a picture required for identification, a user using a user terminal may request personal information on the item. Input and transmit to the electronic identity checker 200.

The terminal authentication unit 120 performs authentication of the user terminal 100 using the external server 300. The disclosure item transmitting unit 130 transmits an item of personal information to be disclosed to the external server 300 when the authentication of the user terminal 100 is completed in the terminal authentication unit 120.

4A is a block diagram schematically illustrating a configuration of an electronic identity checker 200 according to an embodiment of the present invention.

Referring to FIG. 4A, the electronic identity checker 200 of the present invention includes an identity information check item setting unit 210, an authentication arbitration unit 220, and a personal information receiving unit 230.

The identity information verification item setting unit 210 receives the verification items required for identity verification from the user of the electronic identity checker 200.

The method of receiving identification information required for identification in the identification information confirmation item setting unit 210 includes a plurality of identification information items (for example, name, gender, date of birth, age, and photo as shown in FIG. 2). , Social security number, address) can select only items that require user's personal information.

Depending on the needs of the electronic identity checker 200, the verification items required for identity verification may vary. Referring to FIG. 2, only a name and a phone number may be selected as confirmation items required for identification, or a name, a phone number, an address, a social security number, or the like may be selected.

The identity information confirmation item setting unit 210 receives the confirmation item required for identity verification from the electronic identity checker 200 as described above, and then includes a user terminal 100 containing an electronic identity card of a person who wants to perform identity verification. Ask whether or not to agree to the provision of personal information corresponding to the identity information check item, and can receive the consent to agree.

Upon receipt of the consent from the user terminal 100, the authentication arbitration unit 220 mediates authentication between the user terminal 100 and the external server 300. For specific embodiments of mediating authentication in the authentication arbitration unit 220, see FIGS. 8 to 13.

When the authentication is successfully completed between the user terminal 100 and the external server 300, the personal information receiver 230 is the personal information of the identity information check item agreed to be disclosed by the user terminal 100 from the external server 300 Receive The received personal information is displayed on the screen display device of the electronic identity checker 200, it is possible to confirm the identity.

In another embodiment, when the electronic identity checker 200 receives the DB location information from an external server or a DB server (FIGS. 1B and 303), the electronic identity checker 200 accesses the DB location information and connects to the DB server or the DB server (FIG. 1B). 303), the personal information according to the disclosure item is received.

In another embodiment of the present invention, the electronic identity checker 200 as well as the user terminal 100 may be implemented as a method for enhancing security.

The electronic identity checker 200 creates an OTP (One Time Password) based on its IMEI or IMSI value, and hashes it by including an OTP value in a key value used when sending a message to an external server 300. can send. Through this, the electronic identity checker 200 may receive personal information of the user of the user terminal 100 only when the external server 300 is authenticated.

Figure 4b shows a block diagram of an electronic identity checker 200 according to an embodiment of the present invention.

Referring to FIG. 4B, the electronic identity checker 200 of the present invention includes a user screen 201, a user input device 203, a short range communication module 205, and a telecommunication module 207.

The electronic identity checker 200 has a user screen 201 to display information on the identity verification result. The user screen 201 may be replaced by linkage to various screen display devices such as a PC or a smartphone. In addition, the electronic identity checker 200 may have a user input device 203 such as a control button.

According to an embodiment of the present invention, the user input device 203 may be replaced with buttons of a touch screen display device that receives an input through the user screen 201, and may be necessary by various other means (PC connection, etc.). It can be replaced by a functional device that allows input of information.

The electronic identity checker 200 also has a telecommunication module 207 to perform interworking with the external server 300, to perform real-time authentication processing based on the network, and to provide information provided by the external server 300. Displayed on the screen, so that multimedia data such as pictures can be received from the external server (300).

As the telecommunication module 207, a representative PSTN telephone network or a wired internet network such as xDSL or FTTx may be used. (E.g. accessing the AP via WiFi, using xDSL as a backhaul, etc.). The electronic identity checker 200 may include a short range communication module 205 and may perform a short range communication with the user terminal 100 to support actual identity verification.

5 is a block diagram schematically showing an internal configuration of an external server 300 according to an embodiment of the present invention.

Referring to FIG. 5, the external server 120 of the present invention includes an authentication server 301 and a DB server 303, and the authentication server 301 includes a user terminal authentication unit 310 and a public item receiving unit 320. The DB server 303 includes a transmission item receiver 330 and a personal information transmitter 350.

The user terminal authentication unit 310 performs authentication on the user terminal 100, and when the authentication is completed, the public item receiver 320 receives a personal information disclosure item from the user terminal 100. The public item receiver 320 transmits the received personal information disclosure item to the transmission item receiver 303 of the DB server 303, and the personal information transmitter 350 of the DB server 303 corresponds to the received public item. The DB location information is transmitted to the electronic identity checker 200.

6A is a flowchart illustrating an electronic identity verification method in an electronic identity verification system according to an embodiment of the present invention.

The electronic identity checker 200 receives a confirmation item of personal information from the user of the electronic identity checker 200 and transmits it to the user terminal 100 (601). (See Figures 2 and 103)

The user terminal 100 receives a disclosure item of the user personal information to be provided to the electronic identity checker 200 from the terminal user and transmits it to the electronic identity checker 200 (603). (See Figures 2 and 105)

The user terminal 100 transmits an identification code of the user terminal 100, requests the external server 300 to authenticate the user terminal 100 (605), the external server 300 of the user terminal 100 When the authentication is completed, the authentication completion signal is transmitted to the user terminal 100 (607).

When receiving the authentication completion signal of the external server 300, the user terminal 100 transmits a disclosure item of the user personal information to be provided to the electronic identity checker 200 to the external server 300 (609).

The external server 300 transmits the personal information stored in its DB server 303 to the electronic identity checker 200 (615).

The electronic identity checker 200 notifies the user terminal 100 that the electronic identity verification is completed (617) (see FIGS. 2 and 107).

6B is a flowchart illustrating an electronic identity verification method in an electronic identity verification system according to an embodiment of the present invention.

The electronic identity checker 200 receives a confirmation item of personal information to be confirmed from the user of the electronic identity checker 200 and transmits it to the user terminal 100 (601).

The user terminal 100 receives a disclosure item of user personal information to be provided to the electronic identity checker 200 from the user and transmits it to the external server 300 via the electronic identity checker 200 (602).

The user terminal 100 transmits an identification code of the user terminal 100, requests the external server 300 to authenticate the user terminal 100 (605), the external server 300 of the user terminal 100 If authentication is completed, the authentication completion signal is transmitted (607).

The external server 300 transmits the personal information corresponding to the disclosure item stored in its DB server 303 to the electronic identity checker 200 (615).

The electronic identity checker 200 notifies the user terminal 100 that the electronic identity verification is completed (617).

6C is a flowchart schematically illustrating a procedure of verifying an electronic identity using DB location information by an external server 120 according to an embodiment of the present invention. Up to the configuration for transmitting the disclosure item of the personal information to the external server 300 is omitted in the same manner as in the procedure in Figure 6a.

The external server 300 transmits DB location information with personal information corresponding to the disclosure item received from the user terminal 100 to the electronic identity checker 200 (611).

The electronic identity checker 200 receives the DB location information from the external server 300, accesses the corresponding DB location information (613) and receives personal information (615).

The electronic identity checker 200 notifies the user terminal 100 that the electronic identity verification is completed (617).

7 is a flowchart schematically illustrating an electronic identity authentication procedure when the authentication server 301 and the DB server 303 are separated in the electronic identity authentication system according to an embodiment of the present invention. The procedure up to authentication of the user terminal 100 is the same as that described in FIG. 6C and will be omitted.

When the user terminal 100 has completed authentication of the user terminal 100, the user terminal 100 transmits a disclosure item of personal information to the authentication server 301 (709), and the authentication server 301 checks the electronic identity to the DB server 303. The public item of the user personal information to be provided to the device 200 is transmitted to the DB server 303 (710).

The DB server 303 transmits DB location information indicating personal information corresponding to the disclosure item stored in its DB to the electronic identity checker 200 (711).

The electronic identity checker 200 receives DB location information of personal information from the DB server 303 and accesses the DB location information (713).

If the connection is normally completed, the DB server 303 transmits the information corresponding to the disclosure item of the personal information to the electronic identity checker 200 (715).

The electronic identity checker 200 notifies the user terminal 100 that the electronic identity verification is completed (717).

8 is a flowchart illustrating an electronic ID payment procedure using an EAP-TLS authentication procedure in an active electronic identity checker according to an embodiment of the present invention.

In an exemplary embodiment of the present invention, in order to determine information required for identification of the electronic ID card in addition to the authentication, additional information such as a name, a photo, a social security number, an address, a gender, and a date of birth may be used.

To this end, vendor-specific functionality can be used as a new message type in the EAP protocol defined in RFC3748, or a new type can be added.

In a preferred embodiment of the present invention, type 254 Expanded Type may be utilized as shown in Table 1. In addition, it should be noted that various extension methods such as adding a new type can be used and various modifications are possible.

Type Vendor ID Vendor Type Vendor Data 254 14008 257 Electronic ID verification request Request information such as name | gender | date of birth | resident registration number | address 254 14008 257 Electronic ID Verification Result Electronic ID URI

Referring to Figure 8 describes the electronic ID payment flow using the EAP-TLS authentication procedure in the active electronic identity checker as follows. The electronic identity checker, which has received the identification information, waits until communication with the electronic identity card is possible through the local area network, and when communication is enabled, sends an EAP-Start method from the electronic identity card (S810) and the electronic identity checker 200 The electronic ID authentication request message is sent in the EAP-Request message (S811). In this case, the electronic ID card receiving the EAP-Request notifies that the normal response is received by returning the requested information to the EAP-Response (S812).

The electronic identity checker 200 requests the electronic identity card using an EAP-Request (Identity) message so that the electronic identity authentication requested by the user is performed (S813), and then the process is secured by following the EAP-TLS authentication procedure. ID verification (S814 ~ S826). Thereafter, immediately before the end of the EAP-TLS authentication procedure, the electronic ID card piggybacks the information that the actual authentication result agrees to send to the electronic identity checker to the electronic identity checker by piggybacking the ACK message, which is the end message of the EAP-TLS (S826). The electronic identity checker 200 transmits the corresponding ACK message to the external authentication server 300 (S827). If the final authentication is successful, the external authentication server 300 processes the authentication based on the corresponding information, and transfers the electronic identity verification URI to the electronic identity checker 200 by putting the electronic identity verification URI in the EAP-Success message as a result of the processing (S828). . The electronic identity checker 200 did not grasp the meaning of the message in the middle, but interpreted the EAP-Success message (S829), bringing the actual identity information in conjunction with the URI of the message, the screen of the electronic identity checker 200 The identification number 107 of FIG. 2 is displayed to indicate that the normal authentication is performed (S830 and S831).

Since the authentication method can be variously supported depending on the local area network and the electronic ID, it is necessary to introduce a structure that can be used in all authentication methods. Therefore, it can be used in various authentication methods by piggybacking the electronic ID information in the EAP message shown in Table 2 below.

Code Type Type Data 0x01 Request 1 Identity Identity request information (name, social security number, etc.) piggyback 0x02 Response 1 Identity Identity request information piggyback on identity information 0x03 Success Identification URI information piggyback 0x04 Failure Failure code | piggyback failure reason information

9 is a preferred embodiment of the present invention, the EAP-Request (Identity), EAP-Response (Identity), EAP-Success (Identity) of the existing EAP protocol by modifying the EAP-TLS type electronic identity card as shown in Table 2 The procedure for performing authentication and authentication is shown.

The electronic identity card 100 sends an EAP-Start message to the electronic identity checker 200 (S910), and accordingly, the electronic identity checker 200 sends an EAP-Request (Identity) message to the electronic identity card to identify the payload. Piggyback and transmit the confirmation information (S911). The electronic ID received the message transmits an EAP-Response (Identity) message piggybacking identification information (S912), and this information is passed from the electronic identity checker 200 to the electronic ID authentication server (path-through). . The electronic ID authentication server 300 prepares to enable actual authentication by storing the information received by piggyback before performing the authentication procedure according to the identity (S913). After that, if the TLS authentication process is normally performed and all authentications are completed (S914 ~ S925), when the EAP-Success is notified to the electronic identity checker, a piggyback of the URI containing the identification information is sent so that the user can determine whether the authentication is normal. (S926), the electronic identity checker transmits an EAP-Success message to confirm whether or not the normal authentication on the electronic identification card (S927). If the authentication fails, the EAP-Failure message is used to send the failure code and the reason to the electronic identity checker. The electronic identity checker displays the reason on the display device so that the user can identify the failure reason. In addition, the message is transferred to the electronic ID card so that the identification of the failure of the electronic ID card is also possible.

For the security of such information for EAP-TLS authentication, the carrier may issue in advance in the form of OTA (Over The Air) in a smart phone or the like, and support for issuance in a separate offline form.

In addition, the EAP-TLS authentication method provides a similar level of certification in the accreditation process in Internet banking, but it is difficult to popularize due to the burden of mounting and managing the accreditation certificate on the electronic identity card. Therefore, the EAP-TTLS authentication method can be used in which only the server mounts the public certificate and the electronic ID does not use the public certificate. You can also use other authentication methods, such as EAP-AKA or EAP-SIM.

FIG. 10 shows a simplified flowchart of an electronic ID authentication and authentication procedure based on EAP-AKA among various EAP-based authentication protocols.

The AKA authentication method is a secure authentication method that provides mutual authentication between server and clients as a method used for authentication in an existing communication system. It is an authentication method using a shared secret of K and OPc, and the authentication procedure is possible based on the modified message of EAP-Request (Identity), EAP-Response (Identity), and EAP-Success as in FIG. Do.

Like the TLS authentication method, the important authentication information such as K and OPc used for authentication in the EAP-AKA-based authentication method should be impossible to inquire, input, and delete in the user terminal 100 in which the electronic ID is implemented. Security can be ensured only by performing operations necessary for the authentication procedure directly in the communication module (for example, NFC). If you do not use NFC and use short-range communication technology such as Zigbee or Bluetooth, you can perform authentication procedure in connection with USIM card, and use the same method as it performs SIM / AKA authentication supported by USIM card. Can be.

FIG. 11 is a flowchart illustrating a case where an authentication rejection occurs while authenticating an electronic ID using the EAP-AKA method.

When processing the electronic ID authentication, the user using the user terminal in which the electronic ID is implemented enters the verification request information into the electronic identity checker 200, and transmits the EAP-Start message when the electronic ID is set to enable the user to communicate. While entering the authentication process (S1100). After giving and receiving the identity (S1101 ~ S1103), and after completing the AKA authentication (S1104 ~ S1107), the electronic ID card authentication is completed because the authentication for the electronic ID card is performed to determine the authentication. In this case, authentication may be rejected if the authentication information is destroyed due to a loss report, or if the authentication method has not been sufficiently secured to provide the authentication verification information requested by the credit card authenticator. The electronic ID authentication server sends EAP-Failure, not EAP-Success, to the electronic identity checker to notify that the identity verification failed, and piggybacks the information such as the reason for failure and displays it on the screen of the electronic identity checker and the electronic identity card. Can be enabled (S1108, S1109).

12 illustrates a procedure of confirming actual identification information by using information such as MSK, which is additionally generated information when the electronic identification providing server and the electronic identification card authentication period EAP-AKA are authenticated.

8 to 11 and some other drawings are illustrated on the assumption that the electronic identity providing server and the electronic identification card authentication server are implemented as one server for the convenience of description. In FIG. 12, the electronic identification providing server and the electronic identification card are illustrated. It shows a specific embodiment implemented separately by the authentication server.

The electronic identity providing server and the electronic identity authentication server may be generally installed to be installed in the same place and utilize devices such as the same firewall. However, in the present invention, even if the two servers exist in different locations, a mutual VPN (Virtual Private Network) Or even if the secure channel is provided and services through the HTTPS or the like does not cause a problem.

Referring to Figure 12, in another preferred embodiment of the present invention discloses a new authentication procedure between the electronic identity checker 200 and the electronic identity providing server. The electronic identity checker must authenticate through a separate authentication procedure when accessing the URI of the electronic identity verification server. For the requesting URI, a method of signing a URI request with the electronic key of the electronic identity checker or a method of signing a URI request using a pre-shared key should be adopted. Before identification, it should be implemented to be interlocked with the electronic identification server. In addition, the verification of the information request must be performed through the session key generated by EAP mutual authentication in every electronic identity verification case.

In detail, after performing the EAP-AKA authentication (S1200), if the authentication is successfully completed, the electronic identification card authentication server 300 has been authenticated to the electronic identity providing server 400 server, the information requested by the electronic identification card (100) (For example, name, photo, gender, date of birth) transmits a notification to provide authentication information (S1210).

In addition, when the electronic identity checker 200 receives the EAP-Success message, the URI piggybacked to the message is called in a secure communication method of HTTPS, but the URI information cannot be grasped from the outside, but since it is processed through the public network, the random attempt is made. In order to prevent unauthorized calls, the value generated by MSK is sent to KEY as authentication information. It is impossible to send MSK directly because it is traffic through public network, and the value used as KEY to verify whether it is an electronic identity checker with access authority of the URI can be implemented in various forms. According to the embodiment, it is possible to implement to send a POST message in the form of a POST message or a cookie in https: // URI with the additional information of the hashed MSK as SHA-1 in the URI sent from the authentication server (S1220).

The electronic identity providing server 400 verifies whether the corresponding KEY value matches the value received from the electronic identity certificate server by checking the additional incoming KEY value with respect to the URI requested to the electronic identity, and if it matches the value Sends the confirmation information (S1230). In this case, the electronic identity verification information transmitted from the electronic identity providing server 400 to the electronic identity checker 200 may be implemented to include multimedia information such as photographs, information in the form of images, information in the form of a business card, or XML. Information can be provided in other languages such as / HTML.

In this case, however, it should be noted that if a user accesses a new URI for information such as a photo from a URI sent from the electronic ID checker, the URI must also be the same volatile URI, and the information must be used only once. The information used must be destroyed immediately and authentication by KEY value should be performed.

The electronic identity checker 200 having received the electronic identification information is displayed on the screen based on the information to enable identification. For example, when a picture is received, the picture is displayed on the screen, and information such as date of birth may be configured and displayed.

The electronic identification server 400 should destroy the volatile URI immediately after generating the URI and providing it to the electronic identity checker 200. If not, the information may be re-requested using the information once verified by the electronic identity checker 200, and thus may be vulnerable to a replay attack. In addition, when authentication is completed to respond to a replay attack, when the electronic identification card authentication server 300 provides the EAP-Success to the electronic identity checker 200, a hint for generating a sequence may be provided. You can create a sequence based on the hint and respond to a replay attack. In addition, when providing information to the electronic identity checker 200, the main information should be encrypted with a pre-shared key. For example, since the MSK is known, the information can be encrypted using the MSK. By recording the information of the electronic identity checker 200 that requested the information through a technique such as a digital water mark on the multimedia data such as a photograph, If additional information exposure occurs, it should be possible to trace back that information.

As another preferred embodiment of the present invention, in order to further enhance security, the electronic identity providing server 400 generates an OTP (One Time Password) based on the IMEI or IMSI value of the electronic identity checker 200. And, in addition to the MSK in the KEY value used when transmitting a message from the electronic identity checker 200 to the electronic identity providing server 400 may be sent by hashing the OTP value. By using this method, the identification information between the electronic ID card 100 and the electronic ID card authentication server 300 as well as the information of the electronic ID card 100 are additionally checked in order to call the URI. Authentication can also be performed.

In principle, the e-identity provision server should discard the URI if the call is successful or fail, but if OTP is used, an error may occur due to the time difference between each end. You can increase the number of failed authentication attempts from one to a certain number of times. For example, N can be 3, and 3 is a commonly used number of retries for common password entry failures.

FIG. 13 illustrates an embodiment of performing authentication between the electronic ID providing server 400 and the electronic ID checker 200 to enhance security with the electronic ID checker. The electronic identity checker 200 must perform authentication with the electronic identity providing server in advance based on a value such as a TLS certificate or a pre-shared key that it has before requesting verification of its electronic identity (S1300). ), Based on the MSK generated as a result of the authentication, secure channel between the mutual systems can be created, and key information such as IMEI or IMSI can be provided to the electronic identity authenticator to enable more secure electronic identity verification. To this end, the electronic identity checker 200 may perform authentication such as EAP-AKA or EAP-TLS to the electronic identity providing server 400, and utilizes a general AKA / SIM / TLS authentication procedure other than EAP. Authentication may be provided through a separate authentication means.

FIG. 13 illustrates an EAP-AKA-based authentication procedure commonly used in 3G mobile phones as an example of EAP-AKA-based authentication. In this embodiment, EAP-AKA authentication is performed directly between an electronic identity authenticator and an electronic identity verification server. For example. Therefore, since the authenticator from the standard is not included, the TLS authentication procedure using a standard protocol such as HTTPS can be utilized.

After authenticating the electronic identity checker 200 in this way, the electronic identity providing server can safely provide information about the request of the electronic identity checker 200. The procedure for pre-authenticating the electronic identity checker 200 is a method suitable for a system installed to perform a large amount of authentication rather than a system for temporarily performing one-time authentication, and an electronic identity checker 200 for performing one-time authentication. ) May also require the ability to reject the request if a certain number of frequent calls occur.

In addition, to further enhance security, the authentication procedure of the OTP and the electronic identity checker 200 may be used simultaneously, and an additional security function may be added as necessary.

The present invention has proposed a structure capable of electronic ID authentication using various EAP authentication methods as described above. In the electronic identity checker 200, the electronic identity authentication server 300 is linked to use the EAP, but should use a separate protocol such as RADIUS or DIAMETER. The proposed method is applicable to both RADIUS and DIAMETER, and if there are other ways to use EAP, it can be used as well.

The present invention can also be embodied as computer-readable codes on a computer-readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like, and also in the form of a display by a carrier wave (for example, transmission over the Internet). It includes what is implemented. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

So far I looked at the center of the preferred embodiment for the present invention. Those skilled in the art will appreciate that the present invention can be implemented in a modified form without departing from the essential features of the present invention. Therefore, the disclosed embodiments should be considered in an illustrative rather than a restrictive sense. The items of the present invention are shown in the claims rather than the foregoing description, and all differences within the equivalent items will be construed as being included in the present invention.

Claims (9)

An identity information confirmation item setting unit for checking whether the user terminal agrees to provide personal information corresponding to the selected identity information item after selecting only an item requiring user's personal information among a plurality of identity information items;
An authentication mediation unit for arbitrating authentication between an external server storing the user's personal information and the user terminal when receiving the intention of consent from the user terminal; and
Receiving a one-time volatile URI from the external server when the authentication is completed, the personal information receiving unit for receiving and displaying on the screen the personal information corresponding to the selected identity information item based on the URI information; Electronic identity verification device comprising a. The method of claim 1, wherein the authentication arbitration unit
It may be implemented to use a different authentication method according to the security strength of the user's personal information, wherein the authentication method includes an EAP-TLS authentication method, EAP-TTLS method, EAP-AKA method, EAP-SIM method Electronic identity verification device. According to claim 1, wherein in the personal information receiving unit
In order to receive and display personal information corresponding to the selected identity information item on the screen based on the URI information, an International Mobile Equipment Identity (IMEI) or an International Mobile Subscriber Identity (IMSI), which is identification value information of an electronic identification device, is displayed. Authenticate the electronic identity verification device, and when the authentication is completed, the external server stores a log indicating that the electronic identity verification device receives personal information corresponding to the selected identity information item. Device. The method of claim 1, wherein the authentication arbitration unit
Electronic identity verification device, characterized in that for using the identity of the electronic identification card implemented in the user terminal for authentication. The method of claim 1, wherein the identification information confirmation item setting unit
Electronic identification device, characterized in that for performing short-range communication with the user terminal. The method of claim 3, wherein the personal information receiving unit
Generating an OTP using the identification value information of the electronic identification device with respect to the URI, and permitting the electronic identification device to access the external server using the URI only during the time when the generated OTP is maintained. Electronic identification device, characterized in that. The method of claim 1, wherein the external server
And a DB server for storing authentication information and a user's personal information. In this case, the authentication arbitration unit arbitrates authentication between the user terminal and the authentication server, and the personal information receiver receives the URI from the authentication server. Receiving the personal information corresponding to the selected identity information item to the DB server based on the received URI. The method of claim 4, wherein the authentication arbitration unit
If the identity of the electronic ID card is inappropriate or the authentication fails, the electronic identity verification device for receiving the authentication failure reason from the external server and transmits to the user terminal. Selecting only items in which the user's personal information is required among the plurality of identity information items in the electronic identity verification device;
A message transmitting step of confirming whether the electronic identification device agrees to provide personal information corresponding to the selected identity information item to a user terminal;
Mediating authentication between an external server storing the user's personal information and the user terminal when receiving a consent to consent from the user terminal;
Receiving a disposable volatile URI from the external server when authentication is completed between the external server and the user terminal;
Requesting and receiving the personal information corresponding to the selected identity information item from the external server based on the received URI information, and displaying the received personal information on the screen of the electronic identity verification device. How to identify yourself at

Images