KR20190138396A - Creating method for decentralized biometric One-time-password - Google Patents

Abstract

The present invention relates to a method for generating a one-time password (OTP) using decentralized biometric data, which may generate an OTP using biometric data stored in a decentralized way or validate an OTP, thereby providing enhanced security.

Description

Creation method for decentralized biometric One-time-password}

The present invention can provide enhanced security that can generate or validate a one-time-password (OTP) using biometric data stored in a decentralized way. It relates to a one-time password generation method using distributed biometric data.

Related technologies of the present invention include those disclosed in detail in Korean Patent Application Publication No. 10-1284481 ("Authentication method and apparatus using one-time password including bio-image information") to which the applicant of the present invention has applied for a patent. In addition, this paper proposes a method to maintain security on blockchain by applying decentralized method and blockchain technology.

Republic of Korea Patent Publication No. 10-1284481

The problem to be solved by the present invention is to use the user's biometric data (biometric data) on the blockchain (blockchain) of the digital identity (digital identity), such as a private key made using the user's biometric data (physical) It provides a more secure identity authentication method because it provides a way to link with identity.

The identity authentication method according to the present invention has several advantages as follows.

First, enhanced security. The user's private key can be completely removed after generating the public key associated with it, and can be regenerated after a biometric verification at a necessary time.

Therefore, you can fundamentally prevent the risk of hacking caused by keeping your private key somewhere.

Second, the guarantee of undeniable transactions. The user must perform biometric authentication before making any transaction on the blockchain. Depending on the result of the certification, the transaction may be approved or rejected.

Third, support for KYC (know-your-customer) and AML (anti-money-laundering) applications. Since digital identity information is associated with actual identity information, a user's identity authentication function can be provided to a service provider.

Fourth, the possibility of enabling universal identity. In the real world, there are various ID management systems in different countries, so the identity of one user cannot be authenticated in another country. However, the method according to the invention has the beneficial effect of being able to identify anywhere in the world.

Solution to Problem The present invention provides a method for generating a one-time password using decentralized biometric data. Applying a function to apply the hash value (H) as a one-time password, wherein the two components consist of a registered biometric data collected from the biometric data collection device and a unique key of the device assigned to the biometric data collection device; To provide a one-time password generation method using decentralized biometric data.

Another solution of the present invention is that the biometric data collection device for generating a one-time password is one of a biometric dedicated sensor, camera and scanner connected to a host device including a smartphone, tablet and PC Or, to provide a one-time password generation method using a distributed biometric data consisting of one or more of the biometric dedicated sensor, camera and scanner integrated into the smartphone and tablet.

Another solution of the present invention is that the hash value obtained by applying the hash function hash (x) is H ₁ , which is the first hash value, which is hash (registered biodata + device's unique key), which is derived from H ₁ . Any new hash value, H _k Is H _k = hash (H _{k -1} ), and k = 2 to n, and pre-specifies the number n of hash values to be obtained in advance, and finally the hash value H _n Is stored in at least one node of the plurality of nodes on the server or blockchain, H _n Is generated, the remaining hash values H _{n -1} , H _{n -2} ,... To provide a one-time password generation method using decentralized biometric data, including removing H ₂ and H ₁ .

In another aspect of the present invention, there is provided a registration biometric data used to create the first generated hash value H ₁ , comprising: dividing the intact registration biometric data into two or more portions; Encrypting two or more divided biometric data with a unique key of a biometric data collection device and storing the biometric data in two or more nodes on a blockchain constituting a blockchain; And to enhance the security to provide a one-time password generation method using the decentralized biometric data comprising the step of removing the complete registered biometric data.

According to another aspect of the present invention, in order to obtain intact registered biometric data, retrieving two or more distributed and stored biometric data using a biometric data collection device, and decrypting encrypted portions. The present invention provides a method for generating a one-time password using distributed biometric data, comprising the steps of: reconstructing the entire registered biometric data by combining the distributed portions.

According to another aspect of the present invention, the hash value H _{n -c} derived from the first hash value H ₁ is used as a valid one-time password in the order in which the user requests the one-time password. Means that the order of the provided transaction is c-th, and the sum of the dispersed parts is restored to the intact registered biometric data, and for authentication of the user using the same device used to collect the registered biometric data. And collecting biometric data, and matching to compare intact registered biometric data with authentication biometric data, and if the matching result is found to be the same as the genuine, the restored registered biometric data and device. Regenerating the first hash value H ₁ from the unique key of, returns the hash value H _{n -c} from the hash value H ₁ . It is to provide a one-time password generation method using decentralized biometric data comprising the step of generating again.

In addition to solving means of the further object of the present invention to verify the hash value H _{n -c,} the H _n derived from the hash value H, and _n, H ₁ is stored in at least one of the plurality of nodes on the server or block chain The number of times the value of c is one-time password provided by the total number of n values and a user request, the hash value generated until the store has been obtained and the node on the management server or a chain block, a hash function for H _{n -c} C The hash value created by applying it twice is H _n If it is equal to and the hash value to provide a one-time password generation method using a decentralized biometric data comprising the step of determining that it is valid.

In another aspect of the present invention, the newly collected registration biometric data in the step of opening a user's account is divided into two or more parts; And encrypting two or more divided biometric data with a unique key of the biometric data collection device and storing the biometric data in a node on a blockchain.

According to another aspect of the present invention, a newly collected registered biometric data is divided into two or more portions at a user's account opening, and the biometric data is divided into two or more unique keys of the biometric data collection device. The present invention provides a method for generating a one-time password using decentralized biometric data, which includes encrypting and storing the biometric data collection device.

According to another aspect of the present invention, there is provided a method in which a newly collected registered biometric data is divided into two or more parts in a step of newly opening a user account; And encrypting the biomaterials divided into two or more parts without encryption or using a unique key of the biodata collection device and storing them as a file on a computer or printing the barcodes on paper. It is to provide a one-time password generation method.

The problem to be solved by the present invention is to use a user's biometric data (physical data), such as a personal key (or one-time password) created using the user's biometric data on a blockchain (physical identity) As it provides a method of associating with the physical identity of the user, there is an increased effect of providing a more secure identity authentication method.

The identity authentication method according to the present invention has several advantages as follows.

First, the user's private key (or one-time password) can be completely removed after generating the public key associated with it, and then regenerated in a biometric verification process when needed. ) Can be provided.

Thus, you can fundamentally avoid the risk of hacking by keeping your private key (or one-time password) somewhere.

Second, the guarantee of undeniable transactions. The user must perform biometric authentication before making any transaction on the blockchain. Depending on the result of the certification, the transaction may be approved or rejected.

Third, since digital identity information is linked with actual identity information, it can provide a user's identity authentication function to a service provider, so it is a field of know-your-customer (KYC) and anti-money-laundering (AML) applications. There is an elevated effect to support.

Fourth, the possibility of enabling universal identity. In the real world, there are various ID management systems for each country, so that the identity of one user cannot be authenticated in another country. However, the method according to the invention has the beneficial effect of being able to identify anywhere in the world.

1 illustrates a process of generating a one time password (OTP) from registered biometric data and a device unique key.
Figure 2 shows the process of regenerating the first OTP.
FIG. 3 illustrates a process of obtaining a second OTP by applying the first OTP to a hash function, and in the same manner, obtaining the next OTP by applying the obtained OTP to the hash function again.
4 illustrates a process of generating a total of N OTPs from the first OTP, storing the last Nth OTP on a server or blockchain, and removing all remaining OTPs.
FIG. 5 illustrates a process of generating an "NC" th OTP from the total number N values of OTPs generated and the C values of the current OTP order.

It looks at the specific content for practicing the present invention.

In Patent Application Publication No. 10-1284481, which is filed and filed by the present applicant, a hash function (algorithm) is used for the registration of a user's registered biometric data and a biometric device. The hash value is obtained from a combination of unique device keys.

1 illustrates a process of generating a one-time password OTP (16 of FIG. 1) from biometric data.

Specifically, a hash value is obtained by applying a hash function to a combination of registered biometric data collected from the biometric data collection device (11 in FIG. 1) and a unique key of the corresponding device, and the hash value obtained is the first one-time password (Figure 1). Of 16). An iris image (12 of FIG. 1) is obtained by using the biological data collecting device (11 of FIG. 1), and an iris template (13 of FIG. 1) is obtained based on the obtained iris image.

A one-time password (16 in FIG. 1) is obtained by applying a hash function to the combination of the iris template and the unique key (15 in FIG. 1) of the biodata collection device (11 in FIG. 1).

Figure 2 shows the process of regenerating the first one-time password.

Specifically, the first one-time password (FIG. 1) is restored by applying a hash function to a combination of unique keys of the same biodata collecting device (11 in FIG. 1) used to recover the distributed stored biometric data and collecting the registered biometric data. Can be regenerated.

FIG. 3 illustrates a process of obtaining a second one-time password by applying the first one-time password to a hash function, and applying the obtained one-time password to the hash function again in the same manner.

A total number N of one-time passwords can be specified in advance, and a total of N one-time passwords can be generated in this manner.

4 illustrates a process of generating a total of N one-time passwords from the first one-time password, storing the last N one-time passwords on the server or blockchain, and removing all remaining one-time passwords.

FIG. 5 illustrates a process of generating a "N-C" th one-time password from a total number N of times a one-time password is generated and a value of C which is a current one-time password.

Specifically, after recovering the enrollment biometric data, obtaining the unique device key of the biometric data collection device, the first from the combination of the restored registered biometric data and the unique key of the biometric data collection device. A one-time password may be generated, and a "NC" th one-time password may be generated from the generated one-time password.

The following describes the process of obtaining a hash value in detail using a hash function.

A hash function is used to obtain a hash value from a combination of user registration biometric data and a unique device key of a biometric device.

The method of obtaining a new hash value by applying the obtained hash value to the same hash function again is described in Korean Patent Application Publication No. 10-1284481. Repeating this process yields several hash values derived from the original hash values.

In other words, when the first generated hash value is applied to the hash function hash (x), if "H ₁ = hash (Registration biodata + device's unique key)", the new hash values derived from H ₁ are "H _k ". = hash (H _{k -1} ), where k = 2 to n ".

The number n of hash values to be retrieved can be specified in advance, and the final hash value H _n is stored in the server. The remaining hash values H _n-1 , H _n-2 ,... H ₂ and H ₁ are safely stored inside the biological data collection device.

This hash value H stored inside the device is used as a one time password (OTP) in the reverse order it was created.

That is, H _{n -1} is used as the first one-time password OTP, and then, in order, such as H _{n -2} and H _{n -3} .

When the server receives H _{n -c} from the device, it means that it is the cth used OTP. To check if this is valid, apply the same hash function c times to H _{n -c} and use the hash value "H ^~ = hash. (hash (… hash (H _{n -c} ))) ", and if H ^~ is equal to H _n stored in the server, it can be determined as a valid one-time password (OTP).

In the present invention, the hash values H _{n -1} , H _{n -2} ,... H ₂ , H ₁ is completely removed once H _n is generated, suggesting how to maximize security. Meanwhile, H _n is delivered to the server or node on the blockchain for storage. There are a plurality of nodes on the blockchain.

The present invention, unlike the method of the prior prior art, H _{n -1} , H _{n -2,.} Instead of storing H ₂ , H ₁ somewhere, divide the registered biometric data into two or more different parts and store them in a node on a server or blockchain, and then retrieve all the partitioned parts later when needed. Reconstruct the original registered biometric data and use it to generate H _nc .

At this time, prior to generating H _{n -c} , a matching is performed between the restored registered biometric data and the biometric data for authentication of a newly collected user in the field by using the same biodata collection device that collected it. Only when the matching result is determined to be the same (genuine), the process of generating H _nc continues.

A method of storing a user's registered biometric data in a decentralized way is as follows.

The newly collected registration biometric data is divided into two or more parts during the opening of the user's account. The methods are as follows.

First, encrypt two or more parts with a unique key of a biometric data collection device and store them in a node on the blockchain,

Second, encrypting two or more portions with a unique key of the biometric data collection device and storing it securely inside the biometric data collection device,

Third, without encryption or two or more portions are encrypted with a unique key of the biodata collection device and then stored as a file on a computer or printed in barcode form on paper.

The process of generating a one-time password in the present invention is as follows.

First, all parts of the divided registration biometric data are recovered, the encrypted portions are decrypted, and the divided portions are summed and restored into intact registered biological data.

Second, the user collects new biometric data for authentication in the field using the same biometric data collection device that collected the registered biometric data. Then, if two biometric data are matched and the result is determined to be the same, the first hash value H ₁ is generated using the registered biometric data and the unique key of the device, and the number of times required for the same hash function is obtained. H _{n -c} , which is the final hash value, is obtained and used as a valid one-time password (OTP) of the transaction. The c value means that the order of transactions for providing a one time password is c th.

Third, the obtained one-time password (OTP) H _{n -c} is H _n It is sent to the location, the validation procedure (validation) proceeds by the method specified in the prior patent registration No. 10-1284481.

Look at another various embodiments of the present invention.

A method for generating a one time password using decentralized biometric data, the method comprising: obtaining a hash value (H) by applying a hash function to a combination of the following two components to generate a one time password; And applying the hash function to apply the hash value (H) as a one-time password.

The two components consist of registered biometric data collected from the biometric data collection device and unique keys of the device assigned to the biometric data collection device.

The biometric data collection device for generating a one-time password may be one of a biometric dedicated sensor, camera and scanner connected to a host device, including a smartphone, tablet and PC, or the interior of the smartphone and tablet. It may be configured with one or more of a biometric dedicated sensor, camera and scanner integrated in the.

The hash value obtained by applying the hash function hash (x) is H _{1, which} is the first hash value, which is hash (registered biodata + device's unique key), and H _{k is} an arbitrary new hash value derived from H ₁ . Is H _k = hash (H _{k -1} ), and k = 2 to n, and specifies the number of hash values n to be obtained in advance, and specifies the hash value H _n finally obtained. Is stored on the server or node on the blockchain, H _n Is generated, the remaining hash values H _{n -1} , H _{n -2} ,... Removing H ₂ , H ₁ .

The registration biometric data used to generate the first generated hash value H ₁ is divided into two or more parts of the intact registration biometric data, and encrypted after the two or more divided biometric data are encrypted with a unique key of the biometric data collection device. Storing them in the nodes on the blockchain constituting the blockchain and removing intact registered biometric data for enhanced security.

In order to obtain intact registered biometric data, retrieving two or more distributed and stored portions, decrypting the encrypted portions, and reconstructing the dispersed portions into intact registered biometric data Steps.

According to the order in which the user requests a one-time password, the hash value H _{n -c} derived from the original hash value H ₁ is used as a valid one-time password, where c is the sequence of transactions that provide the one-time password. Means second.

Reconstructing the dispersed portions into intact registered biometric data, and collecting biometric data for authentication of a user using the same device used to collect the registered biometric data, Matching to compare the biometric data with the biometric data for authentication.

If the match is found to be genuine, regenerating the first hash value H ₁ from the restored registered biometrics and the device's unique key, regenerating the hash value H _{n -c} from the hash value H ₁ . Includes steps

The H _n derived from the hash value H, and _n, H ₁ is stored in the nodes on the server or block chain to verify the hash value H _{n -c} The total number n of hash values generated up to this value and the value c, which is the number of times a one-time password has been provided by the user's request, are stored and managed in a node on the server or blockchain.

The hash value generated by applying the hash function C times for H _{n -c} is H _n If equal to, the hash value includes acknowledging that it is valid.

The newly collected registered biometric data is divided into two or more parts during the opening of the user's account and the node on the blockchain after encrypting the two or more divided biometric data with a unique key of the biometric data collection device. Storing in the.

The newly collected registration biometric data is divided into two or more parts during the opening of the user's account, and the biometric data is encrypted into the biometric data collection device by encrypting the biometric data divided into two or more parts. Storing.

The newly gathered registered biometric data in the opening of the user's account is divided into two or more parts and the encryption is performed on the computer after encryption of the divided biometric data with the unique key of the biometric data collection device. Saving as a file or printing in a bar code form on paper and storing.

General techniques known to those skilled in the art for generating and applying a one-time password using a hash function are described in detail in Patent Registration No. 10-1284481 filed and registered by the applicant of the present invention. The technical composition related to the technical task of the paper was described.

The present invention can provide enhanced security that can generate or validate a one-time-password (OTP) using biometric data stored in a decentralized way. Since it provides a one-time password generation method using distributed biometric data, it is highly applicable to the industry because the security can be much improved.

11; Biological data collection device
12; Iris image acquired by biological data collection device
13; Iris template from iris image
14; Unique key of the device assigned to the biological data collection device
15; Hash function
16; One Time Password (OTP)

Claims (10)

In the one-time password generation method using decentralized biometric data,
Obtaining a hash value (H) by applying a hash function to a combination of the following two components to generate a one-time password; And
Applying the hash function to apply a hash value (H) as a one-time password,
The two components are
Registered biometric data collected from the biometric data collection device;
A one-time password generation method using distributed biometric data, characterized in that consisting of the unique key of the device assigned to the biological data collection device. The method according to claim 1,
The biometric data collection device for generating a one-time password is one of a biometric dedicated sensor, camera and scanner connected to a host device including a smartphone, tablet and PC,
Or one-time password generation method using a distributed biometric data, characterized in that consisting of one or more of the biometric authentication sensor, camera and scanner integrated into the smartphone and tablet. The method according to claim 1,
The hash value obtained by applying the hash function (hash (x)) is
The first hash value H ₁ is
hash (registered biometric data + device's unique key),
Any new hash value derived from H ₁ , H _k ,
H _k = hash (H _k-1 ), k = 2 to n,
Pre-specify the number n of hash values to obtain in advance,
Save the last hash value H _n to the node on the server or blockchain,
After H _n is generated, the remaining hash values H _n-1 , H _n-2 ,... Method for generating a one-time password using decentralized biometric data comprising the step of completely removing H ₂ , H ₁ . The method according to claim 3,
The biometric data used to create the first generated hash value H ₁ is
Dividing the intact registered biomaterial into two or more portions;
Encrypting two or more portions with a unique key of the biodata collection device and storing the two or more portions in a node on the blockchain constituting the blockchain; And
Method for generating a one-time password using a distributed biometric data, characterized in that for removing security intact registration biometric data comprising the step of removing. The method according to claim 4,
To obtain intact registration biometric data,
Retrieving all of the two or more distributed stored portions;
Decrypting the encrypted portions; And
A method for generating a one-time password using distributed biometric data, comprising: reconstructing the entire registered biometric data by adding the distributed portions. The method according to any one of claims 3 to 5,
In the order in which the user requests a one-time password, the hash value H _nc derived from the original hash value H ₁ is used as a valid one-time password.
Reconstructing the scattered portions into intact registered biometric data,
Collecting biometric data for authentication of a user using the same device as used to collect registered biometric data,
Matching to compare intact registered biometric data with authentication biometric data,
If the match is found to be the same as the genuine, regenerating the first hash value H ₁ from the restored registered biometric data and the device's unique key,
Regenerating the hash value H _nc from the hash value H ₁ ,
The c value is a one-time password generation method using a distributed biometric data, characterized in that the order of the transaction (transaction) providing a one-time password. The method according to claim 6,
The H _n derived from the hash value H _n, and H ₁ is stored in the nodes on the server or block chain to verify the hash value H _{n -c} The value n of the total number of hash values generated up to this value and the number c of the number of one-time passwords provided by the user's request are stored and managed in at least one node on the server or blockchain.
The hash value generated by applying the hash function c times for H _{n -c} is H _n If the same as the hash value is a one-time password generation method using distributed biometric data, characterized in that it is recognized as valid. The method according to claim 1,
Dividing the newly collected registered biometric data into two or more parts in the process of opening a new user account; And
A method for generating a one-time password using distributed biometric data, characterized in that two or more pieces of biometric data are encrypted with a unique key of a biometric data collection device and stored in a node on a blockchain. The method according to claim 1,
In the process of newly opening a user's account, newly collected registration biometric data is divided into two or more parts; And
Method for generating a one-time password using a distributed biometric data characterized in that the two or more divided biometric data is encrypted with a unique key of the biometric data collection device and stored in the biometric data collection device. The method according to claim 1,
In the process of newly opening a user's account, newly collected registration biometric data is divided into two or more parts; And
A method for generating a one-time password using distributed biometric data, characterized in that two or more parts are encrypted with a unique key of a biometric data collecting device and then stored as a file on a computer or printed as a bar code on paper.

Images