KR20200054571A - Apparatus and method for performing non-face-to-face identification using a bio-certificate - Google Patents

Abstract

The present invention relates to a method for identifying a user online in a non-face-to-face manner by issuing a bio-certificate related to bio information of a user and utilizing the bio-certificate. The method comprises the steps of: generating a bio-certificate; registering the generated bio-certificate in a fast identity online (FIDO) server; transmitting a FIDO identification response message; and verifying the FIDO identification response message and receiving a verification result.

Description

Apparatus and method for performing non-face-to-face identification using a bio-certificate}

The present invention relates to a method for issuing a bio certificate using a user's fixed bio key information and a user authentication method based on the bio certificate.

Bio authentication technology is being used in various fields based on convenience and security superior to existing authentication methods. In particular, as FIDO (Fast IDentity Online) authentication technology was introduced in 2015, the introduction of online bio-authentication technology is increasing. In addition, as user authentication technology develops, the boundary between online and offline services is gradually disappearing, and recently, with the launch of an Internet specialized bank, research and necessity for non-face-to-face identity verification technologies have been emphasized.

Current non-face-to-face identity verification technology is a complex structure that handles authentication by combining various methods such as video calling, identification card transmission, and cell phone identity verification.

Therefore, there is a need for a non-face-to-face identity verification method that can be performed through a simple procedure.

An object of the present invention is to issue a bio certificate associated with a user's bio information, and to present a method for authenticating a user online using the bio certificate.

An object of the present invention is to provide a non-face-to-face identity verification method and apparatus useful for preventing and managing leakage of a secret key, as it can be regenerated each time without storing the secret key value for public key authentication.

An object of the present invention is to provide a security effect similar to the act of contrasting a picture of a user's face and identification card offline even online.

An object of the present invention is to provide an existing non-face-to-face identity verification authentication method and a simplified identity verification authentication method.

The technical problems to be achieved in the present invention are not limited to the technical problems mentioned above, and other technical problems that are not mentioned will be clearly understood by those skilled in the art from the following description. Will be able to.

According to an embodiment of the present invention, it is possible to provide a method and apparatus for performing face-to-face identity verification using a user's bio-certificate.

At this time, the method and apparatus for performing non-personal identification using the user's bio-certificate generate a public key pair based on the user's bio-key, generate a bio-certificate based on the public key pair, and generate the Register a bio-certificate to a Fast IDentity Online (FIDO) server, send an electronically signed FIDO authentication response message according to the authentication request of the FIDO server, and send the electronically signed FIDO authentication response message based on the registered bio-certificate. Verify and receive the verification result.

In addition, when there is an authentication request from the FIDO server, after confirming the user's bio-key, the public key pair is regenerated based on the bio-key, and the FIDO authentication response message is a secret key generated from the re-generated public key. Can be digitally signed.

Since the present invention generates a public key pair using fixed bio key information extracted from the user's bio information, it can have an effect of preventing proxy signatures.

The present invention has an effect that can be utilized as an online face-to-face identification technology.

In addition, since it is a structure that registers a bio certificate and authenticates a user based on the bio certificate based on the FIDO authentication system, which is currently used as a user authentication technology that is widely used online, it is highly efficient in terms of technology application and operation, and also recognizes the user in the bio Using technology, it is possible to simplify the current non-face-to-face authentication method and procedure.

The effects obtainable in the present invention are not limited to the above-mentioned effects, and other effects not mentioned may be clearly understood by those skilled in the art from the following description. will be.

1 is a view showing a non-face-to-face identity verification system using a bio certificate according to an embodiment of the present invention.
2 is a view showing a module constituting a FIDO authentication apparatus according to an embodiment of the present invention.
3 is a view showing a module constituting a bio-key management apparatus according to an embodiment of the present invention.
4 is a flowchart of a method for generating and registering a bio-certificate of a non-face-to-face identity verification device using a bio-certificate according to an embodiment of the present invention.
5 is a flowchart of a method for a non-face-to-face identity verification apparatus using a bio-certificate according to an embodiment of the present invention to identify a face-to-face identity.
6 is a diagram illustrating a flow of generating and installing a bio-key learning model for extracting a user's bio-key according to an embodiment of the present invention.
7 is a view showing a flow for issuing a user's bio certificate according to an embodiment of the present invention.
8 is a view showing a flow of registering a user's bio-certificate to a FIDO server according to an embodiment of the present invention.
9 is a view showing a flow of processing authentication through a FIDO server using a user's bio certificate according to an embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art to which the present invention pertains may easily practice. However, the present invention can be implemented in many different forms and is not limited to the embodiments described herein.

In describing the embodiments of the present invention, when it is determined that a detailed description of known configurations or functions may obscure the subject matter of the present invention, detailed descriptions thereof will be omitted. In the drawings, parts irrelevant to the description of the present invention are omitted, and similar reference numerals are used for similar parts.

In the present invention, when a component is said to be "connected", "coupled" or "connected" with another component, this is not only a direct connection relationship, but also an indirect connection relationship in which another component exists in the middle. It may also include. Also, when a component is said to "include" or "have" another component, this means that other components may be further included, not specifically excluded, unless otherwise stated. .

In the present invention, terms such as first and second are used only for the purpose of distinguishing one component from other components, and do not limit the order or importance between components unless otherwise specified. Accordingly, within the scope of the present invention, the first component in one embodiment may be referred to as a second component in another embodiment, and likewise the second component in one embodiment may be the first component in another embodiment It can also be called.

In the present invention, the components that are distinguished from each other are for clarifying each feature, and the components are not necessarily separated. That is, a plurality of components may be integrated to be composed of one hardware or software unit, or one component may be distributed to be composed of multiple hardware or software units. Accordingly, such integrated or distributed embodiments are included in the scope of the present invention, unless otherwise stated.

In the present invention, components described in various embodiments do not necessarily mean components, and some may be optional components. Therefore, an embodiment composed of a subset of components described in one embodiment is also included in the scope of the present invention. In addition, embodiments including other components in addition to the components described in various embodiments are also included in the scope of the present invention.

The present invention is a user authentication system that uses a bio-certificate online to issue a bio-certificate using bio-key information that is constantly extracted from the user's bio-information each time. Since this authentication system is a system using a bio-certificate that is linked to the user's bio-information, proxy signing is not possible and can be used as a non-face-to-face identity verification technology.

At this time, in order to implement the present invention, various known methods for extracting fixed bio-key information using the user's bio-information may be applied. Also, as an embodiment of the present invention, a method of extracting fixed bio-key information using the user's bio-information is described in the prior document 1 (KR 2017-0155930, 'Personal key management in public key infrastructure using bio-information') Method and Apparatus').

Hereinafter, a non-face-to-face identification device and method using a bio certificate according to an embodiment of the present invention will be described with reference to the accompanying drawings. It will be described in detail focusing on the parts necessary to understand the operation and operation according to the present invention.

1 is a view showing a non-face-to-face identity verification system using a bio certificate according to an embodiment of the present invention.

As shown in Figure 1, the non-face-to-face identity verification system using the bio-certificate of the present invention may be composed of a user device (User Device) and a relying party (RP).

The user device may be a device capable of performing bio-authentication service and bio-information management, and may be a smart phone or the like as an embodiment of the present invention. However, the device on which the operation according to the present invention can be performed may correspond to a user device, and is not limited to one embodiment.

The user device may include an application client, a Fast IDentity Online (FIDO) client 100, a Fast IDentity Online (FIDO) authentication device 200, and a bio key management device 300.

At this time, the FIDO client 100 may be configured as an application application, and may utilize the FIDO Client provided by the OS itself or the FIDO Client provided by a web browser.

At this time, the application client may correspond to an application capable of providing a service. At this time, the application client may be a service application that provides a non-face-to-face authentication service, and may be a non-face-to-face banking application as an embodiment of the present invention. Also, the application client may correspond to a service application capable of managing the bio-certificate, and may correspond to an application capable of performing an operation for issuing, updating, and revoking the bio-certificate and bio-information.

The relying party (RP) may be composed of an application server, a FIDO server 400, a CA server 500, and a bio key model learning server 600.

The user device may transmit and receive information through a relying party (RP) and a network, and according to an embodiment of the present invention, the user device may transmit a bio feature point and receive a bio key generation model generated from the relying party. In addition, the user device may transmit a request for issuing a bio certificate to the relying party, and may register the issued bio certificate to the FIDO server. After the bio certificate is registered, a user authentication procedure can be performed by communicating with the FIDO server.

FIDO client 100 calls the FIDO authentication device in conjunction with the FIDO server. In more detail, the FIDO client 100 may interpret the request message from the FIDO server 400 and request the FIDO function from the FIDO authentication device 200.

The FIDO authentication device 200 receives the requested FIDO function from the FIDO client 100 and verifies the user. If the user is verified, the digital signature is executed based on the user's bio certificate. In more detail, the FIDO authentication device 200 identifies the user, generates a public key pair using the user's fixed bio key information, manages the generated bio certificate based on the generated public key information, and registers FIDO / Digital signatures for authentication can be performed.

That is, the FIDO authentication device 200 generates a public key pair from the user's fixed bio key generated from the bio key management device 300 and manages the user's bio certificate. At this time, without storing and managing the secret key, if necessary, a fixed bio key is extracted from the user's bio information, and a secret key is generated from the bio key.

In addition, the FIDO authentication device 200 generates a FIDO registration message (Attestation) including the user's bio-certificate.

The FIDO authentication device 200 performs electronic signature necessary for FIDO authentication using a secret key generated from the user's fixed bio key for user authentication.

The bio key management apparatus 300 extracts the user's fixed bio key information from the user's bio information.

The FIDO server device 400 registers the user's bio certificate and processes authentication and revocation functions. That is, the FIDO server device 400 may register the user's bio certificate and authenticate the user in conjunction with the FIDO client 100. In more detail, the FIDO server 400 provides a function for registering a bio certificate, authenticating a user through the registered bio certificate, and deleting the registered bio certificate. At this time, when compared with the function of the FIDO server device 400, the bio-certificate can be updated only by the CA server 500.

The certification authority (CA) server 500 may perform overall management of the bio-certificate. More specifically, the CA (Certification Authority) server 500 may issue a bio certificate for the public key generated from the user's bio key information, and renew and revoke the bio certificate.

The bio key model learning server 600 may generate a model capable of extracting a user's fixed bio key by learning the user's bio information.

2 is a view showing a module constituting the FIDO authentication apparatus 200 according to an embodiment of the present invention.

The FIDO authentication device 200 includes a user authentication module 210, a display module 220, a communication interface 230, a registration key management module 240, an authentication key management module 250, and a bio certificate management module 260. It can be composed of.

The FIDO authentication device 200 is configured to basically perform a procedure of identifying a user, that is, an owner of a user device, and operate other functions only when it is determined that the owner is the owner.

Therefore, the user authentication module 210 first checks whether the user of the device corresponds to the user. In this case, various methods of identifying a user that can be performed on the user's terminal can be used. In one embodiment of the present invention, the user authentication module 210 performs a procedure of recognizing a face in order to pre-register the user's face and verify the real person when the owner identification method is face recognition.

When the user is authenticated, the display module 220 may output a transaction confirmation message in order to confirm the purpose of the authentication to the user.

The communication interface 230 may perform a communication function between the FIDO client 100 and the bio-key management device 300.

The standard FIDO authentication device uses two types of public key pairs: a registration key used to register the authentication device and an authentication key used to authenticate. However, in the present invention, only the registration key is managed, and the authentication key is not stored or managed. The authentication key is digitally signed by generating the same secret key each time using the user's fixed bio key information whenever necessary.

The registration key management module 240 manages the registration secret key and registration certificate for FIDO registration. At this time, in the present invention, the registration secret key (or registration key) is stored and managed by the registration key management module 240, and may be used when performing digital signatures for registering with the FIDO server.

The authentication key management module 250 generates a public key pair identical to the public key pair generated when issuing the bio certificate using the user's fixed bio key information.

At this time, the authentication key management module 250 does not store and manage the user's bio-key information. However, when the user uses the service, the bio key may be extracted each time the service is used through the user's bio information, and a public key pair may be generated based on the user's bio key information.

At this time, among the generated public key pairs, the secret key is called an authentication key, and in the present invention, it is called an authentication secret key or a secret key for public key authentication. The authentication key of the present invention corresponds to a secret key generated based on the user's bio-key information, and an electronic signature for FIDO authentication can be processed using the authentication key.

Also, in the present invention, the authentication key is not a stored and managed value, unlike a registration key. When a user requests an authentication of the FIDO server using a service, the authentication key management module 250 is checked after confirming the user's bio key. The public key pair is regenerated based on the bio key, and corresponds to the secret key generated from the regenerated public key. In addition, in the present invention, the FIDO authentication response message may be digitally signed using a secret key generated from the regenerated public key.

That is, unlike the procedure for FIDO authentication, in the FIDO registration process, the digital signature is not performed with the secret key generated through the bio key as described above. In the FIDO registration process, the registered secret key managed by the registration key management module 240 is used. In contrast, in the FIDO authentication process, the bio key information is requested according to a request whenever the user uses the service in the authentication key management module 250. Through this, an electronic signature for authentication can be generated using an authentication secret key that is re-produced every time, and the present invention can provide a user verification method and apparatus with enhanced security due to the configuration.

Finally, the bio certificate management module 260 manages the bio certificate associated with the user's fixed bio key. The bio certificate is registered in the FIDO server 400 in the FIDO registration step.

3 is a view showing a module constituting the bio-key management apparatus 300 according to an embodiment of the present invention.

The bio-key management apparatus 300 recognizes the user's bio-information, extracts feature values, and extracts the extracted feature values through the bio-key model learning server 600 to extract the user's fixed bio-key values. It is a device that can receive a generation model, identify a user through the provided bio key generation model, and extract a fixed bio key for the user.

The bio-information processing module 310 recognizes the user's bio-information and extracts feature points for the bio-information. For example, in the case of a device that recognizes face information, feature points for the face are extracted through a user's face photograph.

The bio authentication module 320 processes a function of identifying a registered user through the user's bio information. The user authentication module 210 of the FIDO authentication device 200 identifies the user through the bio authentication module 320 of the bio key management device 300.

The communication interface 330 communicates with the FIDO authentication device 200 to perform the function of providing the user's bio-authentication and the user's bio-key, providing the user's bio-feature points to the bio-key model learning server 600, and It performs a communication function to receive a key generation model.

The bio key model management module 340 may inject the user's bio feature points into the bio key generation model, and as a result, check the user's fixed bio key information. The user's fixed bio-key information can be confirmed after the user's bio-authentication is successful. The bio-key model management model should consist of physical devices for security. For example, it can be configured as a secure device such as a Trusted Platform Module (TPM).

4 is a flowchart of a method for generating and registering a bio-certificate of a non-face-to-face identity verification device using a bio-certificate according to an embodiment of the present invention.

The present invention generates a public key pair using fixed bio key information extracted from a user's bio information in order to provide a secure identity verification method, wherein the bio key information is used as a Seed value for generating a public key pair do. If the bio key information used as the Seed value is different, a different public key pair is generated each time, so the proxy signature based on the bio certificate is not possible at the source, so the present invention can be utilized as an online non-face-to-face technology.

To this end, in order to perform a method of generating and registering a bio-certificate of the non-face-to-face identity verification device, first, a bio key learning model is generated at a relying party based on the user's bio information recognized by the user's terminal, and then, The bio key generation model is stored. (S410)

After confirming the owner of the device according to the request for the public key for generating the bio-authentication, the feature point extracted from the user's bio-information is added to the bio-generation model to check the user's fixed bio-key information (S420).

Thereafter, a public key pair is generated from the user's bio key information, and (S430) a bio certificate is issued using the secret key for the public key. (S440)

The user terminal makes a request to register the user's bio certificate with the FIDO server, generates a FIDO registration response message after confirming the user, and generates an electronic signature with the registration secret key. Thereafter, the digital signature and the registration certificate are transmitted to the FIDO server. (S450)

The FIDO server performs the certification path verification for the registration certificate, and if the certification path verification is correct, the digital signature is verified using the public key included in the registration certificate. If the digital signature verification is successful, the bio certificate information included in the FIDO registration response message is registered in the FIDO server (S460).

The procedure of this FIG. 4 is described in detail by FIGS. 6 to 8.

5 is a flowchart of a method for a non-face-to-face identity verification device using a bio-certificate according to an embodiment of the present invention to identify a face-to-face identity.

When there is a non-face-to-face authentication request (S510), a user verification (S520) procedure is performed, and the user's fixed bio-key information is confirmed (S530) and a public key pair is generated (S540). The public key pair corresponds to the same public key pair as when the bio certificate is issued. Then, a FIDO authentication response message is generated, and the FIDO authentication response message is electronically signed with the secret key among the public key pairs generated through the bio-key information (S550), and the electronically signed FIDO authentication response message is used by the user's bio certificate. To verify the non-face-to-face identity verification (S560).

The procedure of FIG. 5 is described in detail in FIG. 9.

6 is a diagram illustrating a flow of generating and installing a bio-key learning model for extracting a user's bio-key according to an embodiment of the present invention.

The application client, the bio management app, requests to generate a bio key generation model, and requests and manages a bio certificate issuance using public key information associated with the bio key.

The bio management app requests the bio key management device 300 to generate a bio key generation model. The bio key management apparatus 300 recognizes the user's bio information through the bio information processing module 310 and extracts a feature point.

The extracted bio-feature points of the user are transmitted to the bio-key model learning server 600, and the bio-key model learning server 600 generates a model through which the bio-key of the fixed user can be extracted through the bio-feature points of the user. do. The bio key management apparatus 300 stores and manages the bio key generation model in the bio key model management module 340.

7 is a view showing a flow for issuing a user's bio certificate according to an embodiment of the present invention.

In order to issue a user's bio certificate, a bio key generation model must first be installed in the bio key management device 300.

The bio management app requests the CA server 500 to issue the user's bio certificate. The certification authority (CA) server 500 transmits a reference number / authorization code for issuing a bio certificate to a bio management app.

As a next step, the bio management app requests the public key for generating the bio certificate to the FIDO authentication device 200, and the FIDO authentication device 200 confirms the owner of the FIDO authentication device through the user authentication module 210 and the user Request bio-key information.

Next, the bio-key management apparatus 300 recognizes the user's bio-information through the bio-information processing module 310 and extracts a feature point. Then, the user is identified through the bio-authentication module 320, and a feature point is injected into the user's bio-key generation model managed by the bio-key module management module 340 to confirm and return the user's fixed bio-key information. .

As a next step, the FIDO authentication device 200 generates a public key pair associated with the user's bio key through the authentication key management module 250. When generating a public key pair, the user's bio key information is used as a seed value. If the seed value is different, a different public key pair is generated each time. In addition, the authentication key management module 250 does not store and manage the user's bio-key information, and extracts the fixed bio-key through the user's bio-information each time. Since the same bio key is always extracted, the same key pair as the public key pair generated in the step of issuing the bio certificate can be reproduced. Therefore, the private key associated with the public key also does not need to be stored and managed by the FIDO authentication device 200, thereby preventing the leakage of the private key for the bio certificate.

As a next step, the bio management app creates a bio certificate issuance application using the public key and reference number / authorization code information associated with the user's bio key and transmits it to the CA server 500. The CA server 500 issues the FIDO authentication device 200 that can use the secret key for the public key requesting the issuance, and the digital signature for issuing the certificate and performs a conventional procedure to issue the bio certificate. The issued bio certificate is stored and managed in the bio certificate management module 260 of the FIDO authentication device 200.

8 is a diagram illustrating a flow of registering a user's bio-certificate to the FIDO server 400 according to an embodiment of the present invention.

The non-face-to-face banking application, which is an application client, registers the user's bio certificate to the FIDO server 400 and provides a function to process user authentication using the registered bio certificate. In order to register the user's bio certificate to the FIDO server, the user's bio certificate must be stored and managed in the FIDO authentication device 200.

The non-face-to-face bank app requests the user to register the user's bio certificate to the FIDO server 400. The FIDO server 400 generates a request message for FIDO registration and delivers it to the FIDO authentication device 200.

The FIDO authentication device 200 identifies the user through the user authentication module 210 and generates a FIDO registration response message (Attestation) including the user's bio certificate managed by the bio certificate management module 260. Then, the FIDO registration response message is electronically signed with the secret key (registration key) managed by the registration key management module 240, and the registration certificate and electronic signature managed by the registration key management module 240 are registered with the FIDO server 400. ). In the next step, the FIDO server 400 performs certification path verification for the registration certificate in the FIDO standard method. If the certification path verification is successful, the digitally signed FIDO registration response message is verified using the public key information included in the registration certificate, and the bio-certificate of the user included in the FIDO registration response message is stored. The user's bio certificate stored in the FIDO server 400 is used to verify the digital signature of the FIDO authentication response message in the FIDO authentication step. If verification of the digital signature is successful, the bio-certificate information included in the FIDO registration response message is registered on the server.

9 is a view showing a flow of processing authentication through the FIDO server 400 using a user's bio-certificate according to an embodiment of the present invention.

The non-face-to-face bank app requests non-face-to-face authentication to the FIDO server 400, and the FIDO server 400 delivers the FIDO authentication request message to the FIDO authentication device 200.

The FIDO authentication device 200 calls the bio key management device 300 to identify the user through the user authentication module 210 and receive the user's bio key information. And the authentication key management module 250 is a user Generates the same key pair as the public key pair used to issue the bio certificate using the fixed bio key information of.

As a next step, the FIDO authentication apparatus 200 generates a FIDO authentication response message and digitally signs the FIDO authentication response message with a secret key among the public key pairs generated by the authentication key management module 250. The Assertion message including the digitally signed FIDO authentication response message is transmitted to the FIDO server 400.

As a next step, the FIDO server 400 verifies the digitally signed FIDO authentication response message using the user's bio-certificate and delivers the result as a server response.

The present invention uses fixed bio-key information extracted from the user's bio-information as a seed value to generate a public key pair, and utilizes a bio-certificate issued based on the generated public key to face the user online. It is an authentication technology.

If the Seed value is fixed, the same public key pair can be generated each time, so the secret key generated in the registration step can be regenerated using the user's bio information whenever necessary without saving the secret key value for public key authentication. have. Therefore, the present invention is a non-face-to-face identity verification system that does not store a secret key and can also renew a secret key, which has a very great advantage in terms of leakage and management of the secret key.

The secret key update method is to regenerate the user's bio key generation model. When generating a bio-key bio-model, even if the user's bio-feature points are the same, it is possible to randomly change the parameter value for learning so that other bio-key information can be extracted.

Therefore, the user authentication using the bio certificate cannot be authenticated without the fixed bio key information through the user's biometric recognition, so it can have an effect similar to the behavior by comparing the user's face and the photo of the ID card offline.

Therefore, the present invention is expected to be able to simplify the current non-face-to-face identity verification method and procedure.

Advantages and features of the present invention, and methods for achieving them will be clarified with reference to embodiments described below in detail together with the accompanying drawings. However, the present invention is not limited to the embodiments set forth below, but may be implemented in various different forms, and only the present embodiments make the disclosure of the present invention complete, and common knowledge in the art to which the present invention pertains It is provided to completely inform the person having the scope of the invention, and the present invention is only defined by the scope of the claims.

100: FIDO client
200: FIDO authentication device
300: bio key management device
400: FIDO server
500: CA server
600: bio key model learning server
210: user authentication module
220: display module
230: communication interface
240: registration key management module
250: authentication key management module
260: bio certificate management module
310: bio information processing module
320: bio certification module
330: communication interface
340: bio key model management module

Claims (1)

In the method of performing non-face-to-face identification using the user's bio certificate
Generating a public key pair based on the user's bio key, and generating a bio certificate based on the public key pair;
Registering the generated bio-certificate to a Fast IDentity Online (FIDO) server;
Transmitting an electronically signed FIDO authentication response message according to the authentication request of the FIDO server; And
Verifying the electronically signed FIDO authentication response message based on the registered bio-certificate and receiving the verification result;
Including,
When there is a request for authentication from the FIDO server,
After confirming the user's bio key, the public key pair is regenerated based on the bio key,
The FIDO authentication response message is digitally signed using the secret key generated from the regenerated public key.
A method of performing non-personal identification with the feature.

Images