TWM623207U - identity authentication system - Google Patents

Abstract

This creation provides an identity authentication system, which includes a first device and a second device. A first verification code is stored in the first device. When the first device receives a request command to authenticate the user, the first device performs comparison according to a biometric information possessed by the user. After the comparison is successful , and output a signature information according to the first verification code. The second device is signally connected to the first device, the second device has a second verification code corresponding to the first verification code, the second device receives the signature information, and sends the verification code according to the second verification code. The signature information is used for identity authentication, and the result of the identity authentication is sent back to the first device.

Description

identity authentication system

This creation is an authentication system, especially a high-security-intensity identity authentication system using asymmetric public and private keys and biometric identification technology.

The commonly used authentication technologies include traditional password authentication, biometric authentication, and two-factor authentication. Among them, in the traditional password verification architecture, both the user and the server "both" know the account and password for verification. Under this architecture, the risk will be concentrated on the server side. Once a corporate website is compromised, it may result in the leakage of millions of account passwords.

In the biometric authentication method, the sensor is used to obtain the user's biometric features, such as unique features such as fingerprints or pupils, for identification and authentication. In two-factor authentication, in addition to passwords, the second-factor authentication is mostly carried out by text message or telephone voice. However, text messages or telephone voice communications may still be intercepted by hackers without encryption, so in countries that pay more attention to information security, such as the National Institute of Standards and Technology (NIST), In its Digital Authentication Guideline, it has been suggested that enterprises should no longer perform secondary verification through the telecommunication system, including SMS and telephone voice, and exclude this verification method from future advanced authentication. beyond the standard.

In view of the above, there is a need for an identity authentication system to solve the problems of conventional technologies.

This creation is about an identity authentication system with high security strength and no password using biometric identification mechanism. In the system of this creation, the authentication is performed on the device side, with an asymmetric public key-private key structure, the server side only stores the corresponding public key, there is no key, and the private key is only stored on the device side. Under such an architecture, risk will be spread out on the device side, rather than concentrated on the server side. Through the method of this creation, it can solve the problem that in the past, once the enterprise website is breached, it may cause the leakage of more than millions of account passwords. Since the server in the identity authentication server system of this creation does not keep any keys, the possibility of this threat is eliminated. Even if the server is compromised, it is only impossible to log in, but the identity will not be stolen. It will also become quite troublesome if hackers want to infiltrate user devices one by one.

This creation relates to a high-security identity authentication system using asymmetric public and private keys and biometric technology. After identity authentication uses the biometric hardware of the mobile device to confirm the identity, the corresponding identity certificate is encrypted through the asymmetric public and private key technology. The signature is sent to the authentication server for identity authentication.

This creation can monitor the identity authentication history records of multiple mobile devices through the server, analyze and make subsequent individual identity authentication decisions. The server can also control which biometric identifications individual users can use for different mobile devices. Mechanisms (such as face, fingerprint or voice) confirm identity.

In one embodiment, the present invention provides an identity authentication system including a first device and a second device. A first verification code is stored in the first device. When the first device receives a request command to authenticate the user, the first device performs comparison according to a biometric information possessed by the user. After the comparison is successful , and output a signature information according to the first verification code. The second device is signally connected to the first device, the second device has a second verification code corresponding to the first verification code, the second device receives the signature information, and sends the verification code according to the second verification code. The signature information is used for identity authentication, and the result of the identity authentication is sent back to the first device.

In one embodiment, the present creation provides an identity authentication system including an authentication module, a client module and a decryption module. The authentication module receives a request command to activate a biometric In the identification process, a first verification code is stored in the authentication module, the authentication module obtains a biometric information possessed by the user, and compares according to the biometric information, when the comparison is successful, the authentication module according to the first The verification code generates a signature information. The client module is connected with the authentication module information, and the client module is used for generating the request command, receiving the signature information, and outputting the signature information. The decryption module is signal-connected with the client module, the decryption module has a second verification code, the decryption module receives the signature information, and performs identity authentication on the signature information according to the second verification code, And return the result of identity authentication to the client module.

In one embodiment, the authentication module and the client module are set in a first device, the decryption module is set in a second device different from the first device, the first and the second device Communicate over a network. Wherein, the first device is a mobile device, and the second device is a network server.

In one embodiment, the authentication module is further electrically connected with a biometric information unit, and the biometric information unit is used for obtaining the biometric information about the user. Wherein, the first verification code and the second verification code are paired information generated by an algorithm.

2. 2a: Identity authentication system

20, 20a: The first device

200: Operation processing unit

200a: the first arithmetic processing unit

201~203: Biological Information Unit

21, 21a: Second device

210: The second arithmetic processing unit

22: Authentication module

23: Client Mods

24: Decryption module

25: Bioinformatics Unit

90: The first verification code

91:Second verification code

FIG. 1 is a schematic diagram of an embodiment of an authoring identity authentication system.

FIG. 2 is a schematic diagram of another embodiment of an authoring identity authentication system.

Various illustrative embodiments may be described more fully hereinafter with reference to the accompanying drawings, in which some illustrative embodiments are shown. However, the inventive concepts may be embodied in many different forms and should not be construed as limited to the exemplary embodiments set forth herein. Rather, these exemplary embodiments are provided so that this writing will be thorough and complete, and will appeal to those skilled in the art Fully convey the scope of this creative concept. Similar numbers always indicate similar elements. The identity authentication system will be described below with various embodiments in conjunction with the drawings, however, the following embodiments are not intended to limit the present invention.

Please refer to FIG. 1 , which is a schematic block diagram of an embodiment of a creative identity authentication system. The identity authentication system 2 in this system includes a first device 20 and a second device 21 . The first device 20, in one embodiment, may be a mobile device, such as a smart phone, a tablet computer, etc., but not limited thereto, for example, a notebook computer or a desktop computer, etc. can also be used as the Embodiment of the first device 20 . The second device 21, in one embodiment, is a server with computing processing capability that communicates with the first device 20 through a wired or wireless network.

The first device 20 stores a first verification code 90, which is a private key. In the present embodiment, the first device 20 has an arithmetic processing unit 200 with an arithmetic processing capability, which is used to perform computation of related program logic. When the first device 20 receives a request command for authenticating the user, the arithmetic processing unit 200 receives the request command, and the arithmetic processing unit 200 performs comparison according to a biological information possessed by the user. It should be noted that, in an embodiment, the method of generating the request command may be that when a specific APP or an application is activated by the first device 20, the specific APP or application may issue the request command to identify the user. Authenticate.

In an embodiment of biometric information, the first device 20 can pass embedded or external biometric information units 201-203, wherein the biometric information unit 201 is a fingerprint sensor, the biometric information unit 202 is a sound capture device, and the biometric information unit 202 is a The unit 203 is an image capturing device 203 for capturing information such as pupils, specific facial features, or facial features of the user as the biological information. It should be noted that, the biological information units 201 to 203 may be set in the first device 20 according to requirements, and at least one of them can be implemented.

When performing identity authentication, it needs to use the first verification code 90. The following embodiment uses the private key as the first verification code. When the user wants to obtain the private key, he must first go through the first verification code. Set 20 to obtain the user's biometric characteristics, and after the verification is successful, the private key can be taken out for signature. Therefore, in this embodiment, the first device 20 is identified by the embedded or external biometric information units 201 - 203 . When the biometric information is used to confirm the identity successfully, the arithmetic processing unit 200 outputs an output according to the first verification code 90 . Signature information; otherwise, if the comparison fails, the user is not allowed to operate. After the signature information is generated, the first device 20 outputs the signature information to the remote second device 21 for authentication.

The second device 21 is signally connected to the first device 20 , and the second device 21 has a second arithmetic processing unit 210 and a second verification code 91 corresponding to the first verification code 90 . In this embodiment, the second verification code 91 is a public key, and both the first verification code 90 (private key) in the remote first device 20 is through an algorithm, such as a deterministic random bit generator (deterministic random bit generator). random bit generator, DRBG) algorithm, which generates paired passwords in groups. The second device 21 receives the signature information, and the second arithmetic processing unit 210 performs identity authentication on the signature information according to the second verification code 91, that is, uses the public key stored in the second device to verify the signature information to decrypt. Since the second verification code 91 and the first verification code 90 match each other, in the identity authentication procedure, the second device 21 uses the second verification code 91 to verify whether the received signature information corresponds to the first verification code The signature information of verification code 90.

It should be noted that a feature of the public and private keys in the algorithm is to use the private key to sign the data. At this time, the matching public key can be used to verify whether the data is the signature information of the corresponding private key. For example: in one embodiment, there is data abc that uses the private key to sign and generate the signature information of ABC. At this time, abc and ABC use the public key to verify whether the signature information ABC is formed by abc through the private key Signature information. If so, it can be confirmed that the abc data is signed by the user of the private key after confirmation. Therefore, after the signature is completed, the first device 20 returns the generated signature information ABC and the original data abc to the second device 21 so that the second device 21 can use the original registered public key to verify whether it is the original owner. After the verification is completed, the second device 21 will return the verification result to the first device Set 20.

It should be noted that the second device 21 has advanced management functions. For example, in one embodiment, the identity authentication history records of the plurality of first devices 20 are monitored through the second device 21 , and then analyzed to make subsequent individual records. Authentication decisions. In another embodiment, the second device can control which biometric identification mechanisms (such as face, fingerprint or voice) individual users can use to confirm their identity for individual mobile devices.

Please refer to FIG. 2 , which is a schematic diagram of another embodiment of the created identity authentication system. In this embodiment, the identity authentication system 2 a includes an authenticator 22 , a client module 23 and a decryption module 24 . The authentication module 22 and the client module 23 are arranged in a first device 20a. It should be noted that the first device 20a has a first arithmetic processing unit 200a for executing software or firmware programs. In one embodiment, the authentication module 22 and the client module 23 are constituted by software modules executable by the first arithmetic processing unit 200a. The first device 20a can be a mobile device, such as a smart phone, a tablet computer, etc., but not limited thereto, such as a notebook computer or a desktop computer, etc., can also be used as an embodiment of the first device 20a . The decryption module 24 is disposed in a second device 21a. The second device 21 a has one or more second arithmetic processing units 210 , and the decryption module 24 is a software module executable by the second arithmetic processing unit 210 . The second device 21a, in one embodiment, a server with computing processing capability communicates with the first device 20a through a wired or wireless network.

A biological information unit 25 is embedded or externally connected to the first device 20a for capturing a biological information of the user. The biometric information unit 25 can be a fingerprint sensor, a voice capture device or an image capture device to capture information such as the user's pupils, specific facial features, or facial features as the biometric information. [0023] An application program or an APP is installed in the first device 20a. After the user executes the application program or the APP, a requirement for authenticating the user's identity is generated. After the client module receives the request, it will generate a request instruction and send it to the authentication module 22 .

After receiving the request command, the authentication module 22 will start a biometric information identification program, and notify the biometric information unit 25 to obtain the biometric information from the user, so as to confirm the user's identity. The authentication module 22 stores a first verification code 90 (a private key in this embodiment), and the authentication module 22 obtains the biometric information possessed by the user, and compares it according to the biometric information. , the authentication module 22 uses the private key stored in the authentication module 22 to sign the user's corresponding identity certificate to generate signature information.

The signature information is returned to the client module 23, and the client module 23 then transmits the signature information to the remote second device 21a through the network, and requests the second device 21a to perform an identity authentication request. After receiving the signature information, the second device 21a decrypts the signature information through the second verification code 91 stored in the second device, and after confirming the identity, sends the identity authentication result back to the client module of the first device 20a 23, to complete the identity verification procedure. In this embodiment, the second verification code 91 is a public key, which and the first verification code 90 (private key) in the remote first device 20a are both through an algorithm, such as a deterministic random bit generator (deterministic random bit generator). random bit generator, DRBG) algorithm, which generates paired passwords in groups. The second device 21a receives the signature information, and performs identity authentication on the signature information according to the second verification code 91, that is, decrypts the signature information using the public key stored in the second device 21a. Since the second verification code 91 and the first verification code 90 match each other, in the identity authentication procedure, the second device 21a uses the second verification code 91 to verify whether the received signature information corresponds to the first verification code The signature information of verification code 90. After authentication, the authentication result is sent back to the first device 20a to complete the identity authentication procedure.

Based on the above, in the authentication system of this creation, identity verification is carried out at the near end, with an asymmetric public key and private key architecture, the remote server end only saves the corresponding public key, there is no private key, and the private key The key is only stored in the near-end device. Under such an architecture, risk will be spread out on the device side, rather than concentrated on the server side. Through the method of this creation, it can solve the problem that in the past, once the enterprise website is breached, it may cause the leakage of more than millions of account passwords. Due to the original The server in the established identity authentication server system does not keep any keys, which eliminates the possibility of this threat. Even if the server is compromised, it is only impossible to log in, but the identity will not be stolen.

The above-mentioned descriptions merely describe the preferred implementations or examples of the technical means adopted by the present invention to solve the problem, and are not intended to limit the scope of the patented implementation of the present invention. That is to say, all the equivalent changes and modifications that are consistent with the scope of the application for this patent for creation, or are equivalent to changes and modifications made in accordance with the scope of this patent for creation, are covered by the scope of this patent for creation.

2: Identity authentication system

20: The first device

200: Operation processing unit

201~203: Biological Information Unit

21: Second device

90: The first verification code

91:Second verification code

Claims (9)

An identity authentication system, comprising: a first device with a first verification code stored therein, when the first device receives a request command for authenticating a user, the first device executes a process according to a biometric information possessed by the user Comparing, when the comparison is successful, outputting a signature information according to the first verification code; and a second device signally connected to the first device, the second device having a first verification code corresponding to the first verification code Two verification codes, the second device receives the signature information, performs identity authentication on the signature information according to the second verification code, and returns the identity authentication result to the first device. The identity authentication system of claim 1, wherein the first device is further connected with a biometric information unit, and the biometric information unit is used to obtain the biometric information about the user. The identity authentication system of claim 1, wherein the first verification code and the second verification code are paired information generated by an algorithm The identity authentication system of claim 1, wherein the first device is a mobile device, and the second device is a server. An identity authentication system, comprising: a first device, which has a first arithmetic processing unit for executing an authentication module and a client module, wherein: the authentication module receives a request instruction to activate a biological Information identification program, the authentication module stores a first verification code, the authentication module obtains a biometric information possessed by the user, and compares according to the biometric information, when the comparison is successful, the authentication module according to the The first verification code outputs a signature information; the client module is connected with the authentication module information, and the client module is used for generating the request command, and receiving and outputting the signature information; and A second device has a second arithmetic processing unit, the second arithmetic processing unit executes a decryption module, the decryption module is signal-connected with the client module, the decryption module has a second verification code, the The decryption module receives the signature information, performs identity authentication on the signature information according to the second verification code, and returns the identity authentication result to the client module. The identity authentication system of claim 5, wherein the first device is a mobile device, and the second device is a server. According to the identity authentication system of claim 6, the server side controls, for each mobile device, the type of the biometric information that the authentication module obtains from the user. The identity authentication system of claim 5, wherein the authentication module is further electrically connected with a biometric information unit, and the biometric information unit is used for obtaining the biometric information about the user. The identity authentication system of claim 5, wherein the first verification code and the second verification code are paired information generated by an algorithm.

Images