KR101773073B1 - Method for allowing a transaction to be processed and server using the same - Google Patents

Abstract

The present invention relates to a method for supporting a transaction and an authentication support server using the same. According to an aspect of the present invention, the method for supporting a transaction includes: (a) a step in which the authentication support server obtains (1) a public key of a predetermined user and (2) a hash value of predetermined user information or a value in which the hash value is processed, as an authentication information use request; and (b) a step in which a biometric authentication server (i) verifies a value in which the hash value of transaction information or a value that the hash value of the transaction information is processed is signed by a private key corresponding to biometric information on the predetermined user by using the public key of the predetermined user or supports the verification and (ii) transmits a message about a verification result or supports the transmission, by transmitting the public key of the predetermined user to the biometric authentication server or using the public key of the predetermined user which the biometric authentication server manages when a second predetermined hash value which is the hash value on (1) and (2), a second representative hash value generated as at least a neighboring hash value matched to the second predetermined hash value is calculated, or a value in which the second representative hash value is processed corresponds to the value a first representative hash value registered in a database or a value in which the first representative hash value is processed.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a transaction support server,

The present invention relates to a method for supporting transactions and an authentication support server using the same, and more particularly, to an authentication support server using a method for supporting transactions and an authentication support server using at least one neighboring hash that matches the first specific hash value and the first specific hash value In a state in which a first representative hash value generated by computing a value or a value obtained by processing the first representative hash value is registered in a database as a predetermined data structure, (1) a public key of a specific user and (2) obtaining a hash value of the specific user information or a value obtained by processing the hash value of the specific user information, (b) comparing a second specific hash value, which is a hash value with the first specific hash value, A second representative hash value generated by computing at least one neighbor hash value, the at least one neighbor hash value being determined with reference to the predetermined data structure, If the value obtained by processing the table hash value corresponds to the value obtained by processing the first representative hash value or the first representative hash value registered in the database, the public key of the specific user is transmitted to the biometric authentication server, (I) the biometric authentication server transmits a hash value of the transaction information or a value obtained by processing the processed value to a private key corresponding to the biometric information of the specific user by using the public key of the specific user managed by the authentication server (Ii) supporting a transaction to support transmission or transmission of a message on the verification result, and an authentication support server using the method.

Biometric authentication technology refers to a technology that performs authentication using personal biometric information such as fingerprint, iris, face, and voice. Since biometric authentication technology utilizes unique biometric information, user authentication technology that combines biometric authentication technology such as FIDO (Fast Identity Online) is attracting attention because it is highly secure and convenient.

In recent years, the block chain technology of virtual money has been attracting attention in the financial industry field where security is important because transaction details recorded on the block chain can not be changed / modulated.

Therefore, the inventor of the present invention has invented a technique for creating authentication information based on PKI and registering and managing the information on a block chain by applying a block chain technology to a biometric authentication technology so that a financial transaction can be performed more safely.

However, it may be inefficient to access and record the block chain in all cases where it is necessary to register authentication information. Especially, when there are many transaction requests, bottleneck phenomenon of service provision may occur and there is a concern that the transaction fee may be paid for each time a service operation is costly.

Accordingly, the inventor of the present invention has the advantage of being able to record the authentication information in real time without supplementing the above-mentioned invention, and it is possible to register the authentication information which can guarantee the fast service speed and reduce the cost even when the service request is made Invented a system that can. In particular, the system can support transactions using registered authentication information through a predetermined data structure.

KR 10-1611872 B1

SUMMARY OF THE INVENTION The present invention has been made to solve all the problems described above.

In the case where the authentication support server obtains (i) a public key of a specific user and (ii) a hash value of the specific user information or a value obtained by processing the hash value, a specific hash value A first representative hash value generated by digesting at least one neighboring hash value matched with the specific hash value or a value obtained by machining the first representative hash value is calculated in the same manner on a predetermined data structure, Value or a value obtained by processing the processed biometric information, and if the biometric authentication server matches the hashed value of the transaction information or the processed value with a private key corresponding to the biometric information of the specific user, The other purpose is to support the transaction by supporting the verification using the user's public key.

In order to accomplish the above object, a representative structure of the present invention is as follows.

According to one aspect of the present invention, there is provided a method for supporting a transaction, the method comprising: (a) previously calculating at least one neighboring hash value matching a first specific hash value and a first specific hash value In the state where the generated first representative hash value or the value obtained by processing the first representative hash value is registered in the database as a predetermined data structure, the authentication support server transmits (1) key and (2) obtaining a hash value of the specific user information or a value obtained by processing the hash value of the specific user information, and (b) obtaining a second specific hash value, A second representative hash value that is generated by computing at least one neighbor hash value matching the value of the at least one neighbor hash value with reference to the predetermined data structure, If the value obtained by processing the hash value corresponds to a value obtained by processing the first representative hash value or the first representative hash value registered in the database, the authentication support server transmits the public key of the specific user to the biometric authentication server (I) the biometric authentication server transmits a hash value of the transaction information or a value obtained by processing the hash value of the transaction information to the biometric information of the specific user corresponding to the biometric information of the specific user and (ii) supporting transmission or transmission of a message for the verification result. The present invention also provides a method for verifying a verification result of a verification result using a public key of a specific user.

According to another aspect of the present invention, there is provided an authentication support server for supporting transactions, wherein the authentication support server computes at least one neighboring hash value matching the first specific hash value and the first specific hash value (1) a public key of a specific user, and (2) a public key of a specific user, as the authentication information use request, in the state where the generated first representative hash value or the value obtained by processing the first representative hash value is registered in the database as a predetermined data structure. And a communication unit for obtaining a hash value of the specific user information or a value obtained by processing the hash value of the specific user information, and a second specific hash value which is a hash value for the items (1) and (2) Value - the at least one neighboring hash value is determined with reference to the predetermined data structure, or a second representative hash value And transmitting the public key of the specific user to the biometric authentication server if the processed value corresponds to the value obtained by processing the first representative hash value or the first representative hash value registered in the database, (I) the biometric authentication server sends a value obtained by signing the hash value of the transaction information or a value obtained by processing the transaction value with a private key corresponding to the biometric information of the specific user, using the public key of the specific user (Ii) a processor for supporting the transmission or transmission of a message for the verification result.

The present invention has the following effects.

Further, in the present invention, when the authentication support server obtains (i) a public key of a specific user and (ii) a hash value of the specific user information or a value obtained by processing the hash value, And a value obtained by processing the first representative hash value or a value obtained by processing the first representative hash value are calculated in the same manner on a predetermined data structure and the second representative hash value generated by the second The biometric authentication server checks whether the hash value of the transaction information corresponds to the hash value or the processed value and if the biometric authentication server has signed the hash value of the transaction information or the processed value with the private key corresponding to the biometric information of the specific user It is possible to support transactions to be performed by supporting the verification using the public key of the specific user.

1 is a block diagram showing a configuration of an authentication support server for generating and registering authentication information according to an embodiment of the present invention.
2 is a sequence diagram illustrating a process of generating and registering authentication information according to an embodiment of the present invention.
3 is a sequence diagram illustrating a process of destroying authentication information according to an embodiment of the present invention.
FIG. 4 is a sequence diagram illustrating a process of using authentication information upon login according to another embodiment of the present invention.
FIG. 5 is a sequence diagram illustrating a process of using authentication information in a transaction according to another embodiment of the present invention.
6 and 7 are diagrams illustrating examples of a merge tree generated according to an embodiment of the present invention.

The following detailed description of the invention refers to the accompanying drawings, which illustrate, by way of illustration, specific embodiments in which the invention may be practiced. These embodiments are described in sufficient detail to enable those skilled in the art to practice the invention. It should be understood that the various embodiments of the present invention are different, but need not be mutually exclusive. For example, certain features, structures, and characteristics described herein may be implemented in other embodiments without departing from the spirit and scope of the invention in connection with an embodiment. It is also to be understood that the position or arrangement of the individual components within each disclosed embodiment may be varied without departing from the spirit and scope of the invention. The following detailed description is, therefore, not to be taken in a limiting sense, and the scope of the present invention is to be limited only by the appended claims, along with the full scope of equivalents to which such claims are entitled, if properly explained. In the drawings, like reference numerals refer to the same or similar functions throughout the several views.

FIG. 1 is a block diagram illustrating a configuration of an authentication support server for generating and registering authentication information according to an embodiment of the present invention. FIG. 2 is a flowchart illustrating a process of generating and registering authentication information according to an exemplary embodiment of the present invention. It is a sequence diagram.

Referring to FIG. 1, an authentication support server 100 for generating and registering authentication information according to an embodiment of the present invention includes a processor 110 and a communication unit 120.

The processor 110 receives from the biometric authentication server 300 a request for registration of the authentication information from the bank server 400. The hash value of the specific user information, When the value is obtained, it is confirmed whether or not the public key is registered. The biometric authentication server 300 is an apparatus for performing user authentication through biometric information, and may be, for example, an FIDO server.

Referring to FIG. 2, the process of generating and registering authentication information can be started from a process in which a public key of a specific user is generated in the user terminal 500 and transmitted to the bank server 400 (S202). At this time, the private key can also be generated. A specific user can visit a bank and register specific user information, thereby authenticating a specific user. For example, when a hash value of the specific user information other than the public key of the specific user is obtained, the authentication of the specific user is compared with the hash value of the specific user information held by the bank server 400, The authentication can be performed depending on whether or not it is supported. Here, the specific user information may include at least a part of the specific user's name (N), birth date (B), mobile phone number (#), and e-mail (E) When the specific user is authenticated, the bank server 400 may transmit Uhash, which is a hash value of the specific user information, to the biometric authentication server 300 (S204). At this time, the public key of the specific user can be transmitted together with the public key. When a user id is generated using Uhash, the user id and the hash value Idhash of the Uhash may be transmitted instead of Uhash. Idhash can be SHA256hash. The biometric authentication server 300 can transmit the value obtained by processing the Uhash or the Uhash to the authentication support server 100 as (i) the public key and (ii) the hash value of the specific user information or a processed value thereof (S206). In this case, if the user id is generated using the Uhash, the value obtained by processing the Uhash may be the user id and the hash value Idhash of the Uhash. The processor 110 determines whether or not the public key is registered in the local database (not shown) when (i) the public key of the specific user and (ii) the hash value of the specific user information or the processed value is obtained (S208). For reference, the user terminal 500 is a terminal device capable of performing user input / output, and may be any one of a smart phone, a PC, a tablet PC, and other electronic devices capable of user input / output.

The communication unit 120 is configured to communicate with the biometric authentication server 300 or the database 200. [ Here, the database 200 may be a block chain of virtual money.

If it is determined that the public key is registered (S210), the communication unit 120 can transmit an error message to the biometric authentication server 300 (S212). The error message is transmitted to the user terminal 500 via the bank server 400.

Alternatively, if the public key is unregistered, a transaction that outputs (i) the public key of the specific user and (ii) the hash value or the processed value may be generated and transmitted to the database S214, S216). Specifically, if the public key is unregistered, the communication unit 120 sets the public key of the specific user and (ii) the hash value or the processed value as output1 (op_msg1 = pubkey: IDhash), and a transaction having a predetermined amount of virtual money as output 2 can be generated and transmitted to the database. output2 can be used for authentication information destruction as described later. That is, a new transaction having output 2 as an input value is generated and transmitted to the database 200, so that the authentication information can be discarded.

The communication unit 120 acquires a transaction ID indicating the location information recorded on the database 200 in step S218 and transmits the public key and the public key to the biometric authentication server 300 ) A message informing that the hash value or the processed value has been registered normally can be transmitted (S220). The message is delivered to the user terminal 500 via the bank server 400.

The communication unit 120 may be implemented by various communication technologies. (WIFI), Wideband CDMA (WCDMA), High Speed Downlink Packet Access (HSDPA), High Speed Uplink Packet Access (HSUPA), High Speed Packet Access (HSPA), Mobile WiMAX, WiBro, , Long Term Evolution (LTE), bluetooth, infrared data association (IrDA), Near Field Communication (NFC), Zigbee, and wireless LAN technology. In addition, if the service is connected to the Internet, it can follow TCP / IP, a standard protocol for transmitting information on the Internet.

Meanwhile, the processor 110 may store a transaction ID, a hash value of specific user information or a processed value thereof, and a public key of a specific user in a local database (not shown).

The processor 110 performs a function of controlling the flow of data between the communication unit 120 and other components. That is, the processor 110 controls the flow of data between the components of the authentication support server 100 to control the communication unit 120 and other components to perform their own functions.

The processor 110 may include a hardware configuration such as a micro processing unit (MPU) or a central processing unit (CPU), a cache memory, and a data bus. It may further include a software configuration of an operating system and an application that performs a specific purpose.

Hereinafter, the configuration and operation of the authentication support server 100 that performs destruction of authentication information will be described. The authentication support server for performing the destruction of the authentication information described below may be configured as a separate apparatus from the authentication support server 100, but will be described as the same apparatus for convenience of explanation.

3 is a sequence diagram illustrating a process of destroying authentication information according to an embodiment of the present invention.

When the public key of the specific user is obtained from the biometric authentication server 300, which receives the revocation request for the authentication information from the bank server 400 as in the authentication information generation and registration process, the processor 110 determines whether the public key is registered (S308). The process before confirming the registration of the public key is similar to the process of generating and registering the authentication information.

First, a public key of a specific user in the user terminal 500 can be started from the process of being transmitted to the bank server 400 (S302). If a public key of a plurality of users is stored in the user terminal 500, the public key selected by the user can be transmitted to the bank server 400. In addition, a public key may be selected by inputting biometric information such as fingerprint information, face information, iris information, and the like. The bank server 400 performs authentication for a specific user. When the specific user is authenticated, the bank server 400 may transmit Uhash, which is a hash value of the specific user information, to the biometric authentication server 300 (S304). At this time, the public key of the specific user can be transmitted together with the public key. Of course, Idhash may be sent instead of Uhash as described above. The biometric authentication server 300 can transmit the value obtained by processing the Uhash or the Uhash to the authentication support server 100 as (i) the public key and (ii) the hash value of the specific user information or a processed value thereof (S306). In this case, the value obtained by machining Uhash may be Idhash. The processor 110 can confirm whether or not the public key is registered in the local database when (i) the public key of the specific user and (ii) the hash value of the specific user information or the processed value is obtained (S308 ).

If it is determined that the public key is not registered, the communication unit 120 can transmit an error message because the authentication information is not registered (S312). The error message may be communicated to the user terminal 500 via the bank server 400.

If the public key is registered, the communication unit 120 acquires the output value of the specific transaction corresponding to the transaction ID from the database 200 using the transaction ID corresponding to the public key (S314, S316), and a new transaction having at least a part of the output value as an input value is generated and transmitted to the database 200 (S328). Specifically, the communication unit 120 generates an unsigned transaction having an input value of at least a part of the predetermined virtual money as the output value, signs it with the private key of the authentication support server 100 to generate a signed transaction, transaction. The communication unit 120 may acquire a transaction ID indicating the location information recorded on the database 200 in step S330 and notify the biometric authentication server 300 of the discard of the authentication information (S332). The notification message may be transmitted to the user terminal 500 via the bank server 400. [

However, prior to performing such an operation, the communication unit 120 may check the status information of the authentication information and transmit an error message. That is, when the public key is in the registration state, the communication unit 120 receives, as the output value of the specific transaction corresponding to the transaction ID, the public ID from the database 200 using the transaction ID corresponding to the public key (S316). If the public key obtained from the database 200 does not correspond to the public key obtained from the biometric authentication server 300 (S320), the state information of the authentication information As a result of referring to the status information, if it is determined that the authentication information is in a predetermined state (S324), an error message can be transmitted to the biometric authentication server 300 (S322, S326). The error message may be communicated to the user terminal 500 via the bank server 400. The state may be a state that satisfies a predetermined condition in a contracted state or contract.

The configuration and operation of the authentication support server using authentication information will be described below. The authentication support server described below may be configured as a separate apparatus from the authentication support server 100, but will be described as the same apparatus for convenience of explanation.

FIG. 4 is a sequence diagram illustrating a process of using authentication information upon login according to another embodiment of the present invention.

4, the processor 110 can confirm whether or not the public key is registered when a public key of a specific user is obtained from the biometric authentication server 300 that received the authentication information use request from the bank server 400 (S408).

The process before confirming whether or not the public key is registered is similar to the process of generating and registering the authentication information and discarding the authentication information, so that redundant explanation is omitted.

If the public key is unregistered (S410), the communication unit 120 transmits an error message to the biometric authentication server 300 (S412) because there is no authentication information available. In this case, the biometric authentication server 300 may transmit an error message to the bank server 400, and the bank server 400 may transmit an error message to the user terminal 500.

If the public key is registered, the communication unit 120 transmits the public key of the specific user to the biometric authentication server 300 in step S428. If the public key is registered in the public key of the biometric authentication server 300, (I) the biometric authentication server 300 generates a random nonce, and (ii) when the biometric information of the specific user is obtained, the random nonce is added to the biometric information of the specific user (S444), and (iii) a message about the verification result is transmitted to the bank server 400 (S444). The signature of the corresponding private key may be verified using the public key of the specific user.

If the public key is registered, the communication unit 120 transmits the public key of the specific user to the biometric authentication server 300 (S428), and transmits the public key of the specific user to the biometric authentication server 300 The biometric authentication server 300 can use the public key of the specific user managed by the biometric authentication server 300, and the biometric authentication server 300 can generate the random nonce. The biometric authentication server 300 can forward the generated random nonce to the bank server 400 (S430). The bank server 400 may forward the received random nonce to the user terminal 500 (S432). After receiving the random nonce, the user terminal 500 can acquire the biometric information of the specific user (for example, a fingerprint input process can be performed), and the user terminal 500 transmits the random non- Signed with the private key corresponding to the biometric information of the specific user, and may transmit the signed signature to the bank server 400 (S434). The bank server 400 transmits a value obtained by signing the received random nonce to a private key corresponding to the biometric information of the specific user, to the biometric authentication server 300 (S436). The biometric authentication server 300 verifies the value obtained by signing the random nonce with the private key corresponding to the biometric information of the specific user using the public key of the specific user at step S438. If the verification result is not true (S440), the biometric authentication server 300 can transmit a message indicating that the biometric information input by the specific user is not suitable (S442). This message is finally transmitted to the user terminal 500 through the bank server 400. On the other hand, if the verification result is true, the biometric authentication server 300 can transmit a message indicating that the verification is successful and can perform the login normally (S444). For reference, the user's biometric information may be at least a part of iris information, fingerprint information, and face information.

However, prior to performing such an operation, the communication unit 120 may check the status information of the authentication information and transmit an error message. That is, if it is determined that the public key is registered, the communication unit 120 receives the transaction ID corresponding to the transaction ID from the database 200 using the transaction ID corresponding to the public key, The public key obtained from the database 200 does not correspond to the public key obtained from the biometric authentication server 300 at step S420, It is possible to transmit an error message to the biometric authentication server 300 (S422, S426) if it is determined that the authentication information is in a predetermined state (S424). The error message is transmitted to the user terminal 500 via the bank server 400. The state may be a state of being destroyed or satisfying a predetermined condition of the contract.

FIG. 5 is a sequence diagram illustrating a process of using authentication information in a transaction according to another embodiment of the present invention.

5, when the public key of a specific user is obtained from the biometric authentication server 300 that receives the authentication information use request from the bank server 400, the processor 110 can confirm whether or not the public key is registered (S514).

The process before confirming whether or not the public key is registered may be similar to the process of generating and registering the authentication information and discarding the authentication information, so redundant description will be omitted.

If the public key is unregistered (S516), the communication unit 120 may transmit an error message indicating that the public key is not registered in the biometric authentication server 300 (S518). The error message may be communicated to the user terminal 500 via the bank server 400.

If the public key is registered, the communication unit 120 transmits the public key of the specific user to the biometric authentication server 300 (S534), and the biometric authentication server 300 manages the public key of the specific user (I) the biometric authentication server 300 transmits a hash value (Thash) of the transaction information or a value obtained by processing the processed value to a private key corresponding to the biometric information of the specific user (S536), and (ii) a message about the verification result to the bank server 400 (S538, S540).

More specifically, the bank server 400 may generate a hash value (Thash = hash (Transaction)) of transaction information or a processed value thereof (S504), and may transmit it to the user terminal 500 S506). At this time, when the biometric information of a specific user is acquired, the user terminal 500 transmits a hash value (Thash) of the transaction information or a processed value thereof to a value (A) obtained by signing with a private key corresponding to the biometric information of the specific user To the bank server 400 (S508). Then, the bank server 400 can transmit the A to the biometric authentication server 300. At this time, the public key, Thash, Idhash, etc. of a specific user can be transmitted together. Of course, the public key, Idhash, etc. of a particular user may be transferred before. 5, Thash and Idhash are transmitted together with the biometric authentication server 300. After the public key and the Idhash are transmitted from the biometric authentication server 300 to the authentication support server 100, , But the generation and delivery of the Thash may be performed separately from the transmission of the public key, the registration confirmation, and the transfer of the Idhash.

If the verification result is false (S538), the communication unit 120 may transmit a message indicating that the biometric information input by the specific user does not match (S540). The message is delivered to the user terminal 500 via the bank server 400.

However, prior to performing such an operation, the communication unit 120 may check the status information of the authentication information and transmit an error message. That is, if it is determined that the public key is registered, if the public key is registered, the public key and the public key are used as output values of the specific transaction corresponding to the transaction ID from the database 200 using the transaction ID corresponding to the public key (S522). If the public key obtained from the database 200 does not correspond to the public key obtained from the biometric authentication server 300 (S526), the state information of the authentication information is referred to If it is determined that the authentication information is in a predetermined state (S530), an error message may be transmitted to the biometric authentication server 300 (S528, S532). The error message is delivered to the user terminal 500 via the bank server 400. The state may be a state that satisfies a predetermined condition in a contracted state or contract.

The communication unit 120 may transmit the hash value of the transaction information or a value obtained by signing the hash value of the transaction information or the processed value with the private key to record the value X1 or the hash value X2 thereof in the database 200 (S544). This is to record the transaction information in the database 200 for the purpose of preventing non-repudiation at the time of transaction.

The communication unit 120 may obtain the transaction ID indicating the location information recorded on the database 200 by the X1 or X2 in operation S546 and may transmit the obtained transaction ID to the biometric authentication server 300 (S548). The transaction ID may be transferred to the user terminal 500 via the bank server 400.

The authentication support server 100 according to various embodiments of the present invention combines a block-chaining technology with a biometric authentication technology to generate a certificate based on a PKI, registers it on a block chain, and can use and manage the certificate do.

On the other hand, it is inefficient to access and record the database 200 in all cases where authentication information needs to be registered. Especially, when there are many transaction requests, bottleneck phenomenon of service provision may occur and there is a concern that the transaction fee may be paid for each time a service operation is costly.

Hereinafter, a system capable of registering and destroying authentication information capable of reducing the cost and speeding up the service even when the service request is made while taking advantage of the fact that the authentication information can be registered in real time, Explain. This system uses a separate data structure managed by the authentication support server 100, unlike the above-described embodiment. The authentication support server described below may be configured as a separate apparatus from the authentication support server 100, but will be described as the same apparatus for convenience of explanation.

The communication unit 120 acquires, from the biometric authentication server 300 that received the registration information for the authentication information, the public key of the specific user and (ii) the hash value of the specific user information or the value Can be obtained.

At this time, the public key of the specific user is generated in the user terminal 500 and transmitted to the bank server 400. When the specific user is authenticated and the hash value Uhash of the specific user information is received from the bank server 400, A value obtained by processing (i) the public key and (ii) the Uhash or the Uhash may be transmitted to the authentication support server 100 from the biometric authentication server 300 (See FIG. 2 and the description thereof). Since the authentication method of a specific user has been described in the above-mentioned embodiment, redundant description will be omitted. When a user id is generated using Uhash, the user id and the hash value Idhash of the Uhash may be transmitted instead of Uhash. Idhash can be SHA256hash. Also, the value obtained by processing Uhash may be Idhash, which is the hash value of the user id and the Uhash when the user id is generated using the Uhash, as in the above-described embodiment.

The processor 110 can confirm whether or not the public key is registered when the (i) public key of the specific user and (ii) the hash value of the specific user information or the processed value are obtained. If the public key is in the unregistered state and the predetermined anchoring condition is satisfied, the specific hash value (i) the public key of the specific user and (ii) the hash of the specific user information Or a value obtained by processing the representative hash value or the representative hash value generated by calculating at least one neighboring hash value matching the specific hash value with a predetermined data structure, 200). ≪ / RTI >

The computation of a particular hash value and at least one neighbor hash value may be performed by various functions. A particular hash value is denoted as input, and at least one neighboring hash value is denoted by x1, x2, ... , xn, the representative hash value t can be expressed by the following equation.

≪ Equation &

t = hash (function (input, x1, x2, ..., xn))

At this time, the authentication support server 100 may store and manage the specific hash value and the at least one neighbor hash value in a predetermined data structure. Here, the data structure may be various, for example, a merkle tree structure. In this case, the calculation of the specific hash value and the at least one neighbor hash value may be performed through a merkle tree.

That is, the processor 110 can support the generation or generation of a merkle tree assigned to a particular leaf node, and if the public key is not yet registered and the predetermined anchoring condition If it is satisfied, the representative hash value or the representative hash value generated by computing the hash value assigned to at least one other leaf node matching the specific hash value is registered or registered in the database 200 .

More specifically, in this case (x1), the processor 110 is configured to (i) calculate or calculate the hash value assigned to the sibling node of the node to which the specific hash value is assigned and (ii) And to assign or assign a hash value for the computed value to the parent node of the node. (x2) If the parent node is the root node of the merge tree, the hash value assigned to the parent node is the representative hash value. (x3). On the other hand, if the parent node is not the root node of the merge tree, the processor 110 repeats the above (x1) to (x3) with the hash value assigned to the parent node as the specific hash value .

The processor 110 finally registers or registers the hash value assigned to the root node of the merge tree as a representative hash value in the database 200. At this time, a value obtained by processing the representative hash value may be registered. For example, the result of performing the hex operation on the representative hash value can be registered.

Meanwhile, the authentication support server 100 stores the specific hash value and the at least one neighbor hash value in a predetermined first data structure, and then stores a second data structure of the same type as the first data structure In case of managing, the first data structure and the second data structure may be connected in a chain form.

In particular, as in the above example, if the first data structure and the second data structure are merc trees, the root value of the first data structure or the hash value of the root value may be the first leaf node of the second data structure Lt; / RTI > In addition, when the second data structure is created, verification of the first data structure is performed, so that data integrity can be further guaranteed.

In addition, in the case of the first merge tree among the at least one merge tree connected in a chain form, the first leaf node of the first merge tree is assigned a hash value of a predetermined message data composed of text, numbers, or symbols or a processed value thereof . For example, a hash value of an input message initially assigned by the authentication support server 100 can be assigned when generating a merge tree.

6 and 7 are diagrams illustrating examples of a merge tree generated according to an embodiment of the present invention.

FIG. 6 shows a merge tree having 4 (2 ² ) leaf nodes. Since the illustrated merge tree is the first merge tree (tree_id = 0), it can be seen that the hash value (triplesha256digest (coinplug_unique_message)) of the predetermined message data "Coinplug 2016-01-01" is assigned to the first leaf node h1. If there is a registration request for the authentication information, the processor 110 creates the next leaf node of the last leaf node of the currently configured member tree to generate a leaf node of (i) a public key of the specific user and (ii) Value or a hash value (a specific hash value) of the processed value or a processed value thereof. For example, when the value assignment from the previous step to the h1 node as the second leaf node is completed in the merge tree of FIG. 6, the next leaf node h2 is created and the value obtained by processing a specific hash value or a specific hash value (triplesha256digest (input2 )). The processor 110 may also support computing or computing a hash value assigned to (i) a particular hash value and (ii) the h3 node, which is the sibling node of the h2 node, which is the third leaf node to which the particular hash value is assigned. The hash value for the computed value is assigned to the h2 node and the parent node (h23 node) of the h3 node. Since the parent node (h23 node) is not the root node of the merge tree, the processor 110 may repeat the above process with the hash value assigned to the h23 node as the specific hash value. That is, the hash value assigned to the h23 node is set as a specific hash value, and the hash value assigned to the h23 node and the hash value assigned to the h01 node are calculated and assigned to the h23 node and the parent node (h0123 node) of the h01 node have. At this time, since the h0123 node is the root node of the merge tree, the processor 110 can support registration or registration of a value (hex (h {node_index})) obtained by processing the hash value assigned to the node h0123 in the database 200 .

On the other hand, the predetermined anchoring conditions are (i) a predetermined number of (i-1) public keys of the specific user and (i-2) hash values of the specific user information or values obtained by processing Condition, (ii) a condition that a predetermined time elapses, (iii) a condition in which a block is generated in a block chain, and (iv) a condition for a service characteristic.

For example, the processor 110 may generate the root value of the above mentioned muckree at predetermined time intervals (condition (ii) above). In this case, the processor 110 may generate a merge tree using the input values up to that time and register or register the root value of the merge tree in the database 200 when a predetermined time elapses.

In this case, although a predetermined time has elapsed, a value may not be assigned to a sibling node of a node to which a particular hash value of the merge tree is assigned. If the hash value is not allocated to the sibling node of the node to which the specific hash value is allocated, the processor 110 supports the sibling node to allocate or assign a predetermined hash value to the sibling node, The route value of the merge tree can be calculated in one way. For example, the processor 110 may support copying and assigning or assigning the particular hash value to the sibling node.

On the other hand, the service characteristics include the cost information paid by the user (company) who made the authentication information registration request, the time zone information in which the authentication information registration is performed, the area information in which the authentication information registration service is performed, At least in part. However, the present invention is not limited to the one described here, but may include various condition information that can be provided with a generally accepted differential service.

On the other hand, when a new merge tree generation is started and the predetermined condition (e.g., time condition) is satisfied in a state where there is no registration request of authentication information, the processor 110 transmits predetermined message data Data) to create or generate a merge tree assigned to the first leaf node and the second leaf node, and to register or register the root value of the merge tree or the processed value in the database 200. In this case, a merge tree with two leaf nodes can be created. Of course, it is not limited to two.

Meanwhile, as described above, the authentication support server 100 stores the specific hash value and the at least one neighbor hash value in a predetermined first data structure, and then stores a second data structure of the same type as the first data structure The first data structure and the second data structure may be connected in a chain form. In particular, if the first data structure and the second data structure are merc trees, a root value of the first data structure or a hash value of the root value may be assigned to a first leaf node of the second data structure.

FIG. 7 is a diagram illustrating a merge tree generated as the second data structure according to an embodiment of the present invention.

Referring to Fig. 7, it can be seen that the root value (hex (h0123)) of the merge tree (tree_id = 0) of Fig. 6 is assigned to the first leaf node (h4 node) of the new merge tree (triplesha256digest (input4)). The present invention has an advantage of improving data integrity by enabling easy tracking even when data is modulated in the middle by connecting a plurality of data structures generated at the time of occurrence of a transaction.

If it is determined that the public key is registered, the communication unit 120 can transmit an error message to the biometric authentication server 300 because it means that authentication information has already been registered. The error message may be communicated to the user terminal 500 via the bank server 400. Of course, it may also be delivered directly to the user terminal 500.

Meanwhile, the specific hash value may be a hash value of (i) a public key of the specific user, (ii) a hash value of the specific user information or a value obtained by processing the specific user information, and (iii) a predetermined amount of virtual money. In this case, (iii) a predetermined amount of virtual money can be used to indicate whether or not the authentication information is destroyed.

In addition, the processor 110 may store a hash value of the specific user information or a processed value thereof, and a public key of the specific user in a local database.

When the value obtained by processing the representative hash value or the representative hash value is registered on the database 200, the communication unit 120 acquires a transaction ID indicating location information recorded on the database 200, (I) the public key and (ii) a message informing that the hash value or the processed value has been registered normally can be transmitted to the server 300. The message may be delivered to the user terminal 500 via the bank server 400. Of course, it may be directly transmitted to the user terminal 500 or the bank server 400.

Hereinafter, a method of performing the destruction of the authentication information by the authentication support server 100 will be described.

As in the above-described embodiment, the communication unit 120 receives from the biometric authentication server 300 which received the revocation request for the authentication information a secret key of a specific user (i) a hash value of the specific user information or a value . Since the process of confirming whether or not the public key is registered has already been described above, the redundant explanation is omitted (refer to FIG. 3 and the description thereof).

The processor 110 confirms whether or not the public key is registered when (i) a public key of the specific user and (ii) a hash value of the specific user information or a processed value thereof. If the public key is in the registration state and the predetermined anchoring condition is satisfied as a result of the checking, the specific hash value - the specific hash value is (i) the public key of the specific user and (ii) A representative hash value generated by computing a hash value or a hash value for a value obtained by processing the hash value or the processed value and at least one neighbor hash value matched with the specific hash value or a value obtained by processing the representative hash value, The user terminal 200 can perform registration or registration of the authentication information and perform destruction of the authentication information.

The process of destroying the authentication information is similar to the process of registering the authentication information. In this case, the process of destroying the specific authentication information is the same as the process of registering the authentication information, so redundant description is omitted. Further, the predetermined data structure may be a merge tree as described above. Therefore, registration and destruction can be distinguished according to the order in which a particular hash value is recorded in the predetermined data structure. That is, the first hash value recorded in the data structure represents the registration of the authentication information, and the second recorded hash value represents the discard of the authentication information.

In this case, if the obtained public key of the specific user and (ii) the hash value of the specific user information or the processed value correspond to a pre-registered value, the public key is registered And the processor 110 may register the representative hash value or the processed value of the representative hash value in the database 200 according to whether the predetermined anchoring condition is satisfied.

Whether or not the public key is registered can be confirmed in the local database. That is, when the public key is registered in the local database, if the predetermined anchoring condition is satisfied, the processor 110 generates the at least one neighboring hash value matching the specific hash value, A representative hash value or a value obtained by processing the representative hash value may be registered or registered in the database 120 to perform destruction of the authentication information.

In particular, when the predetermined data structure is a merge tree, a public key of the specific user and (ii) a hash value of the specific user information or a value obtained by manipulating the hash value of the specific user information are transmitted to a predetermined leaf node of a merkle tree, When the predetermined anchoring condition is satisfied, the processor 110 generates a hash value assigned to at least one other leaf node matching the specific hash value, The hash value or the value obtained by processing the representative hash value is registered or registered in the database 200, thereby performing the destruction of the authentication information.

On the other hand, if the public key is unregistered or registered in at least two leaf nodes of the merkle tree, the communication unit 120 may transmit an error message to the biometric authentication server 300 . If the public key is assigned to at least two leaf nodes of the merge tree, then registration and destruction are both performed on the authentication information, and the authentication information is currently in the destroyed state. The error message may be communicated to the user terminal 500 via the bank server 400.

Hereinafter, the configuration and operation of the authentication support apparatus 100 capable of supporting log-in using the above-described authentication information will be described. The authentication support server described below may be configured as a separate apparatus from the authentication support server 100, but will be described as the same apparatus for convenience of explanation.

The authentication support server 100 has previously processed the first representative hash value or the first representative hash value generated by computing the first specific hash value and the at least one neighboring hash value matching the first specified hash value (1) a public key of a specific user, and (2) a hash value of the specific user information or a hash value of the specific user information in the state that the value is registered in the database 200 as a predetermined data structure. The processed value can be obtained. Here, the first specific hash value and the first representative hash value correspond to the aforementioned specific hash value and representative hash value.

Meanwhile, when the public key of the specific user is transmitted to the bank server 400, and the specific user is authenticated and the hash value Uhash of the specific user information is transmitted from the bank server 400 to the biometric authentication server 300 , A value obtained by processing (i) the public key and (ii) the Uhash or the Uhash from the biometric authentication server 300 may be transmitted to the authentication support server 100. [ Since this has been described in the above-described embodiment, redundant description is omitted (refer to FIG. 4 and the description thereof).

The processor 110 may further include: a second hash value that is a hash value for (1) and (2) and at least one neighbor hash value that matches the second specific hash value, The second representative hash value or the second representative hash value generated by computing the second representative hash value with reference to the predetermined data structure is stored in the first representative hash value or the first representative hash value registered in the database 200 If a value corresponding to the processed value of the representative hash value is found, the public key of the specific user is transmitted to the biometric authentication server 300 or the public key of the specific user managed by the biometric authentication server 300 is used (i ) Supporting the biometric authentication server 300 to generate or generate a random nonce, and (ii) if the biometric information of the specific user is acquired as a login operation for the specific user, Support to a value signed with private key verified using the public key of the specific user or verify the biometric information corresponding to a particular user and, (iii) can be supported so as to transmit or send the message to the verification result.

In step (ii), the random nonce is signed by the private key corresponding to the biometric information of the specific user by the user terminal 500 and transmitted to the biometric authentication server 300 via the bank server 400 .

Also, if the verification result in step (iii) is false, the processor 110 can support the transmission of a message indicating that the biometrics information input by the specific user is not correct, indicating that the login is not permitted.

For the second specific hash value, the description of the first specific hash value described above can be applied equally. That is, the operation of the second specific hash value and the at least one neighbor hash value can be performed by various functions. Since this has been described above, the explanation is omitted.

If the value obtained by processing the second representative hash value or the second representative hash value does not correspond to the value obtained by processing the first representative hash value or the first representative hash value registered in the database 200, If it is determined that the authentication information is in a predetermined state as a result of referring to the state information of the authentication information for (1) and (2) stored in the database, the communication unit 120 transmits an error message to the biometric authentication server 300 Lt; / RTI > For example, when the authentication information is in a destroyed state, the communication unit 120 may transmit an error message to the biometric authentication server 300. [

When the above-mentioned (1) and (2) are allocated to at least two leaf nodes of the merkle tree, the communication unit 120 determines that the authentication information has been destroyed and transmits the authentication information to the biometric authentication server 300 ). ≪ / RTI >

The processor 110 may refer to a predetermined transaction ID and acquire or obtain an OP message from the database 200 using the transaction ID when an authentication information use request is obtained. If the value obtained by processing the second representative hash value or the second representative hash value corresponds to the value obtained by processing the first representative hash value or the first representative hash value included in the OP message, (I) to (iii) by transmitting the public key of the biometric authentication server 300 to the biometric authentication server 300 or using the public key of the specific user managed by the biometric authentication server 300. [

The second representative hash value may be at least one other hash value that matches the second specific hash value and the second specific hash value in a merkle tree assigned to a particular leaf node. Can be generated by computing a hash value assigned to a leaf node.

In the process of determining whether the value obtained by processing the second representative hash value or the second representative hash value corresponds to the value obtained by processing the first representative hash value or the first representative hash value, In which a merge tree generated in the authentication information registration process described above can be used. That is, the processor 110 computes a hash value assigned to the sibling node of the node to which the second specific hash value is assigned in the existing generated merge tree (y1) (i) And support to assign or assign a hash value for the operation value to a parent node of the node in a new merge tree. (Y2) if the parent node is the root node of the new merge tree, comparing the hash value assigned to the parent node with the value contained in the OP message as the second representative hash value, and y3) If the parent node is not the root node of the new merge tree, it may repeat the operations (y1) to (y3) using the hash value assigned to the parent node as the second specific hash value.

When the root value of the finally generated muckree or the processed value corresponds to the value obtained by processing the first representative hash value or the first representative hash value included in the OP message, ) A public key of a specific user and (2) a hash value of the specific user information or a value obtained by processing the hash value of the specific user information.

As described above, according to the present invention, when the merge tree having n ^m (= N) leaf nodes is generated in the authentication information registration step, only the operation of the merge tree height (log _n N = m) User authentication can be performed to use authentication information.

Hereinafter, the configuration and operation of the authentication support apparatus 100 capable of supporting transactions using the above-described authentication information will be described. The authentication support server described below may be configured as a separate apparatus from the authentication support server 100, but will be described as the same apparatus for convenience of explanation. For reference, in the following embodiments, the terms of the first specific hash value, the second specific hash value, the first representative hash value, and the second representative hash value are used in combination with the above-described embodiments, but they are distinguished from each other Leave.

The communication unit 120 may include a first representative hash value generated by computing the at least one neighboring hash value that matches the first specified hash value and the first specified hash value, (1) a public key of a specific user, and (2) a hash value of the specific user information or a hash value of the specific user information, as the authentication information use request in a state in which a value obtained by processing one representative hash value is registered in a database as a predetermined data structure. Value can be obtained. Here, the first specific hash value and the first representative hash value correspond to the aforementioned specific hash value and representative hash value.

Meanwhile, when the public key of the specific user is transmitted to the bank server 400, and the specific user is authenticated and the hash value Uhash of the specific user information is transmitted from the bank server 400 to the biometric authentication server 300 , A value obtained by processing (i) the public key and (ii) the Uhash or the Uhash from the biometric authentication server 300 may be transmitted to the authentication support server 100. [ Since this has been described in the above-mentioned embodiment, redundant description is omitted (refer to FIG. 5 and the description thereof).

The processor 110 may further include: a second hash value that is a hash value for (1) and (2) and at least one neighbor hash value that matches the second specific hash value, The second representative hash value or the second representative hash value generated by computing the second representative hash value with reference to the predetermined data structure is stored in the first representative hash value or the first representative hash value registered in the database 200 When the value corresponding to the processed value of the representative hash value is associated with the public key of the specific user, the public key of the specific user is transmitted to the biometric authentication server 300 or the public key of the specific user managed by the biometric authentication server 300 is used i) The biometric authentication server 300 transmits a hash value of the transaction information or a value obtained by signing the hash value of the transaction information with the private key corresponding to the biometric information of the specific user using the public key of the specific user It supports to increase or verified, (ii) can be supported so as to transmit or send the message to the verification result.

In step (i), the hash value or the processed value of the transaction information is generated by the bank server 400, and the hash value of the transaction information or the processed value is transmitted to the user terminal 500, The signature may be signed with a private key corresponding to the biometric information of the user and may be transmitted to the biometric authentication server 300 through the bank server 400 (refer to FIG. 5 and the description thereof).

In step (ii), if the verification result is false, the processor 110 can support transmission of a message indicating that the biometric information inputted by the specific user does not match, thereby disabling the transaction. The message may be transmitted to at least one of the user terminal 500, the bank server 400, and the biometric authentication server 300. Of course, it may be transmitted directly to the user terminal 500.

For the second specific hash value, the description of the first specific hash value described above can be applied equally. That is, the operation of the second specific hash value and the at least one neighbor hash value can be performed by various functions. Since this has been described above, the explanation is omitted.

(I) a value obtained by processing the second representative hash value or the second representative hash value corresponds to a value obtained by processing the first representative hash value or the first representative hash value registered in the database 200 Or (ii) when the authentication information is determined to be in a predetermined state as a result of referring to the state information of the authentication information for (1) and (2) stored in the local database, the communication unit 120 transmits, An error message can be transmitted to the mobile station 300. For example, when the authentication information is in a destroyed state, the communication unit 120 may transmit an error message to the biometric authentication server 300. [

In addition, when the above (1) and (2) are allocated to at least two leaf nodes of a merkle tree, the processor 110 determines that the authentication information has been destroyed, 300 to send an error message.

The processor 110 may refer to a predetermined transaction ID and acquire or obtain an OP message from the database 200 using the transaction ID when an authentication information use request is obtained. If the value obtained by processing the second representative hash value or the second representative hash value corresponds to the value obtained by processing the first representative hash value or the first representative hash value included in the OP message, (I) to (ii) by transmitting the public key of the biometric authentication server 300 to the biometric authentication server 300 or using the public key of the specific user managed by the biometric authentication server 300.

The second representative hash value may be at least one other hash value that matches the second specific hash value and the second specific hash value in a merkle tree assigned to a particular leaf node. Can be generated by computing a hash value assigned to a leaf node.

In the process of determining whether the value obtained by processing the second representative hash value or the second representative hash value corresponds to the value obtained by processing the first representative hash value or the first representative hash value, In which a merge tree generated in the authentication information registration process described above can be used. That is, the processor 110 computes a hash value assigned to the sibling node of the node to which the second specific hash value is assigned in the existing generated merge tree (z1) (i) And support to assign or assign a hash value for the operation value to a parent node of the node in a new merge tree. (Z2) if the parent node is the root node of the new merge tree, compares or compares the hash value assigned to the parent node with the value contained in the OP message as the second representative hash value, and z3) If the parent node is not the root node of the new merge tree, it may repeat the operations (z1) to (z3) using the hash value assigned to the parent node as the second specific hash value.

When the root value of the finally generated muckree or the processed value corresponds to the value obtained by processing the first representative hash value or the first representative hash value included in the OP message, ) A public key of a specific user and (2) a hash value of the specific user information or a value obtained by processing the hash value of the specific user information.

As described above, according to the present invention, when the merge tree having n ^m (= N) leaf nodes is generated in the authentication information registration step, only the operation of the merge tree height (log _n N = m) User authentication can be performed to use authentication information.

Meanwhile, if the verification result is true and the predetermined anchoring condition is satisfied, the processor 110 determines whether the third specific hash value - the third specific hash value is a hash value of the transaction information or a processed value thereof A third representative hash value generated by computing a hash value of a value signed by the private key and at least one neighbor hash value matching the third specific hash value or a value obtained by processing the third representative hash value And may be registered or registered in the database 200. This is for recording transaction information in the database 200 for the purpose of preventing non-repudiation at the time of transaction.

In this case, the communication unit 120 obtains the transaction ID indicating the position information recorded on the database 200 by processing the third representative hash value or the third representative hash value, transaction ID to the biometric authentication server 300.

Meanwhile, the embodiments of the present invention described above can be implemented in the form of program instructions that can be executed through various computer components and recorded in a computer-readable recording medium. The computer-readable recording medium may include program commands, data files, data structures, and the like, alone or in combination. The program instructions recorded on the computer-readable recording medium may be those specially designed and constructed for the present invention or may be those known and used by those skilled in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tape, optical recording media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those generated by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules for performing the processing according to the present invention, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but, on the contrary, Those skilled in the art will appreciate that various modifications, additions and substitutions are possible, without departing from the scope and spirit of the invention as disclosed in the accompanying claims.

Therefore, the spirit of the present invention should not be construed as being limited to the above-described embodiments, and all of the equivalents or equivalents of the claims, as well as the following claims, I will say.

100: Authentication support server
200: Database
300: Biometric authentication server
400: Bank server
500: user terminal
110: Processor
120:

Claims (22)

A method for supporting transactions using block chains of virtual money,
(a) a first representative hash value or a first representative hash value generated by computing an at least one neighboring hash value matching the first specific hash value and the first specific hash value, (1) a public key of a specific user and (2) a user information of the specific user information as a authentication information use request in a state in which a value of the authentication information is registered as a predetermined data structure on the block chain of the virtual money. Obtaining a hash value or a processed value thereof, and
(b) a second specific hash value, which is a hash value for (1) and (2), and at least one neighbor hash value that matches the second specific hash value, A value obtained by processing a second representative hash value or a value obtained by processing the second representative hash value is calculated based on the first representative hash value or the first representative hash value registered on the block chain of the virtual money, When the representative hash value is associated with the processed value,
Wherein the authentication support server transmits a public key of the specific user to the biometric authentication server or uses the public key of the specific user managed by the biometric authentication server so that the biometric authentication server can notify the hash of the transaction information Value or a value obtained by processing the value by using a private key corresponding to the biometric information of the specific user is verified or verified using the public key of the specific user, and (ii) a message about the verification result is transmitted Or transmitting,
(c) if the verification result is true and the predetermined anchoring condition is satisfied, the authentication support server transmits a hash value of the transaction information or a value obtained by processing the third specific hash value to the third specific hash value A third representative hash value generated by computing a hash value of a value signed by the private key and at least one neighbor hash value matching the third specific hash value or a value obtained by processing the third representative hash value A step of registering or registering on the block chain of the virtual money
≪ / RTI > The method according to claim 1,
In the step (b)
The value obtained by processing the second representative hash value or the second representative hash value does not correspond to the value obtained by processing the first representative hash value or the first representative hash value registered on the block chain of the virtual money
When it is determined that the authentication information is in a predetermined state as a result of referring to the state information of the authentication information for (1) and (2) stored in the local database, the authentication support server transmits an error message to the biometric authentication server Lt; / RTI > 3. The method of claim 2,
If (1) and (2) are allocated to at least two leaf nodes of a merkle tree, the authentication support server judges that the authentication information has been destroyed and sends an error message to the biometric authentication server Lt; / RTI > The method according to claim 1,
In (ii) above,
If the verification result is false, the biometrics information input by the specific user does not match, thereby supporting a message indicating that the transaction is not allowed. The method according to claim 1,
In (i) above,
A hash value or a processed value of the transaction information is generated by a bank server and a hash value of the transaction information or a value obtained by processing the hash value is transmitted to a user terminal and a signature is signed with a private key corresponding to the biometric information of the specific user And transmitted to the biometric authentication server via the bank server. delete The method according to claim 1,
(d) obtaining, by the authentication support server, a transaction ID representing a value obtained by processing the third representative hash value or the third representative hash value, the position information being recorded on the block chain of the virtual money; and
(e) transmitting, by the authentication support server, the obtained transaction ID to the biometric authentication server. The method according to claim 1,
The step (a)
When the public key of the specific user is transmitted to the bank server, and the specific user is authenticated and Uhash, which is a hash value of specific user information, is transmitted from the bank server to the biometric authentication server, (i) key and (ii) a value obtained by processing the Uhash or the Uhash is transmitted to the authentication support server. The method according to claim 1,
The step (a)
(a1) when the authentication information use request is obtained, the authentication support server refers to a predetermined transaction ID, and
(a2) the authentication support server obtaining an OP message from the block chain of the virtual currency using the transaction ID,
In the step (b)
If the value obtained by processing the second representative hash value or the second representative hash value corresponds to a value obtained by processing the first representative hash value or the first representative hash value included in the OP message, (I) to (ii) by transmitting the public key of the specific user to the biometric authentication server or using the public key of the specific user managed by the biometric authentication server. The method according to claim 1,
The second representative hash value is a value
The hash value assigned to at least one other leaf node matching the second specific hash value and the second specific hash value in the merkle tree allocated to the specific leaf node is calculated ≪ / RTI > 11. The method of claim 10,
(x1) the authentication support server supports to calculate or calculate a hash value assigned to (i) the second specific hash value and (ii) the sibling node of the node to which the second specific hash value is assigned, To assign or assign a hash value for the value to the parent node of the node,
(x2) if the parent node is the root node of the merge tree, comparing the hash value assigned to the parent node with the value contained in the OP message obtained from the block chain of the virtual currency as the second representative hash value Compare,
(x3) If the parent node is not the root node of the merge tree, the step (x1) to (x3) are repeated by using the hash value assigned to the parent node as the second specific hash value Way. An authentication support server for supporting a transaction using a block chain of virtual money,
A first representative hash value generated by computing the first hash value and at least one neighbor hash value matched with the first specific hash value or a value obtained by processing the first representative hash value (1) a public key of a specific user; and (2) a hash value of the specific user information or a value obtained by processing the public key and the hash value of the specific user information in a state of being registered on the block chain of the virtual money as a predetermined data structure A communicating section for acquiring
The at least one neighborhood hash value matching the second specific hash value and the second specific hash value that are the hash values of (1) and (2) Or a value obtained by processing the second representative hash value is calculated based on the first representative hash value or the first representative hash value registered on the block chain of the virtual money The biometric authentication server transmits the public key of the specific user to the biometric authentication server or uses the public key of the specific user managed by the biometric authentication server, The hash value of the specific user or a value obtained by signing the hashed value of the hash value or the processed value with the private key corresponding to the biometric information of the specific user is verified or verified using the public key of the specific user And (ii) a processor that supports sending or transmitting a message for the verification result,
The processor comprising:
If the verification result is true and the predetermined anchoring condition is satisfied, the third specific hash value - the third specific hash value is a value obtained by adding a hash value of the transaction information or a processed value thereof to the private key And a third representative hash value generated by calculating at least one neighboring hash value that matches the third specific hash value or a value obtained by processing the third representative hash value on the block chain of the virtual currency Wherein the server is configured to support registration or registration. 13. The method of claim 12,
(i) a value obtained by processing the second representative hash value or the second representative hash value is a value obtained by processing the first representative hash value or the first representative hash value registered on the block chain of the virtual money Or (ii) when the authentication information is determined to be in a predetermined state as a result of referring to the state information of the authentication information for (1) and (2) stored in the local database, the communication unit transmits an error And transmits the message to the authentication server. 14. The method of claim 13,
If (1) and (2) are allocated to at least two leaf nodes of a merkle tree, the processor determines that the authentication information has been destroyed and transmits an error message to the biometric authentication server Wherein the authentication server comprises: 13. The method of claim 12,
In (ii) above,
And if the verification result is false, the processor supports to transmit a message indicating that the biometrics information input by the specific user is not correct, indicating that the transaction is not allowed. 13. The method of claim 12,
In (i) above,
A hash value or a processed value of the transaction information is generated by a bank server and a hash value of the transaction information or a value obtained by processing the hash value is transmitted to a user terminal and a signature is signed with a private key corresponding to the biometric information of the specific user And transmitted to the biometric authentication server via the bank server. delete 13. The method of claim 12,
Wherein,
Acquiring a transaction ID indicating a value obtained by processing the third representative hash value or the third representative hash value on the block chain of the virtual currency and transmitting the obtained transaction ID to the biometric authentication server And transmits the authentication result to the authentication server. 13. The method of claim 12,
When the public key of the specific user is transmitted to the bank server, and the specific user is authenticated and Uhash, which is a hash value of specific user information, is transmitted from the bank server to the biometric authentication server, (i) key and (ii) a value obtained by processing the Uhash or the Uhash is transmitted to the authentication support server. 13. The method of claim 12,
The processor comprising:
When the authentication information use request is obtained, to refer to a predetermined transaction ID and to acquire an OP message from the block chain of the virtual currency using the transaction ID, and the second representative hash value or the second representative value If the value obtained by processing the hash value corresponds to a value obtained by processing the first representative hash value or the first representative hash value included in the OP message, the public key of the specific user is transmitted to the biometric authentication server, (I) to (ii) by using the public key of the specific user managed by the authentication server. 13. The method of claim 12,
The second representative hash value is a value
The hash value assigned to at least one other leaf node matching the second specific hash value and the second specific hash value in the merkle tree allocated to the specific leaf node is calculated The authentication support server comprising: 22. The method of claim 21,
(x1) the processor is configured to: (i) calculate or calculate a hash value assigned to the sibling node of the node to which the second specific hash value and (ii) the second specific hash value are assigned, To assign or assign a hash value to the parent node of the node,
(x2) if the parent node is the root node of the merge tree, comparing the hash value assigned to the parent node with the value contained in the OP message obtained from the block chain of the virtual currency as the second representative hash value Compare,
(x3) If the parent node is not the root node of the merge tree, the step (x1) to (x3) are repeated by using the hash value assigned to the parent node as the second specific hash value Authentication support server.

Images