KR101861591B1 - Method and device for enrolling and authenticating biometric code - Google Patents

Abstract

Receiving first biometric information, generating a first biometric code by combining the first biometric information and dummy data, encoding the first biometric code with an error correction code, converting the first biometric code into a hash And storing the encoded first biometric code and the hashed first biometric code in a database, wherein the biometric code is registered and authenticated.

Description

METHOD AND DEVICE FOR ENROLLING AND AUTHENTICATING BIOMETRIC CODE [0002]

The present invention relates to a method and apparatus for registering and authenticating a biometric code.

Content stored in a device often stores important data related to the privacy of an individual, and there is an increasing tendency to protect the privacy of an individual. Accordingly, techniques for encrypting and decrypting contents have been developed.

However, since a user has to perform a separate procedure in order to encrypt or decrypt the content, a demand for a method for simplifying the encryption or decryption process of the content is increasing. For example, user authentication and encryption techniques using biometric information are introduced.

It can be assumed that the digital information is represented by a binary information sequence consisting of 0 and 1. This block is divided into k blocks. Each block is called an information vector. The encoding process is a process of mapping a vector composed of n bits to one information vector. In this process, the corresponding vector is called a codeword or a code vector. The set of all codewords is called the [n, k] code. The bits added in the encoding process are referred to as parity bits. In most cases, each parity bit is formed by a specific linear combination of information bits. Generally, the error correction capability of codes varies greatly depending on the linear combination of nk parity bits for given n and k.

Registered Patent Publication No. 10-1622377, Registered on May 12, 2016

An object of the present invention is to provide a method of an authentication device for registering and authenticating biometric information without storing original biometric information and an electronic device including the same.

The problems to be solved by the present invention are not limited to the above-mentioned problems, and other problems which are not mentioned can be clearly understood by those skilled in the art from the following description.

A method of registering and authenticating a biometric code according to an embodiment of the present invention includes a step of extracting a feature vector from a bio (= bio) to generate a first biometric code (= w), a first biometric code (= w) Generating a first biometric code (w || e) by concatenating dummy data to the first biometric code (w), generating the first biometric code (w || e) based on an error correction algorithm XORing the first biometric code (= w) with the encoded Codeword, hashing the first biometric code (= w) based on the hash function, And storing the hashed first biometric code (= H (w)) in the database.

According to an embodiment of the present invention, there is provided an apparatus for registering and authenticating a biometric code, comprising: a biometric sensor for receiving a biometric body; an extraction step / device for extracting a feature vector from the biometric entity to generate a biometric code; (Encoding step / device) for generating a bio-dummy code by adding data to the bio-dummy code and XORing the bio-dummy code with an codeword encoded based on an error correction algorithm [encoding step / device] A storage device for storing the verification code and the hashed biometric code in a database, and an encryption device for creating and using an encryption key in the biometric code.

Other specific details of the invention are included in the detailed description and drawings.

According to the embodiment of the present invention, a method and an apparatus for registering and authenticating a biometric code may store the biometric code of the user, for example, by storing the corresponding verification data and the hashed biometric code without directly storing the biometric information, And can easily perform user authentication using the registered biometric code.

The effects of the present invention are not limited to the above-mentioned effects, and other effects not mentioned can be clearly understood by those skilled in the art from the following description.

1 is a block diagram illustrating an authentication system using a biometric code according to an exemplary embodiment of the present invention.
2 is a ladder diagram illustrating an exemplary biometric registration process according to an embodiment of the present invention.
3 is a flow chart illustrating an exemplary method of generating a random code according to an embodiment of the present invention.
4 is a view showing an embodiment of a biometric registration process of an authentication apparatus according to an embodiment of the present invention.
5 is a flowchart illustrating an authentication process of an authentication apparatus according to an embodiment of the present invention.
FIG. 6 is a block diagram illustrating an exemplary data encryption process using a biometric code according to an embodiment of the present invention. Referring to FIG.
FIG. 7 is a diagram illustrating a data decoding process using a biometric code according to an embodiment of the present invention. Referring to FIG.
8 is a block diagram illustrating an exemplary electronic device according to an embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The advantages and features of the present invention, and the manner of achieving them, will be apparent from and elucidated with reference to the embodiments described hereinafter in conjunction with the accompanying drawings. It should be understood, however, that the invention is not limited to the disclosed embodiments, but may be embodied in many different forms and should not be construed as limited to the embodiments set forth herein, Is provided to fully convey the scope of the present invention to a technician, and the present invention is only defined by the scope of the claims.

The terminology used herein is for the purpose of illustrating embodiments and is not intended to be limiting of the present invention. In the present specification, the singular form includes plural forms unless otherwise specified in the specification. The terms " comprises "and / or" comprising "used in the specification do not exclude the presence or addition of one or more other elements in addition to the stated element. Like reference numerals refer to like elements throughout the specification and "and / or" include each and every combination of one or more of the elements mentioned. Although "first "," second "and the like are used to describe various components, it is needless to say that these components are not limited by these terms. These terms are used only to distinguish one component from another. Therefore, it goes without saying that the first component mentioned below may be the second component within the technical scope of the present invention.

Unless defined otherwise, all terms (including technical and scientific terms) used herein may be used in a sense that is commonly understood by one of ordinary skill in the art to which this invention belongs. In addition, commonly used predefined terms are not ideally or excessively interpreted unless explicitly defined otherwise.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other objects, features and advantages of the present invention will be more apparent from the following detailed description taken in conjunction with the accompanying drawings, in which: FIG.

1 is a block diagram illustrating an exemplary authentication system 10 using biometric information according to an embodiment of the present invention. Referring to FIG. 1, the authentication system 10 may include an authentication device 100 and a database (DB) 200. Here, biometric information can be very diverse, including fingerprint, voice, face shape, iris pattern, hand shape, and vein distribution on the back of the hand.

The authentication device 100 detects the first biometric code (e.g., C1) of the user and combines (XOR) the detected first biometric code C1 with the 'data encoded through the error correction unit 110' , And store the combined first biometric code (Encrypted C1) in the database 200 as verification data. In an embodiment, the encoded first biometric code (Encrypted C1) may include parity for error correction. In the embodiment, the first biometric code C1 may be received from a biometric sensor (not shown) inside or outside the authentication device 100. [ For example, when the first biometric code C1 is the iris code of the user, such iris codes may be provided from LOCKIT product of IRISYS Co., In another embodiment, when the first biometric code C1 is an iris code, the authentication device 100 may be part or all of the LOCKIT product.

In the embodiment, the biometric codes (C1, C2) may further include dummy data so as to improve the error correction capability for the relatively original biometric information. In an embodiment, the error correction unit 110 may be implemented in software / hardware / firmware by various types of error correction codes. For example, the ECC code may be a low density parity check (LDPC) code, a Bose-Caudhro-Hocqeunghem code, a turbo code, a Reed-Solomon code, a convolution code, Coded modulation such as trellis-coded modulation (TCM), block coded modulation (BCM), or the like. Hereinafter, for convenience of explanation, it is assumed that the error correction unit 110 is implemented with a Bose (Bose-Caudhro-Hocqunghem) code. On the other hand, it should be understood that the error correction code of the present invention is not limited to BCH.

The authentication apparatus 100 may be configured to hash the first biometrics code C1 of the user through the hash unit 120 and store the hashed first biometry code Hashed C1 in the database 200 . In an embodiment, the hash unit 120 may include a hash algorithm implemented in software / hardware / firmware. For example, the hash unit 120 may be implemented using a secure hash algorithm (SHA-256, SHA-512). On the other hand, it should be understood that the hash function of the present invention is not limited to SHA.

Thereby, the database 200 stores the verification data (Encoded C1) corresponding to the first biometrics code C1 and the hashed biometric code (Hashed Biometrics Code) corresponding to the first biometrics code C1 without storing the original first biometrics code Can be stored. We call this registration of user biometric code. Therefore, the authentication system 10 of the present invention can register the biometric code without storing the user's original biometric information (e.g., biometric code).

The user authentication using the registered biometric code may proceed as follows. For convenience of explanation, it is assumed that a second biometric code C2 of a user who desires user authentication is received. The error correction unit 110 can correct the error of the received biometrics code C2 using the error correction code and the encoded first biometrics code (Encrypted C1) of the database 200. [ Within the error correction capability range of the error correction unit 110, the error of the received second biometrics code C2 can be corrected. This will be referred to as decoding of the second biometric code (C2). The decoded second biometric code (Decoded C2 or C2 ') can be hashed by the hash unit 120. [

Thereafter, the comparison unit 130 compares the hashed decoded second biometric code (Hashed C2 ') with the hashed first biometric code (Hashed C1) stored in the database 200, thereby obtaining the user authentication result value AUTHRSLT Can be output. If the hashed second biometric code (Hashed C2 ') output from the hash unit 120 is identical to the hashed first biometric code (Hashed C1) read from the database 200, the user authentication is successful. Otherwise, the user authentication fails.

The database 200 may be configured to store the verification data (Encrypted C1) generated in the process of registering the user's biometrics code and the hashed biometrics code (Hashed C1) corresponding thereto. That is, when the verification data (Encrypted C1) and the hashed biometric code (Hashed C1) are stored in the database 200, the biometric code of the user is registered. In FIG. 1, the database 200 exists separately in the authentication apparatus 100. However, the present invention is not necessarily limited thereto. The present invention does not require a separate database and may store the verification data (Encrypted C1) and the hashed biometric code (Hashed C1) in the internal memory of the authentication device 100. [ The authentication system 10 according to the embodiment of the present invention registers the biometric code of the user by storing the corresponding verification data and the hashed biometric code without directly storing the original biometric information, for example, the biometric code, It is possible to perform user authentication simply by using the biometric code.

2 is a ladder diagram illustrating an exemplary biometric registration process according to an embodiment of the present invention. Referring to FIGS. 1 and 2, the biometrics registration process of the user may proceed as follows.

The authentication apparatus 100 can generate the user's biometric code using the dummy data. In the embodiment, the biometric code can be generated by adding dummy data to the original biometric information recognized by the user. Here, the original biometric information may be information received from the biometric sensor. In the embodiment, the original biometric information is 4500 bits of data, and the dummy data may be 3691 bits of data. On the other hand, it should be understood that the size of the original biometric information and the size of the dummy data are not limited thereto.

In an embodiment, the length of the dummy data can be flexibly adjusted. Since the error correction rate of the error correction algorithm can be limited, dummy data is added to the original biometric information, thereby improving the error correction rate of the original biometric information. However, as the size of the dummy data increases, the amount of computation may increase. If the dummy data is shortened, the data may be vulnerable to attack, and the error correction capability may also be degraded. Therefore, it is necessary to use dummy data of an appropriate size.

In one embodiment, the size of the dummy data may be similar to or larger than the size of the original biometric information. If the size of the dummy data is smaller than the size of the original biometric information, the dummy data may be an attack target.

In one embodiment, the size of the dummy data may be adaptively changed according to the processing speed of the authentication device 100. [ The authentication apparatus 100 can test the algorithm for registering and authenticating the biometric code and set the range of the size of the dummy data to complete the entire operation within a predetermined time. The authentication apparatus 100 can set the largest size of dummy data within the set range.

In another embodiment, there may be a lower limit and an upper limit of the size of the dummy data. For example, the lower limit of the size of the dummy data may be the size of the original biometric information. Further, the upper limit of the size of the dummy data may be three times the size of the original biometric information. This example is described for the sake of understanding, and the lower and upper limits of the size of the dummy data are not limited thereto. In this case, even if the processing speed of the authentication apparatus 100 is slow, the size of the dummy data may not become smaller than the size of the original biometric information. In addition, the size of the dummy data may not be larger than three times the size of the original biometric information, no matter how fast the processing speed of the authentication apparatus 100 is.

In an embodiment, the dummy data may be generated randomly. In an embodiment, the dummy data may be randomly generated using a hash function. In another embodiment, the dummy data may be predetermined data. For example, dummy data can be determined using time as a seed value.

In one embodiment, the dummy data may be generated in a combination of 0 and 1. The dummy data may be 0 only. The ratio of 0 to 1 included in the dummy data may be the most preferable in terms of security. The larger the difference in the ratio between 0 and 1 contained in the dummy data, the more vulnerable it may be to security. On the other hand, the larger the ratio of 1 contained in the dummy data, the more error correction may become difficult. Therefore, after determining the ratio between 0 and 1, dummy data can be generated using a random function. For example, after determining the ratio of 0 to 1 to 9 to 1, the position of 1 can be determined using a random function. The ratio of 0 to 1 included in the random function is described for the purpose of illustration, but is not limited thereto.

Thereafter, the error correction unit 110 (see FIG. 1) may encode the biometric code using the algorithm (dummy, combining with encoding) (S12). In one embodiment, the encoded biometric code may be encrypted. The encoded and encrypted biometric code (e.g., Encrypted C1) may be stored in the database 200 (see FIG. 1) as verification data (S12).

Further, the authentication apparatus 100 can hash the biometric code using the hash unit 120 (see Fig. 1) (S14). The hashed biometric code (e.g., Hashed C1) may be stored in the database 200 (S22).

As described above, the verification data of the user and the hashed biometric code are stored in the database 200, so that the user biometric registration process can be completed.

Meanwhile, the authentication apparatus according to the embodiment of the present invention may further perform a randomization operation on the verification data.

3 is a flow chart illustrating an exemplary method of generating a random code according to an embodiment of the present invention. Referring to FIG. 3, the random code generation process may proceed as follows.

First, a biometric code can be received (S13a). A random code can be generated using the biometrics code and the function g (x) of the error correction algorithm (S13b). In an embodiment, g (x) may be a BCH code generation function. On the other hand, it should be understood that the random code generation method shown in FIG. 3 is merely an embodiment that does not limit the present invention.

4 is a view showing an embodiment of a biometric registration process of an authentication apparatus according to an embodiment of the present invention. 1 to 4, the biometric registration process of the authentication device 100 (see FIG. 1) is as follows.

The verification data S can be generated by XORing the concatenated value (w || e) of the biometric code (w) and the dummy data (e) and the random code (c). The biometric code (w) is hashed by the hash function, so that the hashed biometric code (H (w)) can be generated. The verification data S and the hashed biometrics code H (w) are stored in the database, so that the user's biometrics code can be registered. Here, the dummy data e may have a random value.

The method of adding the biometric code (w) and the dummy data (e) is not limited. In another embodiment, the verification data S can be generated by XORing the random code c with the concatenated value e? W of the dummy data e and the biometric code w. The verification data S may also be generated by XORing the random code c with a value obtained by combining the dummy data e and the biometric code w according to a predetermined rule. The method of adding the biometric code w to the dummy data e is a method of separating the dummy data e and the biometric code w from the result obtained by adding the biometric code w to the dummy data e Any method can be used if there is a rule.

5 is a flowchart illustrating an authentication process of an authentication apparatus according to an embodiment of the present invention. 1 to 5, the biometric authentication process of the authentication device 100 (see FIG. 1) is as follows.

The biometric code (w ') desired for user authentication and the dummy data will be concatenated. Here, the dummy data may be predetermined bit data composed of '0'. In this case, the concatenated value will be w '|| 0. A first XOR (exclusive OR) operation on the concatenated value (w '|| 0) and the verification data (S) will be performed. The XOR computed value (QQQ) will be decoded by the BCH decoder. The value QQQ calculated here will satisfy the following equation.

S = w || e + c = w + c || e + c

QQQ = S + (w '|| 0) = w' + w + c || e + c = (w '+ w || e) + c

Let the codeword size of the BCH be 8191, the message length be 391, and the error correction path be t 1403. Here, the Hamming distance of QQQ with respect to C of the concatenated value (w || e), assuming that w 'and w are 1350, e is 53, and their sum is 1403. That is, QQQ can be different from C by 1403 bits. Therefore, decoding QQQ yields c.

Thereafter, a second XOR operation on the decoded value c and the verification data S will be performed. The result value of the second XOR operation will be the concatenated value (w || e) used in biometric registration in Fig. The resulting concatenated value (w || e) will be hashed by the hash function used to hash w.

The comparison unit 130 (see FIG. 1) generates an authentication result AUTHRSLT by comparing whether the hashed biometric code H (w) read from the database 200 (see FIG. 1) can do.

FIG. 6 is a block diagram illustrating an exemplary data encryption process using a biometric code according to an embodiment of the present invention. Referring to FIG. 1 to 6, the data encryption process is as follows.

The verification data S and the hashed biometric code H (w) are generated using the biometric code w, the dummy data e, and the random code c of the user, as described in Figs. 4 and 5, (S110). The verification data S and the hashed biometric code H (w) may be stored in the database 200 (see FIG. 1) (S120).

Thereafter, if data encryption is desired, the data can be encrypted using the hashed biometric code H (w) (S130). Here, the biometric code (w) can be used as an encryption key. In one embodiment, the encryption key can be generated using the biometric code w, and the method is not limited. In an embodiment, the code to be used for authentication when storing / comparing with the encryption key may be H (H (w)), which hashes the hashed code (H (w)) one more time. In another embodiment, the code H (w) to be compared may not be stored. This is because even if the authentication function is omitted, a key is generated in the iris, so that it can not be decoded with another iris and can not generate a key.

FIG. 7 is a diagram illustrating a data decoding process using a biometric code according to an embodiment of the present invention. Referring to FIG. Referring to FIGS. 1 to 7, a data decoding process is as follows.

When it is desired to perform a decryption operation on the encrypted data, the user's biometric code is received and the hashed biometric code (w ') is generated using the received biometric code (w') and the verification data (S) stored in the database (H (w)) may be generated (S210). The process of generating the hashed biometric code (H (w)) has been described with reference to FIG. 5 and will not be described here. The encrypted data can be decrypted using the biometric code w (S220). Here, the biometric code (w) can be used as a decryption key. In one embodiment, the key for decrypting the encrypted data may be generated using the biometric code w, and the method is not limited. At this time, H (H (w)) is stored in the database 200 and the comparison objects are H (H (w)) and H Do not.

8 is a block diagram illustrating an exemplary electronic device according to an embodiment of the present invention. 8, the electronic device 1000 may include a biometric sensor 1100, an authentication device 1200, and an encryption device 1300.

The biometric sensor 1100 may be implemented to recognize a user's biometric information and generate biometric information. The biometric sensor 1100 shown in FIG. 8 is within the electronic device 1000, but the present invention need not be limited thereto. The biometric sensor may be connected to the electronic device 1000 based on various communication protocols (wired or wireless), and may be external to the electronic device 1000.

The authentication device 1200 may be implemented to register and authenticate a biometric code as described in FIGS.

The encryption apparatus 1300 can be implemented to use the registered biometric code as a random number or encryption key of the encryption / decryption operation. The encryption apparatus 1300 can be implemented to encrypt or decrypt data. The encryption device 1300 can be implemented in software / hardware / firmware by standard encryption. For example, the encryption device 1300 may be implemented with an advanced encryption standard (AES) algorithm.

A method of an authentication apparatus according to an embodiment of the present invention includes a step of extracting a feature vector from a bio (= bio) to generate a first biometric code (= w), receiving a first biometric code (= w) (W || e) by concatenating dummy data to the first biometric code (w), generating a first biometric code (w || e) based on an error correction algorithm based on codeword (= W | e XOR c = S) and the hash function (XOR) with the first biometric code (= w X XOR c = S) And storing the first biometric code (= H (w)) in the database.

An electronic device according to an embodiment of the present invention includes a biometric sensor for receiving a living body, an extracting step / device for extracting a characteristic vector from the living body to generate a living body code, dummy data is added to the living body code, [Encoding step / device] generating a verification code by XORing the bio dummy code with codeword encoded based on an error correction algorithm, hashing the biometric code based on a hash function, A [storage device] for storing the code and the hashed biometric code in a database, and an [encryption device] for creating and using an encryption key in the biometric code.

The above-described contents of the present invention are only specific examples for carrying out the invention. The present invention will include not only concrete and practical means themselves, but also technical ideas which are abstract and conceptual ideas that can be utilized as future technologies.

The steps of a method or algorithm described in connection with the embodiments of the present invention may be embodied directly in hardware, in software modules executed in hardware, or in a combination of both. The software module may be a random access memory (RAM), a read only memory (ROM), an erasable programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), a flash memory, a hard disk, a removable disk, a CD- May reside in any form of computer readable recording medium known in the art to which the invention pertains.

While the present invention has been described in connection with what is presently considered to be practical exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, You will understand. Therefore, it should be understood that the above-described embodiments are illustrative in all aspects and not restrictive.

100: Authentication device
110: Error correction unit
120: Hash unit
130: comparison unit
200: Database
w, w ': biometric code
e: dummy data
S: Verification data
H (w): hashed biometric code

Claims (10)

A method for an authentication device to register and authenticate a biometric code, the method comprising:
Receiving first biometric information;
Determining a length of dummy data generated by a combination of 0 and 1 according to the processing speed of the authentication device;
Determining a ratio of 0 to 1 included in the dummy data;
Determining the number and position of 0 and 1 according to the determined ratio to generate the dummy data;
Generating a first biometric code by combining the first biometric information and the generated dummy data;
Encoding the first biometric code based on an error correction algorithm;
Hashing the first biometric code based on a hash function; And
Storing the encoded first biometric code and the hashed first biometric code in a database. The method according to claim 1,
Wherein the error correction algorithm is a Bose-Caudhro-Hocqeunghem (BCH) algorithm and the error correction algorithm utilizes randomly generated dummy data. The method according to claim 1,
Wherein the error correction algorithm comprises a random code,
≪ / RTI > further comprising generating the random code. The method of claim 3,
Wherein generating the random code comprises:
Receiving the first biometric code; And
Generating the random code using the first biometric code and the polynomial generation function of the error correction algorithm. The method of claim 3,
Further comprising XORing the random code and the first biometric code,
Wherein the XOR computed value is validation data stored in the database. The method according to claim 1,
Receiving second biometric information desired to be authenticated by a user;
Generating a second biometric code by combining the second biometric information and the dummy data;
Performing decoding on the second biometric code using the first biometric code and the error correction algorithm;
Hashing the second decoded biometric code based on the hash function; And
And comparing the hashed first biometric code output from the database and the hashed second biometric code. The method according to claim 6,
The step of performing the decoding includes:
Performing a first XOR operation on the second biometric code and the verification data;
Decoding the first XOR computed value based on the error correction algorithm; And
Performing a second XOR operation on the decoded value and the verification data,
Wherein the verification data is the first biometric code. 8. The method of claim 7,
Hashing the second XOR computed value based on the hash function; And
And comparing the hashed value with the hashed first biometric code stored in the database. The method according to claim 1,
Wherein the first biometric information includes at least one of a fingerprint, a voice, a face shape, an iris pattern, a shape of a hand, and a vein distribution of a hand. A biometric sensor for receiving biometric information;
Determines the length of dummy data generated by a combination of 0 and 1 according to the processing speed of the authentication device, determines a ratio of 0 to 1 included in the dummy data, and determines the number of 0's and 1's according to the determined ratio, Generates biometric code by adding the generated dummy data to the biometric information, encodes the biometric code based on an error correction algorithm, and generates the biometric code based on the hash function Hash, and stores the encoded biometric code and the hashed biometric code in a database; And
And an encryption device that uses the hashed biometric code stored in the database as an encryption key.

Images