KR102199138B1 - Method, apparatus and program for user authentication - Google Patents

Abstract

Provided is a user authentication method through an information device to correctly and quickly authenticate a user. According to the present invention, the user authentication method comprises: an authentication module preparation step of registering an authentication module in an authentication server, registering original biometric information of a user in the authentication module, and registering original hash information generated from the original biometric information by the authentication module in a predetermined manner in the authentication server; a biometric information input step of newly inputting instantaneous biometric information of a current user to the authentication module through a biometric sensor of the authentication module detachably connected to an information device; an in-module processing step, when both the original biometric information and the instantaneous biometric information are provided in the authentication module and are not transmitted to the outside, comparing the original biometric information and the instantaneous biometric information in the authentication module and outputting a predetermined biometric matching signal from the authentication module when the matching degree between the original biometric information and the instantaneous biometric information is within a predetermined range; a hash information generation step of allowing the authentication module to generate instantaneous hash information from the original biometric information used for comparison and transmit the instantaneous hash information to the authentication server; and an authentication confirmation step of when both the original hash information and the instantaneous hash information are provided in the authentication server, allowing the authentication server receiving the biometric matching signal to compare the original hash information and the instantaneous hash information and output a predetermined authentication confirmation signal when the original hash information and the instantaneous hash information are matched.

Description

User authentication method, device and program {METHOD, APPARATUS AND PROGRAM FOR USER AUTHENTICATION}

The present invention relates to a user authentication method, device, and program, and more particularly, when authenticating the user's identity by biometric information, verifying whether the original biometric information of the authentication module is damaged by hash information in an authentication server. So far, it relates to a user authentication method, an apparatus and a program.

In general, prior to use of an information device, access to a server, or performance of data processing, authentication of the user's identity may be required. For example, when logging in to a server such as a shopping mall by an information device such as a computer, or when performing remittance processing on a server such as online banking by an information device such as a smartphone It is necessary to verify that the user who is performing is the registered person in advance.

As a conventional user authentication method, there is an ID/password method. However, verification of ID/password is only verification of the knowledge that is stored text data, and this knowledge can be exposed or transmitted to others, so that the requester who authenticates the identity must be the original legitimate person. There is a problem that there is no guarantee.

In addition, the user's identity authentication includes a pattern-based method, a PIN-based method, and a password-based method. However, the verification of the pattern is basically only the verification of knowledge, and thus has the same problem as the ID/password method.

According to the conventional patent document,'In a method executed through an operation server interlocking with an application server that provides a vehicle sharing service that shares driving rights to operate a designated shared vehicle for a certain period of time to a number of users. , N vehicle information for N (N≥1) shared vehicles that can share driving rights for a certain period of time to multiple users and N vehicle phone numbers uniquely assigned to each of the N shared vehicles are mapped one-to-one. A first step of storing in the designated number management D/B; When applying for a vehicle sharing service through an app of a random sharing applicant's wireless terminal, vehicle information of the shared vehicle to be shared to the sharing applicant via a designated route, the sharing time information to be shared with the sharing applicant, and the sharing requester's wireless terminal A second step of receiving a mobile phone number of; A third step of inquiring a number management D/B based on vehicle information of a shared vehicle to be shared with the sharing applicant to check a vehicle phone number of a designated number system assigned to a shared vehicle other than a calling device; A fourth step of mapping the mobile phone number of the sharing applicant's wireless terminal, the vehicle phone number assigned to the shared vehicle, and sharing time information for sharing the shared vehicle in a designated storage medium; When the sharing start time of the stored sharing time information has not arrived, the call forwarding function of the vehicle phone number of the shared vehicle mapped with the mobile phone number of the sharing applicant's wireless terminal is inactive (or maintained in an inactive state), and the sharing is started. A fifth step of processing a call connection request to the vehicle phone number to be forwarded to the mobile phone number when the time has come; A sixth step of checking whether a sharing end time for ending sharing of the shared vehicle has elapsed based on the stored sharing time information; And a seventh step of deactivating (or canceling) the call forwarding function of the vehicle phone number assigned to the shared vehicle when the sharing end time of the shared vehicle has elapsed. It is disclosed.

Registered Patent No. 10-1783555

The technology of the above patent document specifies a shared person who is a driver using the mobile phone number of the applicant's wireless terminal. That is, the mobile phone number of the applicant's wireless terminal serves as an ID.

However, an ID or mobile phone number is just'knowledge' that can be given to others. Since it is a piece of knowledge, there may be cases in which the person actively informs others of the ID or mobile phone number, and there are cases where the ID or mobile phone number is stolen by others against their will.

At this time, if another person who has acquired the knowledge applies for a service, there is a concern that the user with the application name (the person) and the actual user (other person) will be different. For this reason, the performance for each user may be erroneously calculated, and furthermore, there is a fear of being abused for crime.

In addition, ID or mobile phone number is an authentication method that is inconvenient to input into the device by typing or the like. Therefore, in the case of temporary user change, such as when the user temporarily changes due to typing inconvenience, for example, when a factory worker entrusts the conveyor work to a worker next to him to go to the toilet for a while, the ID or mobile phone number for user change There are cases where typing is not performed, and there is a fear of authentication failure due to mistyped even when typing is performed.

On the other hand, there is also a method based on biometric information such as face, iris, and fingerprint for user authentication. Since biometric information does not correspond to verification of knowledge, there is no problem of exposure, transmission, or theft. Since such biometric information corresponds to extremely important personal information, strict management is required. In particular, when the biometric information is configured to be transmitted/received through a network, an accident may occur in which biometric information is leaked due to hijacking of the network signal or the like. Of course, there may be cases in which hardware containing biometric information, such as a server, terminal, module, etc., is hacked and biometric information is stolen. Furthermore, if the biometric information registered in the server, terminal, module, etc. can be modified without permission, the other person is authenticated by the biometric information after modifying the biometric information of another person other than the originally registered user. There is also a fear that an operation such as a crime may occur that takes advantage of the authentication of the originally registered user.

The present invention is intended to solve the problem of the technology in the above patent documents, and authenticates users accurately and quickly by means of an authentication method in which the person is not actively informed to others or is not stolen by others against his or her intention. It is intended to provide a user authentication method, device and program that can be done.

In addition, in the case of user authentication using biometric information, it is intended to provide a user authentication method, apparatus, and program that enable authentication to be performed in a state in which biometric information is not transmitted/received through a network.

In addition, it is intended to provide a user authentication method, an apparatus, and a program capable of preventing the occurrence of a crime of stealing the authentication effect of others due to alteration of biometric information.

The method of the present invention for achieving the above object is a method for authenticating a user through an information device, wherein an authentication module to be used for user authentication is registered in an authentication server, and original biometric information of the user is registered in the authentication module. An authentication module preparation step of registering original hash information generated in a predetermined manner from the original biometric information by an authentication module in the authentication server; A biometric information input step of newly inputting instantaneous biometric information of a current user to the authentication module through a biosensor of the authentication module that is detachably connected to the information device; When both the original biometric information and the instantaneous biometric information are provided in the authentication module and are not transmitted to the outside, the original biometric information and the instantaneous biometric information are compared within the authentication module, and the original biometric information A module internal processing step of outputting a predetermined biometric matching signal from the authentication module when the matching degree between the instantaneous biometric information and the instantaneous biometric information falls within a predetermined range; An instantaneous hash information generating step in the authentication module, generating instantaneous hash information from the original biometric information used for comparison, and transmitting it to the authentication server; In a state in which both the original hash information and the instantaneous hash information are provided in the authentication server, the hash matching result of the comparison of the original hash information and the instantaneous hash information in the authentication server receiving the biometric matching signal In this case, an authentication verification step of outputting a predetermined authentication verification signal from the authentication server ; It characterized in that it is made to include.

Here, in the intra-module processing step, it is preferable that the matching degree is determined while the original biometric information and the instantaneous biometric information are loaded into a secure memory that can be read only inside the authentication module.

In addition, it is preferable that the original biometric information is stored in an encrypted state, and then decrypted and processed immediately before the match degree in the processing step inside the module is determined.

In addition, it is preferable that the instantaneous biometric information is completely deleted so as to be irrecoverable immediately after determining the matching degree.

And, prior to the instantaneous hash information generating step, a designated position output step of outputting a designated position to be compared of hash information from the authentication server receiving the biometric matching signal is further provided. In the instantaneous hash information generating step, the instantaneous hash information generating step Instantaneous hash information of the designated position is generated and transmitted, and in the authentication verification step, it is preferable that instantaneous hash information of the designated position and original hash information are compared.

In addition, the designated position is preferably determined by a random number.

In addition, it is preferable that the number of designated positions is plural.

On the other hand, the device of the present invention for achieving the above object is a user authentication device through an information device, with an external authentication server connected, one side detachably connected to the information device, and the other side to the biosensor. It is connected, and the original biometric information of the user is registered and provided therein, and the original hash information generated in a predetermined manner from the original biometric information is registered in the authentication server. By receiving the instantaneous biometric information of the current user, the original biometric information and the instantaneous biometric information are both provided inside and are not transmitted to the outside. If the degree of correspondence between the original biometric information and the instantaneous biometric information falls within a predetermined range, a predetermined biometric matching signal is output, while instantaneous hash information is generated from the original biometric information used for comparison, and the authentication An authentication module to be transmitted to the server; In a state in which the original hash information is registered from the authentication module, the instantaneous hash information is received together with the biometric matching signal from the previously registered authentication module, and both the original hash information and the instantaneous hash information are provided inside. In the present state, the original hash information and the instantaneous hash information are compared, and if they match, a hash match determination is made and an authentication server for outputting a predetermined authentication confirmation signal is included.

On the other hand, the program of the present invention for achieving the above object is a program for user authentication, in which a program for executing each step of the method described above is recorded on an information processing device, and is stored in a storage medium readable by an information processing device. It is a recorded program.

According to the present invention, a user authentication method, apparatus, and program capable of accurately and quickly authenticating a user by an authentication method in which the user is not actively informed to others or is not stolen by others against his or her will. Is provided.

In addition, in the case of user authentication using biometric information, a user authentication method, apparatus, and program are provided that enable authentication to be performed in a state in which biometric information is not transmitted or received through a network.

In addition, there is provided a user authentication method, apparatus, and program capable of preventing the occurrence of a crime of stealing the authentication effect of others due to alteration of biometric information.

1 is a block diagram of an embodiment of an apparatus in which a user authentication method according to the present invention is to be implemented.
2 is a flowchart of the method.

Hereinafter, a method, an apparatus, and a program for detecting a usage record for each user for a shared object according to the present invention will be described in detail with reference to the accompanying drawings. However, for members having the same function by the same configuration, the same reference numerals are maintained even if the drawings are different, and thus detailed description thereof may be omitted.

In addition, the relationship in which other members are arranged or connected to the front, rear, left and right sides, top and bottom of a certain member includes a case where a separate member is inserted in the middle. Conversely, when a member is said to be'right' before, left, or above and below the other member, it means that there is no separate member in the middle. And, when a part is said to'include' other components, it means that other components may be further included, rather than excluding other components unless otherwise stated.

In addition, the classification of the names of the configurations into first, second, etc. is for classifying the configurations in the same relationship, and is not necessarily limited to the order. In addition, terms such as'unit','means','unit','member', and'module' described in the specification mean a unit of a comprehensive structure that performs at least one function or operation. In addition, information processing devices such as terminals and servers described in the specification basically mean hard wiring, which means hardware in which a specific function or operation is implemented, but should not be interpreted to be limited to specific hardware. It does not exclude soft wiring made up of software that is driven to enable specific functions or operations to be implemented. That is, the terminal or the server may be a device or software installed on a device, such as an app.

In addition, the size and thickness of each component shown in the drawings are arbitrarily shown for convenience of description, so the present invention is not necessarily limited to those shown in the drawings, and in order to clearly express various parts and regions such as layers and regions In some cases, the thickness is exaggerated and enlarged or reduced.

<Basic configuration-method>

The method of the present invention is a method of authenticating the user 14 through the information device 10. This method can be used when authentication of the identity of the user 14 is required prior to use of the information device 10, connection of the server 30, execution of data processing 31, or the like. For example, when logging in to the server 30 such as a shopping mall by an information device 10 such as a computer, or performing a remittance process in the server 30, such as online banking, by an information device 10 such as a smartphone (31) In such a case, it may be used when it is necessary to verify whether the user 14 requesting the login or the remittance process is a registered person. However, the authentication of the user 14 is not limited to the above-described cases, for example, in the case of verifying whether the user 14 is allowed in advance, such as military field, aerospace, company decision making, entrance door, etc. It is natural to interpret that it can be used for all.

The method of the present invention, the authentication module preparation step (S10) and; Biometric information input step (S20) ; A module internal processing step (S30) ; Instantaneous hash information generation step (S40) and; Authentication verification step (S50); It characterized in that it is made to include.

In the authentication module preparation step (S10) , the authentication module 12 to be used for user 14 authentication is registered in the authentication server 20, and the original biometric information of the user 14 is registered in the authentication module 12. In addition, the original hash information generated in a predetermined manner from the original biometric information by the authentication module 12 is registered in the authentication server 20.

The authentication server 20 is a server configured to output a predetermined signal corresponding to the input of a predetermined signal. In other words, unlike a typical server in the related art, advanced computational processing such as image comparison processing is not required. Therefore, it is possible to increase the processing speed while reducing errors.

The authentication server 20 is preferably configured to respond only to a signal from the authentication module 12 registered in advance. Therefore, the authentication module 12 must be registered in the authentication server 20 in advance prior to transmission and reception of signals. When registering the authentication module 12 with the authentication server 20, it may be subjected to a security verification, for example, by a public certificate or a private certificate. Whether to register may be determined by a unique identification code of the authentication module 12, for example, a serial number or ID.

The original biometric information is biometric information that is used for authentication. The original biometric information may be acquired and input through the biometric sensor 13 connected to the authentication module 12. However, it is not limited to this. For example, the original biometric information may be input by being transmitted from another device (not shown) without going through the biometric sensor 13.

On the other hand, in order to confirm whether the original biometric information is hacked, the original hash information is generated in a predetermined manner by the authentication module 12 for the original biometric information, and is transmitted to the authentication server 20 to be registered. have. This original hash information is data stored in advance to be used for verification of hacking of the original biometric information when comparing biometric information later. Here, the hash information may be set as, for example, a hash function value, but is not limited thereto, and may be set as, for example, a predetermined processing value for the hash function value. Hereinafter, the hash function value or its processed value is collectively referred to as hash information.

When the original hash information is transmitted from the authentication module 12 to the authentication server 20, it is transmitted in an encrypted state. If the original hash information is a hash function value, all hash function values may be transmitted, or through other methods, the server processes the hash value for the biometric information to have all or part of it. The authentication server 20 safely stores the original hash information.

In the biometric information input step (S20) , the current user is newly added to the authentication module 12 through the biometric sensor 13 of the authentication module 12 that is detachably connected to the information device 10. This is the step of inputting the instantaneous biometric information of (14).

The information device 10 is a unit that contributes to the processing of the authentication function according to the present invention, in addition to basic functions such as connection to the processing server 30 and information processing. For example, in the case where the information device 10 requests processing such as log-in to the processing server 30, the processing request unit 11 in the information device 10 performs the processing unit of the processing server 30 It is connected to (31), determines the method of log-in processing, and performs authentication processing through the authentication module 12 and authentication server 20 in the information device 10, and authentication verification in the authentication server 20 It may be set to wait for a signal to be input to the processing unit 31.

The processing request unit 11 may be included in the information device 10 and may be configured integrally. However, it is not limited to this. The processing requesting unit 11 may be configured in a detachable manner so as to be detachable from the information device 10. Likewise, the processing execution unit 31 may be included in the processing server 30 and be configured integrally. However, it is not limited to this. The processing execution unit 31 may be configured in a detachable manner so as to be detachable from the processing server 30.

The authentication module 12 may be formed integrally, which is included in the processing request unit 11 or the information device 10 and installed. In this case, with a stable electrical connection, an optimized configuration is possible.

However, it is preferable that the authentication module 12 be configured to be detachable and detachably fastened to the processing request unit 11 or the information device 10. The method of attaching and detaching is possible regardless of wired or wireless, for example, a case in which the authentication module 12 in the form of a USB dongle is physically attached to and detached from the processing request unit 11 or the information device 10 having a terminal of a USB interface. As another example, there may be a case in which the processing request unit 11 or the information device 10 and the authentication module 12 having a Bluetooth-type wireless means are paired with each other within an accessible range. In this detachable case, the authentication module 12 may be configured to be connected to various information devices 10. Therefore, it is possible to increase the degree of freedom of connection. In addition, when not in use, the authentication module 12 can be separated from the processing request unit 11 and stored in a safer place such as a safe.

In particular, the authentication module 12 may be configured to consist of a plurality. In this case, each of the plurality of authentication modules 12 may be for individuals assigned to each user 14. In this case, the authentication module 12 of each user 14 is preferably configured such that the original biometric information of each user 14 is registered. By doing so, each authentication module 12 is thoroughly personalized, and is used only for authentication of each individual user 14. And this personal authentication module 12, can be used for various information devices (10).

Instantaneous biometric information is biometric information input to be compared with the original biometric information. This is acquired from the biometric sensor 13 connected to the authentication module 12. The biometric sensor 13 may be included in the authentication module 12 and installed integrally. By doing so, security can be enhanced. However, it is not limited to this. The biometric sensor 13 may be of a detachable type that is detachably connected to the authentication module 12. By doing this, there is an advantage that a newly developed sensor and a different type of sensor can be replaced and mounted, and the sensor itself can be separated and managed.

In the module internal processing step (S30) , in a state in which both the original biometric information and the instantaneous biometric information are provided in the authentication module 12 and not transmitted to the outside, the authentication module 12 When the original biometric information and the instantaneous biometric information are compared and the degree of correspondence between the original biometric information and the instantaneous biometric information falls within a predetermined range, a predetermined biometric matching signal is output from the authentication module 12.

Here, it is preferable that the original biometric information and the instantaneous biometric information are loaded in a secure memory (not shown) that can be read only inside the authentication module 12, and the matching degree is determined. The secure memory cannot be accessed from the outside of the authentication module 12. Therefore, it is not possible to hack through data access to the authentication module 12, and security is greatly improved.

In addition, it is preferable that the original biometric information is stored in an encrypted state and then decrypted immediately before the matching degree is determined, so that the matching degree determination and the like are processed. Thus, even if an attempt to hack the biometric information in the authentication module 12 occurs, security is greatly improved due to the original biometric information in an encrypted state.

In addition, it is preferable that the instantaneous biometric information is completely deleted so as to be irrecoverable immediately after determining the matching degree. Thus, even if a hacking attempt occurs for the biometric information used for determining the degree of matching in the authentication module 12, the security is extremely improved since it has already been completely deleted so as not to be recovered.

The determination of the degree of correspondence may use a conventional technique for determining the degree of correspondence or degree of similarity with respect to the pattern of biometric information. For a balance between security and speed, the predetermined range of the degree of match can be adjusted.

The biometric matching signal output as a result of determining the degree of matching is a signal predetermined between the authentication server 20 and the authentication module 12 registered in the authentication server 20. The biometric matching signal is transmitted directly from the authentication module 12 to the authentication server 20, or from the authentication module 12 to the processing requesting unit 11 or the information device 10. ).

The instantaneous hash information generating step (S40) is a step in which instantaneous hash information is generated from the original biometric information used for comparison in the authentication module 12 and transmitted to the authentication server 20.

When the authentication module 12 checks the degree of correspondence of the biometric information by comparing the original biometric information and the instantaneous hash information (when performing user verification), before or after confirming the degree of correspondence through biometric authentication, the authentication module 12 , Instantaneous hash information (eg, hash function value) of the original biometric data used in the comparison conducted this time is calculated. This instantaneous hash information is generated by the authentication module 12 and transmitted to the authentication server 20 in the same manner as when the original biometric information is registered and the original hash information is registered in the authentication module preparation step (S10).

In the authentication verification step (S50) , in a state in which both the original hash information and the instantaneous hash information are provided in the authentication server 20, the original text in the authentication server 20 receiving the biometric matching signal. In the case of a hash matching result of comparing the hash information with the instantaneous hash information, a predetermined authentication confirmation signal is output from the authentication server 20.

By comparing the original hash information stored in the authentication server 20 with the instantaneous hash information generated and transmitted during this comparison of the biometric information, the original biometric information registered and stored in the authentication module 12 has not been forged. I can confirm.

The predetermined authentication confirmation signal is a signal predetermined between the authentication server 20 and the authentication module 12 registered in the authentication server 20, and the processing server 30 in the authentication server 20 It is a signal that is predetermined to be transmitted to ). Accordingly, the processing server 30 waits for input of the authentication confirmation signal and, when receiving the authentication confirmation signal, performs a predetermined process by the processing execution unit 31.

<Effect>

For example, in the case where the user 14 logs in to the shopping mall which is the processing server 30 in the computer as the information device 10, the user 14 connects the detachable authentication module 12 to the processing request unit 11, Instantaneous biometric information is input by the biometric sensor 13 built into the authentication module 12. Then, the degree of correspondence between the original biometric information and the instantaneous biometric information is determined inside the authentication module 12, and if it falls within a predetermined range, a biometric matching signal is output. The authentication server 20 receiving the biometric matching signal outputs an authentication confirmation signal, which is input to the processing server 30. The processing server 30 performs login processing by the processing execution unit 31.

In this way, since the processing unit 31 of the processing server 30, which receives the processing request from the information device 10 by biometric authentication, performs a predetermined processing, it is possible to discriminate users based on knowledge such as mobile phone number or ID. It avoids problems and makes it possible to accurately and easily discriminate true users. In particular, since the degree of correspondence of the biometric information is determined only inside the authentication module 12, there is no external leakage of the biometric information. In addition, since the result of determining the degree of correspondence is output only as a predefined signal, there is no leakage of biometric information.

Further, the attempt to hack is completely blocked by configurations such as instantaneous biometric information is stored in a secure memory, original biometric information is stored in an encrypted state, and instantaneous biometric information is deleted after the match degree is determined.

In addition, when the authentication module 12 is a detachable type, is a plurality of assigned to each user, and is for personal use, it is possible to connect to various information devices 10 having a high degree of freedom.

In addition, since the authentication module 12 generates original hash information for the original biometric information registered in the authentication module 12 and registers it in the authentication server 20, it is possible to check whether the registered original biometric information is hacked. Can be judged. That is, when instantaneous biometric information is subsequently input and compared with the original biometric information as described above, the authentication module 12 newly generates instantaneous hash information of the original biometric information used for the comparison, and the authentication server 20 Will be sent to. The authentication server 20 compares the original hash information registered in advance with the instantaneous hash information transmitted this time, and determines the hash match only when they match. This hash match determination becomes evidence that the original biometric information registered in the authentication module 12 has not been hacked. Therefore, even if the hacker replaces the original biometric information of the original user of the authentication module 12 with the biometric information of another person, the biometric matching signal of the result of inputting and comparing the instantaneous biometric information of the other person is according to the present invention. According to this, since the hash match determination is not received by the authentication server 20 according to the comparison of the hash information, it is possible to prevent theft.

<Designated position of hash information>

On the other hand, there may be a case where it is considered unsafe to send the entire instantaneous hash information to the authentication server collectively for each comparison of instantaneous biometric information. In consideration of this case, it is also conceivable to transmit the instantaneous hash information only at the request of the authentication server, or to transmit only the portion (position) designated by the authentication server. By doing so, the security confirmation by the server can be read.

To this end, prior to the instantaneous hash information generation step (S40), a designated position output step of outputting a designated position to be compared of hash information from the authentication server 20 receiving the biometric matching signal is further provided. . In this situation, in the instantaneous hash information generation step (S40), instantaneous hash information of the designated position is generated and transmitted, and in the authentication verification step (S50), the instantaneous hash information of the designated position and the original hash information are compared. It is preferable to be made so that.

Since the hash information of the position designated by the authentication server is input to the authentication server, whether or not the authentication module is hacked can be checked, and the integrity of the biometric information can be checked.

Here, it is preferable that the designated position is determined by a random number. The authentication server may be equipped with a random number generator. By specifying a position by a random number, a different position value may be transmitted to the authentication module each time.

And here, it is preferable that there are a plurality of the designated positions. Such a plurality of designated positions may be configured so that all or part of them are used for comparison of hash information.

<device>

The device of the present invention is a user authentication device through the information device 10. The apparatus of the present invention includes an authentication module 12 ; Authentication server 20 ; characterized in that it is made.

The authentication module 12 , while the authentication server 20 is connected to the outside, one side is detachably connected to the information device 10, the other side is connected to the biometric sensor 13, inside In a state in which the original biometric information of the user 14 is registered and provided, and the original hash information generated in a predetermined manner from the original biometric information is registered in the authentication server 20, the biometric sensor 13 is By receiving the instantaneous biometric information of the current user 14 newly through the input, both the original biometric information and the instantaneous biometric information are provided inside, and the original biometric information is not transmitted to the outside. And the instantaneous biometric information are compared so that when the degree of correspondence between the original biometric information and the instantaneous biometric information falls within a predetermined range, a predetermined biometric matching signal is output, while instantaneous hash information from the original biometric information used for comparison Is a module that is generated and transmitted to the authentication server 20.

The authentication server 20, in a state in which the original hash information is registered from the authentication module 12, receives the instantaneous hash information together with the biometric matching signal from the authentication module 12 that is registered in advance, In a state in which both the original hash information and the instantaneous hash information are provided inside, the original hash information and the instantaneous hash information are compared, and if they match, a hash match determination is made and a predetermined authentication confirmation signal is output. It's a server.

<Program>

The program for user authentication of the present invention is an information device program recorded on a storage medium readable by the information device, in which a program for information device for executing each step of the method is recorded on the information device.

Although the preferred embodiments of the present invention have been described above, the present invention is not limited to the disclosed embodiments, but is implemented by modifying in various forms different from within the scope of the claims, the detailed description of the invention, and the accompanying drawings. It can be practiced, and other equivalent embodiments are possible, and it is natural to those of ordinary skill in the art that this also falls within the scope of the present invention, and only the embodiments are intended to make the disclosure of the present invention complete, and the present invention It is provided to completely inform the scope of the invention to those of ordinary skill in the art to which it belongs, and the invention is only defined by the scope of the claims.

The present invention can be used in the industry of user authentication methods, devices and programs.

10: information equipment
11: Request for processing
12: authentication module
13: biometric sensor
14: user
20: authentication server
30: processing server
31: processing unit

Claims (9)

As a user authentication method through an information device,
The authentication module to be used for user authentication is registered in the authentication server, and the original biometric information of the user is registered in the authentication module, and the original hash information generated in a predetermined manner from the original biometric information by the authentication module is authenticated. Preparing an authentication module registered in the server;
A biometric information input step of newly inputting instantaneous biometric information of a current user to the authentication module through a biosensor of the authentication module that is detachably connected to the information device;
When both the original biometric information and the instantaneous biometric information are provided in the authentication module and are not transmitted to the outside, the original biometric information and the instantaneous biometric information are compared within the authentication module, and the original biometric information A module internal processing step of outputting a predetermined biometric matching signal from the authentication module when the matching degree between the instantaneous biometric information and the instantaneous biometric information falls within a predetermined range;
An instantaneous hash information generating step in the authentication module, generating instantaneous hash information from the original biometric information used for comparison and transmitting to the authentication server;
In a state in which both the original hash information from the original biometric information at the time of registration and the instantaneous hash information from the original biometric information at the time of performing user verification are provided in the authentication server, the original hash information and the An authentication verification step in which a predetermined authentication confirmation signal is output from the authentication server receiving the biometric matching signal from the authentication module only when the instantaneous hash information is compared and matched to determine that the original biometric information has not been modified ;
User authentication method, characterized in that made by including. The method according to claim 1,
In the module internal processing step, the matching degree is determined while the original biometric information and the instantaneous biometric information are loaded into a secure memory that can be read only inside the authentication module.
User authentication method, characterized in that. The method according to claim 1 or 2,
The original biometric information is stored in an encrypted state, and then decrypted and processed immediately before the matching degree in the processing step inside the module is determined.
User authentication method, characterized in that. The method according to claim 1 or 2,
The instantaneous biometric information is completely deleted irrecoverably immediately after the determination of the matching degree
User authentication method, characterized in that. The method according to claim 1 or 2,
Prior to the instantaneous hash information generation step, a designated position output step of outputting a designated position to be compared of the hash information from the authentication server receiving the biometric matching signal; is further provided,
In the instantaneous hash information generation step, instantaneous hash information of the designated position is generated and transmitted,
In the authentication verification step, the instantaneous hash information of the designated position and the original hash information are compared.
User authentication method, characterized in that. The method of claim 5,
The designated position is determined by a random number
User authentication method, characterized in that. The method of claim 5,
The above designated positions are plural.
User authentication method, characterized in that. As a user authentication device through information equipment,
With the authentication server connected to the outside, one side is detachably connected to the information device, the other side is connected to a biometric sensor, and the original biometric information of the user is registered and provided inside, and from the original biometric information In a state in which original hash information generated in a predetermined manner is registered in the authentication server, instantaneous biometric information of the current user is newly input through the biosensor, so that both the original biometric information and the instantaneous biometric information are When the original biometric information and the instantaneous biometric information are compared inside, the original biometric information and the instantaneous biometric information are within a predetermined range, and are provided inside and are not transmitted to the outside. An authentication module for outputting a biometric matching signal of and generating instantaneous hash information from the original biometric information used for comparison and transmitting it to the authentication server;
In a state in which the original hash information from the original biometric information at the time of registration is registered from the authentication module, the instantaneous hash information from the original biometric information at the time of user verification is received from the previously registered authentication module, and the original Only when it is determined that the original biometric information has not been modified by comparing and matching the original hash information and the instantaneous hash information while both the hash information and the instantaneous hash information are provided inside, the authentication module An authentication server for outputting a predetermined authentication confirmation signal upon receiving the biometric matching signal;
A user authentication device, characterized in that it comprises a. As an information device program for user authentication,
A computer program for an information device recorded on a storage medium readable by an information device, in which a computer program for an information device for causing the information device to execute each step of the method of claim 1 or 2 is recorded.

Images