KR102644124B1 - User terminal performing non-real name two-factor authentication, authentication performing apparatus, and operating method thereof - Google Patents

Abstract

A user terminal and authentication performing device that perform non-real-name two-factor authentication, and a method of operating the same are disclosed. The operating method of the disclosed authentication device includes receiving a first inborn ID, private key signature information, and a certificate issued by an authentication system from a user terminal, decrypting the certificate using the public key of the authentication system, and Obtaining the included second human ID and public key of the user terminal, performing primary authentication for the user of the user terminal based on whether the first human ID and the second human ID match each other, and first When authentication is completed, performing secondary authentication for the user by verifying the private key signature information with the public key.

Description

User terminal and authentication device that perform non-real name 2-factor authentication and their operating method {USER TERMINAL PERFORMING NON-REAL NAME TWO-FACTOR AUTHENTICATION, AUTHENTICATION PERFORMING APPARATUS, AND OPERATING METHOD THEREOF}

The explanation below relates to the user terminal and authentication device that performs non-realistic 2-factor authentication and its operation method. More specifically, the user's bio information and the device's unique key (e.g. PUF (physically unclonable function)) are used. This is about a combined inborn ID-based non-real name two-factor authentication technique.

As the information society becomes more sophisticated, the need to protect personal privacy is increasing, and the safety of authentication methods is being raised as an important technical issue. In particular, user authentication in electronic finance, access to devices or systems, and authentication in IoT (internet of things) or M2M (machine to machine) require a high level of reliability of authentication methods. Authentication includes knowledge-based authentication, possession-based authentication, and authentication using the user's biometric information itself. Depending on whether authentication is performed using only one method or multiple methods, it can be divided into 1-factor authentication, 2-factor authentication, and multi-factor authentication.

Multi-Factor Authentication

IT infrastructure is diversifying from server-client devices connected through wired networks to various types of devices, from wearable devices to vehicles connected through various types of wireless networks such as mobile, RFID (radio frequency identification), and NFC (near field communication). . In addition, as application areas from payments to M2M have become more sophisticated, existing password-based authentication has become less secure or difficult to apply. Accordingly, the need for an authentication method that is safer and can be applied in various forms is emerging.

Multi-factor authentication is an authentication method that uses a combination of two or more knowledge-based, ownership-based, and biometric authentication methods. Knowledge-based authentication is a traditional authentication method, such as a password that verifies pre-shared memories or promised secret information. Possession-based authentication is an authentication method that checks whether you have a tangible or intangible authentication method such as a security card, OTP, or certificate. Bio-based authentication is a method of authentication that determines the characteristics of the user's unique body structure. Each authentication method has its own strengths and weaknesses in terms of safety and usability, and this can be achieved by using two or more types of authentication methods simultaneously to increase safety. It may be one of several examples of multi-factor authentication that uses a combination of password, OTP, smart key, and fingerprint.

However, as authentication methods change from single authentication to dual authentication or multi-authentication, authentication procedures for security are increasing, causing user inconvenience. The processing time for step-by-step authentication is increasing, and additional costs are incurred to secure storage space due to the increase in authentication data.

anonymous authentication

As IT infrastructure expands into all aspects of life, excessive collection and exposure of personal information is becoming a major issue. Individual privacy is being violated by requesting excessive personal information, and personal information leakage accidents frequently occur due to carelessness in information management. Even if important personal information is safely stored in a third party, there are limitations in the current Internet system that uses real names. One way to protect personal information is anonymous authentication technology.

It is based on a certificate that guarantees anonymity. It is associated with the concept of anonymous payments or untraceability. Representative techniques include blind signature and group signature.

In a hidden signature protocol, the signer does not know about the message he or she is signing, nor does he know whether the recipient of the signature obtained the message. In general, blinded messages are obtained by combining random blinding factors and messages in various ways. The blinded message is delivered to the signer, and the signer can sign using a general signature algorithm. The resulting message affected by the blind factor can be later verified using the signer's public key. Because the content of the message is unknown, it is used in online voting, etc.

Group signing is a signing method that allows one member of a group to anonymously sign a message. For example, when an employee of a large company signs a document using a group signature structure, the verifier that verifies the validity of the signature can only know that it was signed by one of the company's employees, and that the employee It is unclear exactly who signed it. Another application example is an application that uses key cards to access a restricted area. You cannot track the movements of individual employees in that area, but you can ensure that only employees belonging to that group have access to that area. there is. The most important element in a group signature structure may be the group manager. Group managers can add new members to the group and have the power to reveal signatories in case of disputes.

Since the contents of the signature cannot be known or who signed it, it is impossible to know for whom the certificate is intended, so anonymity can be guaranteed. However, compared to a typical signature, a third party is required or the length of the signature is very long, making it cumbersome to actually use and increasing costs such as additional processing time and storage data space, which may reduce its practicality.

A method of operating an authentication device according to an embodiment includes receiving a first inborn ID, private key signature information, and a certificate issued by an authentication system from a user terminal, and using the public key of the authentication system to obtain the certificate. Obtaining a second human ID and a public key of the user terminal included in the certificate by decrypting the certificate, and providing the user of the user terminal based on whether the first human ID and the second human ID match each other It includes performing primary authentication for the user and, when the primary authentication is completed, performing secondary authentication for the user by verifying the private key signature information with the public key.

The first human ID is generated using at least one of at least a portion of the user's bio information obtained from the user terminal, at least a portion of a unique key corresponding to the user terminal, and at least a portion of random number information stored in the user terminal. It may be generated based on the first part of the authentication key.

The authentication key is provided in response to a case where the user's bio information obtained from the user terminal matches pre-stored bio information, at least a part of a unique key corresponding to the user terminal and at least a part of random number information stored in the user terminal. It can be created using at least one of:

The private key and public key of the user terminal may be generated based on the second part of the authentication key.

The first part and the second part of the authentication key may be determined independently of each other.

The certificate may be generated by signing the second human ID and the public key transmitted from the user terminal to the authentication system during the setup process with the private key of the authentication system.

The second personal ID and the public key transmitted from the user terminal to the authentication system during the setup process may be registered in the authentication system along with the user's personal information.

A method of operating an authentication device according to an embodiment may further include performing an operation according to a request received from the user terminal when the secondary authentication is completed.

A method of operating a user terminal according to an embodiment includes generating a first human ID in response to a user's request for an authentication device, the first human ID, private key signature information of the user terminal, and issued by an authentication system. transmitting a certificate to the authentication device and receiving results of primary authentication and secondary authentication based on at least one of the first human ID, the private key signature information, and the certificate performed by the authentication device. Includes, wherein the first human ID is at least one of at least a portion of the user's bio information acquired from the user terminal, at least a portion of a unique key corresponding to the user terminal, and at least a portion of random number information stored in the user terminal. It is generated based on the first part of the authentication key generated using.

The authentication key is provided in response to a case where the user's bio information obtained from the user terminal matches pre-stored bio information, at least a part of a unique key corresponding to the user terminal and at least a part of random number information stored in the user terminal. It can be created using at least one of:

The private key and public key of the user terminal may be generated based on the second part of the authentication key.

The first part and the second part of the authentication key may be determined independently of each other.

The certificate may be generated by signing the second human ID and the public key transmitted from the user terminal to the authentication system during the setup process with the private key of the authentication system.

The second personal ID and the public key transmitted from the user terminal to the authentication system during the setup process may be registered in the authentication system along with the user's personal information.

The step of receiving a result of the primary authentication and the secondary authentication may include receiving a result of an operation performed according to the request in response to completion of the primary authentication and the secondary authentication.

The authentication performing device according to one embodiment includes a processor and a memory including at least one instruction executable by the processor, and when the at least one instruction is executed by the processor, the processor receives a first authentication certificate from the user terminal. By receiving an (inborn) ID, private key signature information, and a certificate issued by an authentication system, and decrypting the certificate using the public key of the authentication system, the second human ID and disclosure of the user terminal included in the certificate are disclosed. Obtain a key, perform primary authentication on the user of the user terminal based on whether the first human ID and the second human ID match each other, and when the primary authentication is completed, the public key is used to authenticate the user of the user terminal. By verifying the private key signature information, secondary authentication is performed for the user.

The user terminal according to one embodiment includes a processor and a memory including at least one instruction executable by the processor, and when the at least one instruction is executed by the processor, the processor In response to the request, a first human ID is generated, and the first human ID, the private key signature information of the user terminal, and a certificate issued by the authentication system are transmitted to the authentication device, and the authentication performed by the authentication device is performed. Receive results of primary authentication and secondary authentication based on at least one of a first human ID, the private key signature information, and a certificate, and the first human ID is at least part of the user's bio information obtained from the user terminal. , It is generated based on a first part of an authentication key generated using at least one of at least a part of a unique key corresponding to the user terminal and at least a part of random number information stored in the user terminal.

According to an embodiment of the present invention, the multi-authentication process can be simplified and anonymity can be guaranteed by using an inborn ID that combines the device's unique PUF and bio information.

According to one embodiment of the present invention, the multiple authentication process can be simplified by performing authentication using unique information combining bio information (bio information-based authentication) and PUF (proprietary information-based authentication) as an authentication key.

According to one embodiment of the present invention, in the setup stage, unique information combined with bio information and PUF is used as a human ID, a separate authentication system matches personal information corresponding to the ID, and a certificate guaranteeing the human ID is issued. In the authentication stage, by using the authentication target as a human ID, anonymity can be guaranteed without infringing on personal privacy.

According to one embodiment of the present invention, when biometric authentication is an existing system, a human ID can be generated by matching on the device and used for two-way authentication and personal information protection.

1 and 2 are diagrams for explaining an operation of generating a personal ID and key in a user terminal according to an embodiment.
3 and 4 are diagrams for explaining a registration operation and a certificate issuance operation in an authentication system according to an embodiment.
Figure 5 is a diagram for explaining an authentication operation according to an embodiment.
Figure 6 is a flowchart for explaining the setup process according to one embodiment.
Figure 7 is a flowchart explaining the authentication process according to one embodiment.
Figure 8 is a block diagram for explaining an electronic device according to an embodiment.

Hereinafter, embodiments will be described in detail with reference to the attached drawings. However, various changes may be made to the embodiments, so the scope of the patent application is not limited or limited by these embodiments. It should be understood that all changes, equivalents, or substitutes for the embodiments are included in the scope of rights.

The terms used in the examples are for descriptive purposes only and should not be construed as limiting. Singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, terms such as “comprise” or “have” are intended to designate the presence of features, numbers, steps, operations, components, parts, or combinations thereof described in the specification, but are not intended to indicate the presence of one or more other features. It should be understood that this does not exclude in advance the possibility of the existence or addition of elements, numbers, steps, operations, components, parts, or combinations thereof.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as generally understood by a person of ordinary skill in the technical field to which the embodiments belong. Terms defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning in the context of the related technology, and unless explicitly defined in the present application, should not be interpreted in an ideal or excessively formal sense. No.

In addition, when describing with reference to the accompanying drawings, identical components will be assigned the same reference numerals regardless of the reference numerals, and overlapping descriptions thereof will be omitted. In describing the embodiments, if it is determined that detailed descriptions of related known technologies may unnecessarily obscure the gist of the embodiments, the detailed descriptions are omitted.

Additionally, in describing the components of the embodiment, terms such as first, second, A, B, (a), and (b) may be used. These terms are only used to distinguish the component from other components, and the nature, sequence, or order of the component is not limited by the term. When a component is described as being "connected," "coupled," or "connected" to another component, that component may be directly connected or connected to that other component, but there is no need for another component between each component. It should be understood that may be “connected,” “combined,” or “connected.”

Components included in one embodiment and components including common functions will be described using the same names in other embodiments. Unless stated to the contrary, the description given in one embodiment may be applied to other embodiments, and detailed description will be omitted to the extent of overlap.

1 and 2 are diagrams for explaining an operation of generating a personal ID and key in a user terminal according to an embodiment.

Referring to FIG. 1, the user terminal 100 may generate a personal ID and key based on the user's bio information and a unique key within the user terminal 100. Bio information may be input by the user, and the unique key may be a value inherent in the user terminal 100.

The user terminal 100 is a device controlled by a user, for example, various computing devices such as a mobile phone, smart phone, tablet, laptop, personal computer, or e-book device, a smart watch, smart glasses, or a head-mounted display (HMD). Mounted Display), or various wearable devices such as smart clothing, various home appliances such as smart speakers, smart TVs, or smart refrigerators, smart cars, smart kiosks, IoT (Internet of Things) devices, WAD (Walking Assist Device), and drones. , or may include robots. The user terminal 100 may be a device subject to authentication by an authentication performing device, which will be described below.

Bio information is the user's biometric data and may include, for example, information about at least one of the user's fingerprint, iris, voice, face, vein distribution, and retina. However, bio-information is not limited to the above-described examples and may also include biometric data of various users.

A unique key is a physically unclonable function (PUF) value based on electrical characteristics that are randomly determined using differences in the microstructure of semiconductors that occur in the same manufacturing process. It contains unique information about the device, like a fingerprint. and may have time-invariant properties. PUF can provide unpredictable digital values. Even if individual PUFs are manufactured in the exact same manufacturing process, the digital values provided by the individual PUFs are different due to process variations. Therefore, PUF may also be referred to as POWF (Physical One-Way Function practically impossible to be duplicated). These PUFs can be used to generate authentication keys for security and/or device authentication. For example, a PUF can be used to provide a unique key to distinguish devices from one another. PUF and a method of implementing it are described in Korean Patent No. 10-1139630, the entire content of which is incorporated herein by reference.

When describing human ID and key generation with reference to FIG. 2, a seed key 230 including at least part of the bio information 210 and at least part of the unique key 220 may be determined. The seed key 230 is a key that is the basis for generating the authentication key 240 for authentication, and may have a predetermined number of bits. For convenience of explanation, in this specification, it is assumed to have A number of bits. . This seed key 230 may be generated to include at least part of the bio information 210 and at least part of the unique key 220.

The bio information 210 is not a digital value from the beginning, but is output as a digital value from a bio sensor that detects the user's biological characteristics in the analog domain, so it is well known that it has a weakness in terms of time-invariance. It is known. For example, in the case of voice-based biometric authentication, even if some of the bio information 210 is the same each time it is recognized due to various factors such as the user's neck condition and surrounding noise, there may be parts that are determined differently each time. In addition, in the case of a fingerprint, part of the bio information 210 may be determined differently each time due to various factors such as the position/direction of touching the finger to the sensor, degree of contact, sensor surface condition, degree of wetness of the finger, temperature, and humidity. In the case of or iris, there may be a portion of the bio information 210 that is output differently each time due to illumination or other distortion factors. As a result, the bio information 210 may be misrecognized. Accordingly, at least a portion of the bio information 210 whose constancy is guaranteed to a certain level can be selected and utilized. The selection operation may be understood as a difference in the level at which the sensor samples the user's biometric characteristics, or as post-processing after detecting the user's biometric information 210.

The extent to which constancy is guaranteed in the bio information 210, at least part of which is guaranteed in the bio information 210 is the type of bio information 210, the user's characteristics, the environment in which the bio information 210 is detected, the bio It may be determined based on at least one of the characteristics of the sensor that detects the information 210. Types of bio information 210 include fingerprint, iris, voice, face, vein distribution, retina, etc., and the degree to which constancy is guaranteed (e.g., number of bits, bit length, etc.) may vary depending on the characteristics of the type. You can. The user's characteristics include the user's race, age, physical characteristics, etc. For example, the fingerprints of a user with hyperhidrosis may have less constancy than the fingerprints of a user with dry hands. Additionally, the environment in which the bio information 210 is sensed may include various environmental parameters, such as illumination, temperature, humidity, and ambient noise, without limitation. Additionally, the characteristics of the sensor that detects bio information 210 may include sensing resolution, sensing sensitivity, sensing method, etc. For example, the degree to which constancy is guaranteed may be different for optical fingerprint sensors and ultrasonic fingerprint sensors.

In the example of FIG. 2, at least part of the bio information 210 for which constancy is guaranteed has B number of bits. Here, B may be a natural number smaller than A. In other words, it is difficult to generate a seed key 230 with A number of bits using at least part of the bio information 210 whose constancy is guaranteed, and the insufficient number of bits A-B can be extracted from the unique key 220. The unique key 220 is a PUF value based on electrical characteristics that are randomly determined based on process deviations in the manufacturing process and has time-invariant properties.

The seed key 230 may be composed of at least part of the bio information 210 whose constancy is guaranteed, and the remainder may be composed of at least one of the unique keys 220. In this way, the seed key 230 is generated based on both the bio information 210 and the unique key 220, resulting in a single process of user authentication based on the bio information 210 and device authentication based on the unique key 220. In addition to improving security and convenience, it is also possible to supplement issues regarding the constancy of the bio information 210 itself. Preferably, half of the seed key 230 consists of at least part of the bio information 210, and the other half consists of at least part of the unique key 220, so that either user authentication or device authentication is neglected. However, at least part of the bio information 210 constituting the seed key 230 and at least part of the unique key 220 are not limited to the above-described examples.

In one embodiment, the seed key 230 may be determined further using at least a portion of random number information stored in the user terminal. Random number information may be a value generated by a random number generator (RNG) and stored in a memory such as a non-volatile memory (NVM). In summary, the seed key 230 includes at least a portion of the user's bio information 210 obtained from the user terminal, at least a portion of the unique key 220 corresponding to the user terminal, and at least a portion of random number information stored in the user terminal. It can be created using one.

The authentication key 240 is determined based on the seed key 230. Depending on the embodiment, the seed key 230 is used as the authentication key 240, or authentication is performed from the seed key 230 through an encryption algorithm. Key 240 may be generated.

According to another embodiment, the bio information 210 obtained from the user terminal may not be used to determine the seed key 230. The user terminal determines whether the acquired bio information 210 matches the pre-stored bio information, and if matched, uses at least one of at least part of the unique key 220 and at least part of the random number information to obtain the seed key 230. ), and the authentication key 240 can be generated based on the seed key 230.

The user terminal may generate the personal ID 270 based on the first part 250 of the authentication key 240. For example, the user terminal may use the first part 250 of the authentication key 240 as the personal ID 270. The user terminal may generate a private key 280 and a public key 290 by applying a public key algorithm to the second part 260 of the authentication key 240.

The length required for the personal ID 270 can be extracted from the authentication key 240 as the first part 250. The length required to generate the private key 280 and the public key 290 may be extracted from the authentication key 240 as the second portion 260. The first part 250 and the second part 260 may be parts that do not overlap each other, and depending on the embodiment, there may be a part of the authentication key 240 that does not belong to any of the first and second parts 250 and 260. It may be possible. Additionally, according to another embodiment, the first part 250 and the second part 260 may overlap at least partially.

3 and 4 are diagrams for explaining a registration operation and a certificate issuance operation in an authentication system according to an embodiment.

Referring to FIG. 3, an example is shown to explain the registration operation of the authentication system 300. In the setup procedure, the personal ID transmitted from the user terminal and the public key of the user terminal may be registered in the authentication system 300. The authentication system 300 can register the received human ID and the public key of the user terminal by matching the user's personal information. The user's personal information may include one or more various personal information about the user, such as name, age, address, and ID information registered in the authentication system 300.

Referring to FIG. 4, an example is shown to explain the certificate issuance operation of the authentication system 400. An example is shown to explain the certificate issuance operation of the authentication system 400. In the setup procedure, the authentication system 400 may issue a certificate 410 for verifying the user's signature. The certificate 410 may be generated by encrypting the user's personal ID and public key with the private key of the authentication system 400. The issued certificate 410 may be delivered to the user terminal of the corresponding user.

Figure 5 is a diagram for explaining an authentication operation according to an embodiment.

Referring to Figure 5, the process of performing actual user authentication after the setup procedure is shown.

The user terminal 510 may determine a seed key using at least part of the bio information obtained from the user and at least part of the unique key, and generate an authentication key based on the seed key. The user terminal 510 may generate a personal ID based on the first part of the authentication key and generate a public key and a private key based on the second part of the authentication key. In another embodiment, the user terminal 510 determines a seed key using at least one of at least a portion of bio information, at least a portion of a unique key, and at least a portion of stored random number information, and generates an authentication key based on the seed key. You may.

The user terminal 510 may generate private key signature information using the private key. For example, private key signature information may be a document signed with the private key.

The user terminal 510 may transmit the personal ID, private key signature information, and certificate issued by the authentication system 530 to the authentication device 520.

The authentication device 520 decrypts the certificate received from the user terminal 510 using the public key of the authentication system 530 received from the authentication system 530, so that it is registered in the authentication system 530 and attached to the certificate. The personal ID and public key of the included user terminal 510 can be obtained. In this specification, for convenience of explanation, the human ID generated in the user terminal 510 during the authentication operation is referred to as the first human ID, and the human ID registered in the authentication system 530 and included in the certificate is referred to as the second human ID. refers to

The authentication device 520 may perform primary authentication for the user based on whether the first ID received from the user terminal 510 and the second ID obtained from the certificate match each other. If the first authentication ID and the second authentication ID do not match each other, the authentication device 520 may transmit a primary authentication failure message to the user terminal 510. Conversely, if the first ID and the second ID match each other, the authentication device 520 can subsequently perform secondary authentication.

The authentication device 520 can perform secondary authentication for the user by verifying the private key signature information received from the user terminal 510 with the public key obtained through certificate decryption. If the private key signature information is not properly decrypted with the corresponding public key, the authentication device 520 may transmit a secondary authentication failure message to the user terminal 510. Conversely, if the private key signature information is normally decrypted with the corresponding public key, the authentication device 520 can successfully complete the secondary authentication.

Once this two-step authentication process is passed, two-factor authentication based on bio and ownership (e.g. PUF) can be completed using a non-real-name human ID. In other words, since the authentication process was completed using unique information that combines bio-based authentication information and ownership-based authentication information, two-factor authentication was performed simultaneously. At this time, the matching personal information is a non-real-name human ID, so non-real-name authentication can be satisfied. there is.

In one embodiment, a highly convenient application service is possible even when two-factor authentication of user authentication using bio information and device authentication using device information is performed. For example, safe and convenient authentication with guaranteed constancy is possible in various fields that require authentication, such as payments through voice recognition in vehicles, electronic payments through IoT devices, and financial transactions using smartphones.

For example, in FIG. 3, the authentication device 520 is implemented as a vehicle, and when the authentication procedure described above is completed through communication with a user terminal 510 (e.g., a smart phone) possessed by a legitimate user, the door of the vehicle is opened. The operation of opening can be performed. Alternatively, when the authentication performance device 520 is implemented as a payment server and the authentication process described above is completed through communication with a user terminal 510 (e.g., a smart phone) owned by a legitimate user, the corresponding user terminal 510 The payment requested may be approved by the payment server. At this time, the authentication system 530 corresponds to a CA (certification authority) and may include, for example, a public certification authority server. In addition, the previously described authentication process can be applied without limitation to various applications, so non-real-name two-factor authentication can be performed safely and conveniently.

Figure 6 is a flowchart for explaining the setup process according to one embodiment.

In step 610, the user terminal may receive input of the user's bio information. Bio information may include, for example, information about at least one of the user's fingerprint, iris, voice, face, vein distribution, and retina. However, bio-information is not limited to the above-described examples and may also include biometric data of various users.

In step 620, the user terminal uses an authentication key generated using at least one of at least a portion of bio information, at least a portion of a unique key corresponding to the user terminal, and at least a portion of random number information stored in the user terminal to provide a human ID. , you can generate private keys and public keys. For example, the user terminal may generate a personal ID using the first part of the authentication key, and generate a private key and a public key using the second part of the authentication key. In another example, the user terminal determines whether the acquired user's bio information matches pre-stored bio information, and in response to matching, authenticates using at least one of at least part of the unique key and at least part of random number information. You can also generate a key.

In step 630, the user terminal may transmit the personal ID and public key to the authentication system.

In step 640, the authentication system can register the personal ID and public key received from the user terminal by matching them with the user's personal information. Additionally, the authentication system can issue a certificate by signing the human ID and public key with the authentication system's private key.

In step 650, the authentication system may transmit the issued certificate to the user terminal.

Since the details described above with reference to FIGS. 1 to 5 are applied to each step shown in FIG. 6, a more detailed description will be omitted.

Figure 7 is a flowchart explaining the authentication process according to one embodiment.

In step 701, the user terminal may receive a user's request for an authentication performing device. For example, requests may include performing a payment, opening or closing a door, unlocking an electronic device, securing a secure connection, etc. The user terminal can receive the user's bio information along with the user's request.

In step 702, the user terminal uses an authentication key generated using at least one of at least a portion of bio information, at least a portion of a unique key corresponding to the user terminal, and at least a portion of random number information stored in the user terminal to create a first authentication key. You can generate a human ID, private key, and public key. In another example, the user terminal determines whether the acquired user's bio information matches pre-stored bio information, and when matching, authenticates using at least one of at least part of the unique key and at least part of random number information. You can also generate a key.

In step 703, the user terminal may transmit the first human ID, private key signature information, and certificate to the authentication performing device. For example, private key signature information may include documents signed with the private key. The certificate may have been issued by an authentication system during the setup process.

In step 704, the authentication device may obtain the second personal ID and public key of the user terminal included in the certificate by decrypting the certificate received from the user terminal with the public key of the authentication system. The authentication performing device may receive the public key of the authentication system from the authentication system.

In step 705, the authentication device may perform primary authentication for the user based on whether the first ID received from the user terminal and the second ID included in the certificate match each other.

If the first authentication fails because the first authentication ID and the second authentication ID do not match each other, the authentication performing device may transmit a message that primary authentication has failed to the user terminal in step 706.

When the first human ID and the second human ID match each other and the primary authentication is completed, in step 707, the authentication performing device verifies the private key signature information received from the user terminal with the public key included in the certificate to verify the user's identity. Secondary authentication can be performed. Private key signature information can be verified by determining whether the private key signature information is normally decrypted with the public key.

If secondary authentication fails because the private key signature information is not verified with the public key, in step 708, the authentication device may transmit a message that secondary authentication has failed to the user terminal.

When the private key signature information is verified with the public key and secondary authentication is completed, in step 709, the authentication device can perform an operation according to the user's request. For example, an authentication performing device may authorize a requested payment, open a door, or authorize access to a secure area. However, operations according to user requests are not limited to the examples described above.

In step 710, the authentication device may transmit the result of performing the operation requested by the user to the user terminal.

Since the details described above with reference to FIGS. 1 to 6 are applied to each step shown in FIG. 7, a more detailed description will be omitted.

Figure 8 is a block diagram for explaining an electronic device according to an embodiment.

Referring to FIG. 8 , the electronic device 800 includes a memory 810 and a processor 820. The memory 810 and the processor 820 may communicate with each other through a bus, peripheral component interconnect express (PCIe), network on a chip (NoC), etc. The electronic device 800 may be implemented as the user terminal, authentication device, or authentication system described above.

Memory 810 may include instructions that can be read by a computer. The processor 820 may perform the above-mentioned operations as instructions stored in the memory 810 are executed in the processor 820. Memory 810 may be volatile memory or non-volatile memory.

The processor 820 is a device that executes instructions or programs or controls the image restoration device 800 and may include, for example, a Central Processing Unit (CPU) and/or a Graphic Processing Unit (GPU). . In one embodiment, the processor 820 receives the first human ID, private key signature information, and a certificate issued by the authentication system from the user terminal, and decrypts the certificate using the public key of the authentication system, thereby decrypting the certificate included in the certificate. Obtain the second human ID and public key of the user terminal, perform primary authentication for the user of the user terminal based on whether the first human ID and the second human ID match each other, and when primary authentication is completed , performs secondary authentication for the user by verifying the private key signature information with the public key. In another embodiment, the processor 820 generates a first human ID in response to a user's request for an authentication performing device, and uses the first human ID, private key signature information of the user terminal, and a certificate issued by the authentication system. Transmits to the authentication device, and receives the results of primary authentication and secondary authentication based on at least one of the first human ID, private key signature information, and certificate performed by the authentication device.

In addition, the electronic device 800 can process the operations described above.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc., singly or in combination. Program instructions recorded on the medium may be specially designed and configured for the embodiment or may be known and available to those skilled in the art of computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. -Includes optical media (magneto-optical media) and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, etc. Examples of program instructions include machine language code, such as that produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter, etc. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

Software may include a computer program, code, instructions, or a combination of one or more of these, which may configure a processing unit to operate as desired, or may be processed independently or collectively. You can command the device. Software and/or data may be used on any type of machine, component, physical device, virtual equipment, computer storage medium or device to be interpreted by or to provide instructions or data to a processing device. , or may be permanently or temporarily embodied in a transmitted signal wave. Software may be distributed over networked computer systems and thus stored or executed in a distributed manner. Software and data may be stored on one or more computer-readable recording media.

Although the embodiments have been described with limited drawings as described above, those skilled in the art can apply various technical modifications and variations based on the above. For example, the described techniques are performed in a different order than the described method, and/or components of the described system, structure, device, circuit, etc. are combined or combined in a different form than the described method, or other components are used. Alternatively, appropriate results may be achieved even if substituted or substituted by an equivalent.

Therefore, other implementations, other embodiments, and equivalents of the claims also fall within the scope of the following claims.

Claims (17)

In the method of operating the authentication device,
Receiving a first inborn ID, private key signature information, and a certificate issued by an authentication system from the user terminal;
Obtaining a second personal ID and public key of the user terminal included in the certificate by decrypting the certificate using the public key of the authentication system;
performing primary authentication for a user of the user terminal based on whether the first human ID and the second human ID match each other; and
When the primary authentication is completed, performing secondary authentication for the user by verifying the private key signature information with the public key of the user terminal.
containing
How the authentication performing device operates.
According to paragraph 1,
The first human ID is
At least part of the user's bio information obtained from the user terminal;
At least part of a unique key corresponding to the user terminal; and
At least part of the random number information stored in the user terminal
generated based on a first portion of an authentication key generated using at least one of
How the authentication performing device operates.
According to paragraph 2,
The authentication key is
In response to a case where the user's bio information obtained from the user terminal matches pre-stored bio information,
At least part of a unique key corresponding to the user terminal; and
At least part of the random number information stored in the user terminal
Generated using at least one of the
How the authentication performing device operates.
According to paragraph 2,
The private key and public key of the user terminal are
generated based on the second part of the authentication key,
How the authentication performing device operates.
According to paragraph 4,
The first part and the second part of the authentication key are determined independently of each other,
How the authentication performing device operates.
According to paragraph 1,
The above certificate is
Generated by signing the second human ID and the public key transmitted from the user terminal to the authentication system during the setup process with the private key of the authentication system,
How the authentication performing device operates.
According to paragraph 1,
The second human ID and the public key transmitted from the user terminal to the authentication system during the setup process are registered in the authentication system along with the user's personal information,
How the authentication performing device operates.
According to paragraph 1,
When the secondary authentication is completed, performing an operation according to a request received from the user terminal.
containing more
How the authentication performing device operates.
In the method of operating a user terminal,
generating a first human ID in response to a user's request for an authentication performing device;
transmitting the first human ID, private key signature information of the user terminal, and a certificate issued by the authentication system to the authentication device; and
Receiving the results of primary authentication and secondary authentication based on at least one of the first human ID, the private key signature information, and the certificate performed by the authentication performance device,
The primary authentication is performed based on whether the first human ID and the second human ID of the user terminal included in the certificate match each other,
The secondary authentication is performed by verifying the private key signature information with a public key when the primary authentication is completed,
The first human ID is
At least part of the user's bio information obtained from the user terminal;
At least part of a unique key corresponding to the user terminal; and
At least part of the random number information stored in the user terminal
generated based on a first portion of an authentication key generated using at least one of
How the user terminal operates.
According to clause 9,
The authentication key is
In response to a case where the user's bio information obtained from the user terminal matches pre-stored bio information,
At least part of a unique key corresponding to the user terminal; and
At least part of the random number information stored in the user terminal
Generated using at least one of the
How the user terminal operates.
According to clause 9,
The private key and public key of the user terminal are
generated based on the second part of the authentication key,
How the user terminal operates.
According to clause 11,
The first part and the second part of the authentication key are determined independently of each other,
How the user terminal operates.
According to clause 9,
The above certificate is
Generated by signing the second human ID and the public key transmitted from the user terminal to the authentication system during the setup process with the private key of the authentication system,
The second human ID and the public key are obtained by decrypting the certificate using the public key of the authentication system,
How the user terminal operates.
According to clause 9,
The second human ID and the public key transmitted from the user terminal to the authentication system during the setup process are registered in the authentication system along with the user's personal information,
The second human ID and the public key are obtained by decrypting the certificate using the public key of the authentication system,
How the user terminal operates.
According to clause 9,
The step of receiving the results of the first authentication and the second authentication is
Receiving a result of an operation performed according to the request in response to the primary authentication and the secondary authentication being completed,
How the user terminal operates.
In the authentication device,
processor; and
Memory containing at least one instruction executable by the processor
Including,
When the at least one instruction is executed on the processor, the processor
Receive the first inborn ID, private key signature information, and certificate issued by the authentication system from the user terminal,
Obtaining a second personal ID and public key of the user terminal included in the certificate by decrypting the certificate using the public key of the authentication system,
Perform primary authentication for the user of the user terminal based on whether the first human ID and the second human ID match each other,
When the primary authentication is completed, performing secondary authentication for the user by verifying the private key signature information with the public key of the user terminal.
Authentication performing device.
In the user terminal,
processor; and
Memory containing at least one instruction executable by the processor
Including,
When the at least one instruction is executed on the processor, the processor
generate a first human ID in response to the user's request to the authentication performing device;
Transmitting the first human ID, private key signature information of the user terminal, and a certificate issued by the authentication system to the authentication device,
Receiving the results of primary authentication and secondary authentication based on at least one of the first human ID, the private key signature information, and the certificate performed by the authentication performance device,
The primary authentication is performed based on whether the first human ID and the second human ID of the user terminal included in the certificate match each other,
The secondary authentication is performed by verifying the private key signature information with a public key when the primary authentication is completed,
The first human ID is
At least part of the user's bio information obtained from the user terminal;
At least part of a unique key corresponding to the user terminal; and
At least part of the random number information stored in the user terminal
generated based on a first portion of an authentication key generated using at least one of
User terminal.

Images