KR20060014654A - System and method for the user's authentication by facial-password in the client-server computer system - Google Patents

Abstract

The present invention relates to a client server system and method for face password user authentication that performs electronic authentication for a user ID. The client computer first performs authentication for user identification using a face password, and authentication is successful. Then, a user authentication at the client server is performed by using a face security code produced by using a face image and a face password by a promised security function. This authentication method has the effect of utilizing the user's biometric information as electronic data for authentication, and the face security code produced by using the face image and the face password in the electronic processing process while maintaining the memory information input by the user simply It has the effect of having a complicated structure, and also has the security effect of automatically updating the user's face security code every time authentication is performed.

To this end, the present invention comprises the steps of inputting a face image of a user using a camera at the client computer and simultaneously inputting a face password; Performing user authentication by comparing similarity with a previously input face password; If the same face password is authenticated, creating a unique face security code for each user and transmitting information for authentication to a server; Producing a face security code for the corresponding ID at the server computer; Comparing and verifying the identity of the face password; If the face security code comparison verification result is the same, it characterized in that it comprises a step of performing a procedure for approving user authentication using a communication network. In addition, the user authentication system using a face password according to the present invention, a face recognition unit and a face password authentication unit for attaching a camera to obtain a face image and extracts the face password reference point for the face image input from the camera, A client computer including a face security code generation unit and a face password storage unit, a control unit to perform a logical operation, and a memory device, and a communication unit to transmit / receive user authentication information; And a face image recognition unit, a personal information database, a face security code generation unit, and a verification unit connected to the client computer through a wired / wireless communication network, a control unit for performing logical operations, a memory device, and a communication unit for data transmission and reception. It is characterized by including a server computer provided.

Description

System and method for the user's authentication by facial-password in the client-server computer system}

1 is a schematic diagram of a user authentication system and method using a face password

2 is a configuration diagram of a client server system for user authentication

Figure 3 is a schematic diagram of the face password authentication principle

4 is a schematic diagram for the production of the face security code

5 is a flow chart for the production of the face security code

6 is a flowchart for registering a face password user of a client server system.

7 is a flowchart for face password user authentication of a client server system.

<Explanation of symbols for the main parts of the drawings>

1: user (sender) 2: user's face image

3: client computer 4: camera

5: server computer 6: database

7: Electrical transmission and reception 8: Internet

9: main operation unit (CPU) 10: memory unit

11: Communication unit for data transmission and reception 12: Camera input image face recognition unit

13: face password authentication unit 14: face security code generation unit

15: face password storage unit 16: still image face recognition unit

17: face security code and face image verification unit

18: Face password first reference point P1 19: Face password second reference point P2

20, 21, 22, 23: Registered face passwords (M1, M2, M3, M4)

20c, 21c, 22c, 23c: tolerance for face password re-entry error

20s, 21s, 22s, 23s: Retyped face passwords (S1, S2, S3, S4) for authentication

25: encryption function

26: face security code

According to the present invention, in the user ID and password authentication using a client server structure, the face image corresponding to the user's biometric information and the user directly input the face image on the face image by means of a mouse or the like through the electronic authentication means of the user. The user of the server by the unique face security code of the person who is encrypted based on the password (hereinafter referred to as "face password") information in the GUI (graphic user interface) environment based on multiple location information and input order A client server system and method for face password user authentication performing identity authentication.

Conventional user identification technology has been the most widely used ID and password method of the character input method. In order to enhance the security of the password, a PIN (Personal Identification Number) numbering scheme may be used. And one-time passwords are transmitted and received by e-mail and authenticated, or question-and-answer user identity authentication methods are used in client-server. In order to improve security, user identity authentication technology is applied by using public key infrastructure or digital signature with public key encryption technology. It is used as a means for authentication.

Recently, the mobile phone number or a means using an encryption chip embedded in a mobile phone or a smart card and a user identity authentication means using a radio frequency identification (RFID) technology are being applied to the real life.

Since the above user identification means performs ID and password authentication only by a random combination of numbers and letters that do not reflect the biometric characteristics of the user, in terms of authenticating the other party in an electronic transaction that cannot directly see or contact the other party. There is a problem that must be limited.

In order to improve the above problems, many research and development efforts have been made to apply user identity authentication technology using biometric authentication to actual industrial sites. Biometric technologies include the use of human's static characteristics such as face recognition, fingerprint recognition, iris or retinal recognition, and vein recognition, and methods to analyze human behavior and apply them to authentication. Gait and voice are being researched and developed. The above biometric methods have not yet overcome the practical problems of implementing the user identity authentication technique for a large number of users connected to the network. The biggest problem is the equal error rate (EER), that is, the false recognition rate ( There is a difficult problem in that it is not possible to provide 100% identity authentication to all users due to false acceptance ratio (FAR) and false rejection ratio (FRR). Nevertheless, biometric technology is a technical method that can more reliably provide the non-repudiation effect on the transactions of electronic trading parties in electronic transactions.

In addition, in the off-line transactions, unlike the trade partners face-to-face and promote the transaction, online transactions only send and receive authentication and transaction information, there is a problem that you can not face the other party directly. In the conventional biometric authentication method, a user identification technology is electronically performed by a method of transmitting and authenticating a personal biometric template, but at the same time, it is difficult to identify the other party directly with human eyes at the same time. to be. Therefore, if a digital still image is to be transmitted to a counterparty for the above purpose, a security function for forgery and forgery of face image data should be separately provided.

According to another technical requirement, in the case of direct transmission of facial images in electronic transactions, a large number of image editing tools, such as the Photoshop program of Adobe Co., Ltd., are widely distributed on the market. Or all of them can be easily forged and altered, and a video parody that expresses parts of an image differently appears as a social phenomenon on the Internet. Security measures for solving the above problems include watermarking, steganography, scramble and other technical means, but it is a security technology that applies encryption algorithm uniformly to the whole image. In the decryption process, there is a problem in that a security function cannot be differentiated for each face image due to a large amount of operation or a security structure such as a symmetric key. In addition, public key (PKI: Public Key, also known as symmetric key type DES (Data Encryption Standard) algorithm, asymmetric key type RSA (Rivest Shamir Adleman), DSA (or Digital Signature Standard), etc. Compared with the security based on the infrastructure based encryption algorithm, the encryption level of the image security technology is significantly lower. Therefore, the development of a security algorithm applied with a private key in the transmission of digital still face images is a necessary technique in terms of information protection in the transmission of personal face images.

In addition, various attempts have been made to combine biometric template data and public key-based encryption technology to enhance biosecurity information and security of biometric information for data transmission.

The problem of the user authentication method of the conventional ID password structure is that user convenience is high, but security for user authentication is a weak method. For example, authentication by entering a combination of letters and numbers on the keyboard is more secure but difficult to remember if the user uses a combination of complex passwords, and vice versa. Presumed security vulnerability.

In the case of biometric authentication, since it is very difficult to change the biometric information of an individual, encryption technology for protecting the biometric information of an individual transmitted through a communication network is very important.

Another problem is that the personal information for authentication provided directly by the user, such as in ID password authentication or biometric authentication, is transmitted to the server via a communication network, so that the authentication information as the transmitted personal information is not encrypted. There is a problem that the security risks of data transfer and personal information for user authentication in the server computer are concentrated.

An object of the present invention is to solve the above problems, in the client computer, the facial image authentication means for performing the electronic authentication and correlated with the face biometric information of the user and the face image and face password as personal information provided for authentication The face security code means that can be encrypted so that information can be protected is logically combined and transmitted, the server system for the face password code authentication for the user ID is implemented in the server system, the client server system for face password user authentication with excellent identity characteristics And providing a method.

In addition, another object of the present invention is in the configuration of personal information data used for user authentication, if both the face image and the face security code input for authentication of the user ID from the client to the server, the face transmitted from the server computer By verifying the identity of the face security code generated from the image and the face password stored in the database and the transmitted face security code, the possibility of forgery tampering of the transmitted face image and the integrity determination of the transmitted face security code can be simultaneously achieved. A client server system and method for face password user authentication are provided.

In addition, another object of the present invention is to improve the individual security value of the face security code by using the face password information specified by the user in a random form when transmitting digital still face image data directly used in the production of the face security code for encryption To provide a client server system and method for face-password user authentication in a secure manner that can determine the possibility of forgery tampering.

Further, another object of the present invention is a security structure for storing and authenticating personal information in a user authentication system, wherein the user input information is diversified into a face image and a face password, and a face security code used for direct authentication is used for face recognition. It is manufactured and authenticated through mathematical coordinate conversion process and encryption process, and the security effect is excellent by the process of distributing personal information and face security code, compared to the conventional method, and at the same time, it is applied electronically while simplifying user's password memory. It is to provide a client server system and method for face password user authentication that allows passwords to be very complex and automatically updated.

A client server system and method for face password user authentication according to the present invention for achieving the above object include: inputting a face image of a user using a camera at a client computer and simultaneously inputting a face password using the face image;

Performing user authentication by comparing the similarity between the registered face password at the client computer and the face password input for authentication;

If the authentication is performed using the same password, generating a face security code produced by an encryption function using a face image and a face password as user input information, and transmitting an ID, a face image, and a face security code to a server;

Reading, by the server computer, a face password for the corresponding ID from a database and manufacturing a face security code using the transmitted face image;

Comparing and verifying the identity of the face security code transmitted from the client computer and the newly created face password at the server computer;

If the face security code comparison verification result of the corresponding ID is the same, the step of approving the user authentication to the client computer using a communication network, characterized in that configured to include.

The client server system for face password user authentication according to the present invention includes a face recognition unit and a face password authentication unit attached to a camera to acquire a face image and extracting a face password reference point for the face image input from the camera. A client computer including a face security code generation unit and a face password storage unit, including a control unit and a memory device to perform logical operations, and a communication unit to transmit and receive data; And

The client computer is connected to the wired / wireless communication network, and includes a face image recognition unit, a personal information database, a face security code generation unit, and a verification unit, and a control unit for performing logical operations, a memory device, and a communication unit for data transmission and reception. It is characterized in that it is configured to include a server computer.

Hereinafter, the detailed techniques applied to the client server system and method for face password user authentication will be described in detail with reference to the accompanying drawings.

1 shows an overview of a user authentication system and method using a face password. In the server computer 5 structure in which the client computer 3 is connected to the Internet 8 communication network and performs the electrical transmission and reception process, the user 1 who performs user authentication using the client computer 3 The user can input his / her face image 2 through the camera 4 connected to the client computer 3, and at the same time, the server computer 5 can store and use personal information for authentication of various users. It is the structure which can be provided with the database 6 which exists. In detail, the process of electrical transmission and reception (7) is described. Step 7a of downloading the software for user registration or authentication from the client computer 3 from the server computer 5 and the user 1 from the client computer 3 is described. Step 7b of transferring personal information back from the client computer 3 to the server computer 5 to perform the authentication procedure and requesting user authentication on the server computer 5 and the user transmitted from the client computer 3 Step 7c is performed by performing a user authentication procedure at the server computer 5 using the personal information for authentication and transmitting the authentication result back to the client computer 3.

2 illustrates a configuration of a client server system for user authentication. The client computer 3 includes a camera device 4 for receiving a face image of a user, and is provided with a camera input image face recognition unit 12 as a main component of the computer, and a face password authentication unit 13 ), A face security code generation unit 14, and a face password storage unit 15, the main operation unit control unit 9 and the memory device 10 to perform the computer operation for the user authentication In addition, the data transmission and reception communication unit 11 is also provided. In addition, the user software constituting the camera input image face recognition unit 12, face password authentication unit 13, and face security code generation unit 14 in the client computer 3 is transmitted from the server computer 5 through a communication network. Is received (7).

In the client computer authentication system described above, the camera 4 input image face recognition unit 12 selects any one of the moving images input from the camera and performs a face recognition process on the selected still image to perform any After determining whether there is a human face region, extracts both eye regions of the face from the face image, and sets coordinate points of both eyes to perform face password input. The face password authentication unit 13 sets a reference coordinate point corresponding to both eyes in the input face image, and then the user arbitrarily designates an easy-to-remember area such as an eye nose mouth of the face by a mouse or a touch screen method. Performs face password registration and authentication function to utilize the input location and input order in. The face password generator 14 performs a function of performing an encryption function by using the registered face password information and the input face image. The face password storage unit 15 stores a face password value registered in the client computer as a face coordinate system after face password registration.

The server computer 5, which is connected to the Internet and performs electrical transmission and reception, transmits all personal information for user authentication, that is, an ID, a face image, and a face security code, through the communication unit 11 for data transmission and reception. The transmitted still image face recognition unit 16 for extracting the reference coordinate points of both eyes with respect to a single face image, a personal information database 6 for extracting the face coordinate system face password of the corresponding ID, the still image and the individual The face security code generation unit 14 which performs encryption function calculation using the face password information in the information database, and the face security code identical to the face security code produced by the server computer as the personal information transmitted from the client computer. It is provided with a face security code verification unit 17 to verify, and the computer operation for the user authentication Also provided is a main operation unit control unit 9 and a memory unit 10 to be performed.

In the server computer authentication system, the face security code generation unit 14 of the present invention uses the same encryption function and the face security code production method, but it is also possible to apply encryption functions not identical to each other at the request of the user. That is, even if the face security code generation unit 14 of the server computer 5 and the client computer 3 applies the face image and the face password as the same user input information, the face security code values are produced to be inconsistent with each other. It will be clear that the face security code verification unit 17 may be solved by performing an additional operation previously promised. That is, the face security code generation unit 14 of the server computer additionally design and apply an arbitrary security function, and the face security code verification unit 17 applies the inverse function of the security function applied first again. In the personal information database 6, the face password and the face image of the registration step for each ID are stored for the purpose of authentication, and the face image transmitted in the authentication step is separately stored and managed for management purposes. In addition, the still image face recognition unit 16 uses the same face recognition algorithm as the camera input image face recognition unit 12 of the client computer 3.

Figure 3 shows an overview of the face password authentication principle. Figure 3a is to find both eyes of the face by applying a face recognition technique, using one eye as the first reference point (P1) (18) corresponding to (0,0) and the other eye (100,0) 2 is a diagram showing the principle of newly converting and normalizing the coordinate values of the specific position points (x1, y1) 55 inputted into the face by setting the reference points (P2) 19. The arbitrary position points (x1, y1) 55 of FIG. 3A have the effect of geometrically transforming a specific position point value represented by the xy window coordinate system by the first and second reference points P1, P2. The conversion system in which the same new coordinate value conversion is performed with respect to both eyes of the person is hereinafter referred to as "face coordinate system". The feature of such a face coordinate system is that when a user inputs a specific position of a face in the registration or authentication step, a face of a human face is inputted from the camera in a large or small form, and at the same time, the face position of each face is moved. Remembering is easier and more convenient than remembering with computer window coordinates. In other words, it does not use an arbitrary input position in the face image displayed on the window screen as a latitude coordinate system, but uses a relative coordinate system that is re-designated by triangulation based on two eyes of the face. The process of finding both eyes in the face image and setting the reference coordinate points of the face coordinate system using conventional academic face recognition techniques will first be described. A process of extracting target areas such as eyes, eyebrows, noses, and mouths is performed, and the masses corresponding to the eyes are extracted from the masses estimated to be the face parts. The center coordinates of the lump, which are estimated as eyes, are recognized as eye coordinates and used as reference coordinate points P1 and P2 of the face coordinate system.

FIG. 3B is a view for explaining the principle of face password authentication using a face coordinate system. First, the concept of face password will be briefly described. Otherwise, if a face image of the user is introduced on the computer screen through the camera, and a plurality of position points arbitrarily designated in the face image are input again using a mouse or a touch screen on the computer screen, the face coordinate system is used to register the face image. The authentication scheme of the method for determining the similarity between the input order and the input position for the input points and the input points in the authentication step will be referred to as "face password authentication" in the following. The facial password authentication will be described in detail with reference to FIG. 3B. Any input points of the user inputted by the mouse in the registration step form a series of unique patterns with respect to the reference points (P1, P2) (18, 19) of the face coordinate system corresponding to both eyes, and are recognized as the face coordinate system. Face password registration points (M1, M2, M3, M4) (20, 21, 22, 23) is stored in the form. When inputted again by the user's registration step memory in the authentication step, the input points are converted into the face coordinate system by the reference points (P1, P2) (18, 19) of the face coordinate system in the face image used for input, and the face password authentication is performed. It is represented by points S1, S2, S3, S4 (20s, 21s, 22s, 23s). The above face password input points apply both the input position and the input order to the authentication, and even though the input order and the input position are performed for the user face password authentication, the positions of the authentication point and the registration point are as shown in FIG. 3B. It is difficult to match exactly. Therefore, in the face password authentication, the allowable range of the face password re-input error (20c, 21c, 22c, 23c) considering the user's memory error and input error is set, and the allowable error range can be set differently for each input point. You can also unify the input point.

The characteristic of such an authentication system is that unlike a conventional password, authentication is performed using biometric information. In addition, a conventional password is a method for determining whether an input password and a password for authentication are the same, but a face password is registered. It is to use the authentication method to determine the input position error of the location points requesting authentication in accordance with the input order of the location points and to determine the similarity. Therefore, in the face password authentication, there may be a false recognition rate, but unlike the conventional face recognition uses a large amount of facial feature information for authentication, in the present invention, the false recognition rate by the method using only both eyes in the face as biometric information This can be greatly improved. In face password authentication, the biometric step of finding both eyes is first performed as a preprocessing process. In the next step of determining the similarity of the user input information, the input order and position error of the registration points and the authentication points after conversion to the face coordinate system as reference points (P1, P2) (18, 19) of the face coordinate system are simply determined. Since only a mathematical operation for determining is performed, a logical error does not exist. In other words, it is an authentication means that can yield a result of "yes or no". The face password authentication method as described above may be referred to as a technology different from the conventional face authentication because the face password authentication may be performed using another person's face. However, since the face image of the person performing the authentication must be used for authentication, the face password authentication can be performed. Therefore, there is a security effect of identity verification for the person requesting the authentication. Another feature is that it is a password authentication method using a face screen.

Figure 4 shows the outline for the production of a face security code, showing the process of producing a face security code by performing an encryption function operation for the face security code using a face password and a face image to produce a face security code will be. The facial password reference points 18 and 19 extracted from the face image 2 and the facial image 2 input from the camera, and the facial password registration points marked with respect to the reference points 18 and 19 (20, 21, 22, 23). By using the encryption function 25 to perform the operation to produce a face security code (26). The encryption function 25 used to produce the face security code will be described in detail. When the face password registration points of the face coordinate system are converted back to the window coordinate system, different coordinate values {(x1, y1), (x2, y2), (x3, y3), (x4, y4)}. As the encryption function 25, a one-way function in the form of a polynomial equation is used. For example, in the functions f (x1, y1, x2, y2, x3, y3, x4, y4) = ax1 * by1 * cx2 * dy2 * ex3 * gy3 * hx4 * iy4 a, b, c, d, e, g , h, and i are constants and can be calculated by applying coordinates to variables. The user's face security code is produced by substituting the window coordinate value of the face password into each variable value to derive one result value and converting the result of the function operation back to the hexadecimal value. In addition, in order to increase the correlation between the face image and the face security code in addition to the coordinate values used in the calculation process, the polynomial is selected from the hue, lightness, and saturation information from RGB or YCbCr image information values of pixels corresponding to four registration points. Of course, it can also be applied as a variable value of the equation. And it will be appreciated that the hexadecimal conversion of the result of the function operation performed by those skilled in the art can be changed as necessary.

The method of manufacturing a face security code is a method of simultaneously applying a face password as a user's memory information and a face image as a user's biometric information to a face security code, which can distribute and manage personal information to be used for copying a face security code. Is the point. In addition, since the face security code and the face image produced by the above method are mathematically related by the face password and the encryption function, the face security code can be a technical means for determining the authenticity of the face image. That is, even a face image obtained from the same person has a characteristic that is constantly changing due to the surrounding lighting conditions, the position of the face in the screen, and the minute pose change of the face, so that the face security code produced by the same face password information is also used. It also has the characteristic of always changing. In the security aspect of the still face image, since the original input value of the user, the face password, is the start information that generates the face security code for each still face image, the face used for authentication by face security code authentication. It also features features that provide an indirect key to image forgery and tampering.

5 shows a procedure for manufacturing a face security code. If the detailed description of the face security code production process step by step, first performs a personal information collection step as a start process for producing a face security code (S100). In the personal information collecting step, the face password registration point information stored in the face image and the face coordinate system stored in the client computer is prepared. The server computer also reads the face password registration point from the database. In the next step, both eyes are extracted from the prepared face image and the reference coordinates of the face coordinate system are set (S110). When the reference points of both eyes are extracted from the face image, it means that the face password information can be freely converted between the face coordinate system and the window coordinate system as required by those skilled in the art. Next, a step of converting the face password registration point indicated by the face coordinate system into the window coordinate system is performed (S120). The reason for performing such a step is to express the same face password registration point differently every time authentication is made using the face image used for authentication. That is, when face passwords of the same face coordinate system are represented in different face images or face images having different positions of up, down, left and right in the screen, the face password is expressed differently from the viewpoint of the window coordinate system. In the next step, a variable value to be applied to an encryption function for producing a face security code is selected (S130). In the next step, the input information extracted in the previous step is substituted into the encryption function, and the encryption function is performed (S140). In the next step, a standardization step of the security code for converting the result value obtained by the function operation into hexadecimal is performed (S150). In this step, in the security code representation, in order to increase the complexity of the function operation result value, the security code may be converted to a higher number than the hexadecimal number, and the length of the security code may be standardized by limiting the number of characters. As a final step, the face security code generation is completed (S160). This means that the face security code, which has been completed in the previous step, is kept in a memory or a storage device and the next step for user authentication is performed.

6 illustrates a procedure for face password user registration of a client server system. After the client computer and the server computer are connected to each other by using a wired / wireless communication network (S200), and after receiving a face image of the user from a camera connected to the client computer as a next step, as shown in detail in FIG. In case of determination and face, a camera input image face recognition step of extracting a reference point corresponding to both eyes in the face is performed (S210), and a user's face password using a mouse or a touch screen in the face image from which the reference point is extracted. Newly received and stored in the client computer (S220). At this time, the stored face password is registration point information that is converted into a face coordinate system and stored. In the next step, the step of generating the face security code described in detail in FIG. 5 is performed (S230), and when the generation is completed, the user ID and face image and the face security code through the communication unit of the client computer and the face stored in the face coordinate system in the step. The password registration point is transmitted to the server computer (S240). In this case, since the size of the transmitted personal information includes a face image, the size of the personal information is larger than the basic packet size in the normal TCP / IP communication, so that the data is separated into several communication packets and transmitted. When all data transmitted from the client computer through the communication network is received by the server computer, the server computer performs a face recognition step of extracting the reference coordinate points of the face coordinate system of both eyes from the transmitted still face image (S250). Re-creating the face security code using the face password registration point and the face image transmitted in the next step (S260), verifying the identity of the face security code produced by the server and the face security code transmitted from the client computer Indirectly determining the integrity of the transmitted face image (S270). If the verification result is not the same, a step of notifying the rejection to the client computer is performed (S300). If the verification result is the same, the step of storing the still face image and the face password for each ID in the server database is performed (S280). In step S290, the client computer is notified of the approval.

7 shows a procedure for face password user authentication of a client server system. After performing the user registration process of FIG. 6 first, the user authentication process for the corresponding ID is performed in the following process. In a start step in which a client computer and a server computer are connected to a wired / wireless communication network for user authentication (S400), a face recognition step of inputting a face image of a user using a camera and extracting a reference coordinate point for the face image is performed. Next, a step of inputting a face password using the face image is performed (S410), and the face password registration points stored after the user registration on the client computer and the face password authentication points newly inputted for authentication are regenerated. A face password authentication step of performing user authentication is performed by determining whether an input error exists within an allowable range (S430). If it is determined that the face password is not the same, the authentication failure step is performed and the user authentication is terminated (S440). When the same face password is authenticated, a face security code produced by an encryption function is generated using a face image and a face password as user input information (S450), and a step of transmitting an ID, a face image and a face security code to a server is performed. (S460). The face security code generation process performed in the authentication process is performed in the same manner as the registration process, but the encryption functions to be applied may be defined and used differently. In the authentication process, unlike the registration process, the face password is excluded from the configuration of the personal information data transmitted from the client computer to the server computer. When all data transmitted from the client computer through the communication network is received by the server computer, the server computer performs a face recognition step of extracting the reference coordinate point of the face coordinate system of both eyes from the transmitted still face image (S470). The server computer reads out the face password for the corresponding ID from the database and generates a face security code using the transmitted face image (S480). The face security code transmitted from the client computer and the server computer are newly produced. Comparing and verifying the identity of the face security code has been performed (S490). If the face security codes do not match, it is determined that the face security code transmitted from the client computer is forged or the transmitted face image is forged or tampered, and a step of notifying the client computer of rejection is performed (S520). If there is a match, it is determined that the integrity of the transmitted face image is proved by indirect means, and the step of storing the still face image for each management purpose in the server database is performed (S500), and notifying the client computer of the approval. (S510). The database information in which the still face image of the user is accumulated in the registration step and the authentication step has an advantage that it can be used as data for user authentication by conventional face recognition technology.

As another example, when the face password authentication step is performed on the client computer as in the above example, a problem may be derived that can be repeated indefinitely to estimate the face password of the user regardless of the server system. For security reasons, the server computer may sequentially perform the face password authentication step S430 of FIG. 3 or 7 together with the face security code authentication step.

The present invention is not limited to the above-described embodiments and may be variously modified and changed by those skilled in the art, which are included in the spirit and scope of the present invention as defined in the appended claims.

As described above, according to the client server system and method for face password user authentication according to the present invention, face password authentication using information about randomly selected points in a face using the user's face image as an authentication principle, The user authentication function is strengthened online and the user authentication success rate is enhanced by two authentication methods that have the correlation between the face security code authentication produced by the encryption function calculation using the registered face password information and the face image during authentication. The new client server method has the effect of providing a separate security measure for still face images while greatly improving, and having the effect of distributed storage and management of personal information due to various characteristics of information for user authentication. User Identity Authentication System and Method Provided.

Claims (23)

In the client server authentication method for face password user authentication that performs electronic authentication for the user ID, (a) inputting a face image of a user using a camera at a client computer, and inputting a face password using a mouse; (b) performing face password authentication on the face password authentication point; (c) if a face password of the same user is authenticated, manufacturing a face security code using the face image and the face password; (d) transmitting the face security code produced by the face image and face image for each ID as personal information for authentication from the client computer to the server computer; (e) at the server computer, reading a face password of the corresponding ID received from the client computer in a database, and producing a face security code on the received face image in the same manner as at the client computer; (f) performing user authentication in a method for determining the sameness between the face security code produced at the server computer and the face security code received at the client computer; (g) storing user information and transmitting the authentication result to the client computer. The method of claim 1, wherein step (a) When face image and face password information is input from the user, a face recognition technique is applied. (a1) extracting important face parts estimated from eyes, nose, mouth, and eyebrows of the face through binarization and color image analysis of the face image; (a2) extracting image chunks corresponding to both eyes from the image chunks of the plurality of face parts; (a3) A method for face password user authentication of a client server structure comprising the step of recognizing a center coordinate of an estimated image mass of an eye as a coordinate point of an eye. The method of claim 1, wherein step (b) A step of performing user authentication on the face password registration point information entered by the user in the registration step and the authentication point information of the face password re-entered in the authentication step, (b1) setting both eyes to a reference coordinate point of the face coordinate system with respect to the face image; (b2) showing face password registration point information and authentication point information input by the user in the face coordinate system; (b3) A method for face password user authentication of a client server structure comprising an authentication step of determining whether an authentication point exists within an allowable re-input error tolerance given to a registration point according to a user's input order. The method of claim 2, wherein the size of the re-input error tolerance in step (b3) is set differently for each registration point and applied to authentication. The method of claim 1, wherein step (c) As a step of producing a face security code as a means for encrypting the content of the personal information for user authentication transmitted using a communication network to be difficult to infer, (c1) preparing a face image and a face password registration point of a face coordinate system as personal information for manufacturing a face security code; (c2) setting both eyes in the face image as a reference coordinate system; (c3) marking the face password registration point of the face coordinate system in the face image of the window coordinate system; (c4) selecting personal information values to be applied to the encryption function; (c5) performing a cryptographic function operation, the method for facial password user authentication of a client server structure. 6. The face password user authentication of a client server structure according to claim 5, further comprising the step of converting the result value into a hexadecimal number as a means of information transmission efficiency and complex expression when the result value of the encryption function operation is made to a very large value. Way for you. 6. The method of claim 5, wherein the encryption function for producing the face security code in step (c5) uses a one-way function of a polynomial equation structure. 8. The method of claim 7, further comprising using image information values for colors in face password coordinates used as variable values in a polynomial equation as an encryption function. The method of claim 1, further comprising separately storing and managing a still face image as personal information used for authentication for each user ID in a personal information database. The method of claim 1, wherein as a registration step for authenticating a user ID, (h) inputting a face image of the user using a camera at a client computer and inputting a face password using a mouse; (i) storing the face password registration point in the face coordinate system; (j) manufacturing a face security code by applying the registered face password and the reference coordinate point extracted from the face image; (k) transmitting the face image for each ID, the face security code made from the face image, and the stored face password as personal information for registration from the client computer to the server computer; (l) producing a face security code in the same manner as in the client computer with respect to the face password and the received face image of the corresponding ID received from the client computer; (m) performing user authentication in a method for determining the sameness between the face security code produced at the server computer and the face security code received at the client computer; (n) storing the user registration information in a personal information database and transmitting the authentication result to the client computer. The method of claim 10, wherein the personal information stored in the database in step (n) comprises an ID, a face password, and a face image. The method according to claim 1, wherein the face password authentication step at the client computer can be repeated indefinitely regardless of the server computer. A method for face password user authentication of a client server structure in which a face password authentication step performed at a client computer is performed at a server computer. In the client server system for face password user authentication connected to a wired or wireless communication network to perform electronic authentication for the user ID with a computer system having an external device such as a mouse, a monitor, a touch input device, a camera, etc. A client computer including a camera input face image face recognition unit and a face password authentication unit of the user, further comprising a face security code generation unit and a face password storage unit, and including a control unit as a computing device and a communication unit for data transmission and reception; The server computer connected to the client computer and the communication network is provided with a still image face recognition unit, a face security code generation unit, a face security code verification unit, and a personal information database, and a control unit as a computing device and a communication unit for data transmission and reception are provided. Client server system for facial password user authentication, including server computer. The client server system of claim 13, wherein the client computer and the server computer are connected to a wired or wireless communication network. The face recognition unit of claim 13, wherein the camera input image face recognition unit at the client computer and the still image face recognition unit at the server computer have the same face recognition algorithm that designates both eyes as reference coordinate points for inputting a face password in the face image. Client server system for face password user authentication. The face password user authentication of claim 13, wherein the face password authentication unit converts coordinates into a face coordinate system and performs user authentication using a face image input by a user and an input point within a face input by a mouse. Server system for management. The client of claim 16, further comprising a face password authentication unit configured to determine whether an authentication point exists within a re-input error tolerance given to the registration point in accordance with an input order for face password user authentication. Server system. 15. The client server system of claim 13, wherein the client computer and the server computer system each implement a face security code generation unit using the same encryption function and face security code manufacturing method. 19. The client server system of claim 18, wherein the encryption function is not defined identically for security reasons and a face security code is produced. 19. The method according to claim 13 or 18, wherein the face security code verification unit determines the identity of the face security code received from the client computer and the face security code produced by the server computer. Client Server System. 20. The apparatus of claim 13 or 19, wherein the face security code verification unit applies a reverse function to the face security code produced by the server computer to produce a new face security code and determines the same as the face security code received from the client computer. Client server system for facial password user authentication characterized in that the function. 15. The client server system of claim 13, wherein the personal information database stores face images expressed by face IDs and face coordinates transmitted in the registration step. The client server system of claim 13, wherein the face image in the authentication step is separately stored for each ID in addition to the personal information database.

Images