KR20060119796A - Wireless telecommunication device with output control function - Google Patents

Abstract

A wireless communication terminal equipped with an output control function is provided to offer a password output function with strengthened security, control output of secrecy maintenance data by using biometric information, and output the secrecy maintenance data with minimum key operations without being exposed to the network. The wireless terminal(10) includes a transceiving module transceiving voice or data, an outputting module, a data storing module, a sensor recognizing the biometric information, and a computing module controlling each component. The wireless terminal checks the biometric information of a user by using the sensor in a secrecy maintenance data outputting mode, and outputs the autonomously generated or transceived data requiring secrecy maintenance after processing the data or without processing the data. The data requiring the secrecy maintenance includes a one-time password, the transceived data, mobile phone ID information, or mobile phone user information.

Description

Wireless telecommunication device with output control function

1 is a block diagram when receiving an OTP in a wireless network in the present invention

2 is a schematic diagram of a network connection of a system using a mobile phone having a password generation function according to the present invention;

3 is an operational block diagram of a cryptographic generator in a mobile communication terminal according to the present invention;

* Description of the main reference numerals

10; Communication terminal 19; Biometric information sensor 30; Authentication request server 40; Authentication server

The present invention relates to a wireless communication terminal having an output control function.

The authentication process is necessary to confirm whether the user is legitimate or to grant the user authority in online and offline commerce, access to security buildings, or the use of pay devices in multiple facilities. For example, in credit card settlement, credit card holders present a credit card or credit card number to establish a transaction, but there is no safeguard against credit card theft or leakage of credit card information. In order to compensate for this, it is possible to require the presentation of a fixed password, but there is a high possibility that such a password can be stolen and used with a credit card or credit card number, and such an accident is actually occurring.

On the other hand, wireless communication terminals including mobile communication terminals are not only voice communication but also information processing capability. Most of them are carried by the general public so that they are saturated in the middle and advanced countries. There have been attempts to use this as an auxiliary device for authentication.

US Pat. No. 5,608,778 discloses a technology for authorizing the use of a mobile device, such as a credit transaction, for a commerce or secured building, or for a multi-facility payable device, as a tool for controlling the authentication process with a mobile phone. In Korean Patent Application Nos. 1999-4871, 1999-57586, 2000-14506, etc., the authentication number is transmitted from the authentication server to the mobile phone at the request of the seller server in the authentication procedure of online commerce, and the authentication entered into the seller server by the user. There is disclosed a micropayment method in which a verification server verifies a number, approves a transaction, and charges a communication fee. The authentication number is a one-time use valid time (for example, 10 minutes).

Korean Patent Laid-Open Publication No. 1999-37751 (published on 1999, 05, 25) includes a password generation unit, which has a password generation function for generating a response value as a one-time password from a challenge value including a time received from a communication module from a server. Disclosed is a communication terminal device. Korean Patent Registration No. 412986 discloses a one-time password authentication method for synchronizing time and event values using a mobile phone. Korean Patent Registration No. 441905 discloses a time-synchronous mobile phone authentication system that can be used in multiple environments by assigning a seed value to a department member.

The security of the authentication process can be further enhanced by the one-time encryption method using a mobile phone, that is, a wireless communication terminal. However, a security problem may occur when a PIN code or a password corresponding to the PIN code or personal information is leaked together with the mobile phone. Can be.

The conventional technology may use the wireless communication terminal only by means of a single-use password transmission means, thereby failing to fully utilize the security aspects of the wireless communication terminal in commerce or incompletely relying on it to achieve desirable security and convenience. There was no.

The present invention is to provide a wireless communication terminal having a cryptographic output function further enhanced security.

The present invention also relates to a wireless communication terminal having a function of output control of confidentiality data information by biometric information.

In addition, the present invention is to provide a wireless communication terminal that can output confidential data information with minimal key operation without being exposed on the network and can maintain security even if stolen with meaningful information on the security of the user. will be.

The present invention also relates to a wireless communication terminal having an authorization request control function to prevent unauthorized use.

In addition, the present invention is a wireless having an authorization request control function that prevents unauthorized use to output an authorization request signal to the authentication request server by an authorized user to pay or settle to an account associated with the wireless communication terminal. It relates to a communication terminal.

Transmitting and receiving module for communicating voice or data according to the present invention; Output means; Data storage means; Input means; A sensor for recognizing biometric information; And computing means for controlling the elements, the data information being stored in advance or required for confidentiality generated by itself or transmitted and received by communication by the sensor for recognizing the biometric information in the confidentiality data information output mode. Provided is a wireless communication terminal that checks the biometric information of the recipient and outputs it as it is or processed. The wireless communication terminal is preferably a mobile communication terminal, PCS, cellular phones, smart phones or PDA and notebook type equipped with a mobile communication module capable of two-way data communication. In the present invention, the user wireless communication terminal is most preferably in the form of a CDMA or TDMA mobile phone or mobile phone.

The output means of the wireless communication terminal includes, for example, display means such as screen display means, speaker means or light emitting means such as LEDs, and wired and wireless output means for outputting sound waves, light waves or radio waves. The screen display by the screen display means is text or a one-dimensional or two-dimensional pattern or a color code. The one-dimensional pattern is, for example, a barcode.

The wireless output means includes a means for outputting, for example, short-range wireless, including wireless or infrared. Near-field wireless output is achieved by, for example, infrared chips, RFid chips, Zigbee chips or Bluetooth chips.

As the data storage means is well known, RAM, ROM, HDD or flash memory may be combined and used according to the purpose of use. The input means consists of, for example, a keypad or a button or a jog shuttle.

The confidential data information is preferably hardware masked so that it can be located in RAM, Secure EEPROM, or the like, or at least cannot be read from the outside. In addition, it is preferable that the power is turned off when the decommissioning attempt is performed so that all data used in the meantime is automatically erased. It is preferably done in software.

The computing means consists of a central computing unit (CPU), an operating system and additional application software. The central computing device is known a system chip for mobile phones. As operating systems, operating systems dedicated to Windows CE, Symbian or mobile phones are known for PDA.

The wireless communication terminal may be used in a one-time password type user authentication service system consisting of an authentication request server and an authentication server. Here, the authentication request server refers to a server on the side that provides goods or access to a user under the same authentication as the seller server. The authentication request server and the authentication server may be physically integrated or share some or all of user information.

The user is given a predetermined authority through the authentication request procedure of the authentication request server. For example, in the case of a virtual private communication network, the user has access to the network. In trading with a company, you are authorized to log in or establish an order. In the case of a financial institution, it is a payment or access right such as transfer of money and balance check. However, the user's predetermined authority is not limited to online. If the predetermined authority is not on-line but on-line, for example, it is an access right to a security building. Or the use rights of a paid device in multiple facilities.

The confidential information data information is confidential data data stored in advance in the storage means, self-generated confidential data information, and / or confidential data data transmitted and received by communication. The data information that needs to be kept secret is, for example, data information including a one-time password generated by itself, data information transmitted and received by communication, in particular, a one-time password, mobile phone identification information and personal information of a mobile phone owner or a fixed password. Here, the mobile phone identification information means a string data such as a mobile phone device number (ESN), a mobile phone assignment number (MINI), a mobile carrier assignment number and a secret key, or a digital data string obtained by hashing them. If the mobile phone identification information is converted or outputted as an authorization request control signal, and if necessary, the authentication server sends a key to the authentication request server in a separate manner, for example, the personal information of the mobile phone user using the Internet network. By performing authentication by combining the two pieces of information, more accurate authentication can be performed.

 The data information requiring the confidentiality is output as it is or processed by the output means. For example, it may be processed and output according to the authentication request interface of the authentication request server. Here, processed means that the authentication request interface can be converted into a signal that can be received or encrypted for security.

In the wireless communication terminal having an output control function of the present invention, the output means is simply a screen display means, the data information requiring confidentiality is a one-time password or a fixed password, and the screen display means displays the one-time password or a fixed password. do.

The data information that needs to be kept confidential can be displayed by a screen display means as a one-dimensional or two-dimensional pattern, a color pattern, or a color code. When output in this manner, the authentication request interface must provide a reader that can read these patterns. More complicatedly, it may be an authorization request control code or signal that includes a fixed or one-time password that can be accepted by the authentication request interface of the authentication request server. In addition, the authorization request control code or signal may include all or part of information for verifying the account of the mobile phone owner. With the authorization request control code or signal inputted in the authentication request interface of the authentication request server, in some cases, for example, the mobile terminal owner's account is checked in accordance with the key input personal information of the mobile phone owner and is authorized. The seller operating the authentication request server through the account may settle the fee in exchange for granting. Here, the account of the mobile phone owner means an account linked by the mobile phone owner based on the mobile phone number and, in some cases, the subscriber's information submitted when subscribing to the authorization service mentioned in the present invention. For example, a user's telecommunications usage account for a telecommunications company. Or an account authorized by the mobile phone user to pay the credit card account by outputting an authorization request signal to the authentication request server through the mobile phone to the credit card account associated with the mobile phone identification information (for example, the mobile phone number).

The one-time password may be generated by a hardware or software one-time password generator built in the wireless communication terminal or may be received by wireless communication from an authentication server. The password generation method by the one time encryption generator is synchronized between the server and the wireless communication terminal by a challenge / response method, a time synchronization method and / or an event synchronization method. When receiving a one-time password from the authentication server by wireless communication, the wireless communication terminal does not need a one-time password generator. At this time, the one-time password is generated only by the authentication server.

The biometric information refers to a user's physical characteristics or behavioral characteristics. The physical characteristics are a face, an iris, a retina, a vein, a fingerprint, an ear, and the like, and the user's behavioral characteristics are a signature or a voice. The biometric information is preferably a face, iris, fingerprint or voice. Biometric technologies such as iris, fingerprint or voice are relatively well known, although they cannot guarantee integrity and full performance. The biometric information has at least 10 degrees of freedom and preferably at least 13 so as to correspond to three or more PIN numbers, preferably four or more PIN numbers. The iris, fingerprint or voice is a common technique with degrees of freedom of 4000, 65 and 55, respectively. In consideration of the accuracy of the algorithm or the sensor, even if the level is low, it is possible to set the false recognition rate FRR 1% or less and FAR 0.01% or less (corresponding to the 4-digit password). This is much more secure than a four-digit password scheme, given incorrect keystrokes.

In the case of facial recognition, it may be recognized as a pattern of a faceless face and / or a face of a particular expression.

For speech recognition technology, speech recognition technology or speaker recognition technology is used. In speech recognition technology, the sensor hardware is sufficient to use a conventional microphone, and the algorithm preferably uses speech dictation technology or speaker recognition technology. Speaker recognition technology is divided into voice registration process and voice recognition process. The voice registration process includes obtaining a sound signal waveform spectrum of the input voice signal, extracting a language unit by filtering and processing; Quantity adjustment step; And a storing step, wherein the voice recognition process comprises: obtaining a sound signal waveform spectrum; Comparative section harvesting step; It consists of a comparison step.

The iris recognition technology has been commercialized since 1993 by Professor Dogman, which developed an image encoding algorithm for 256 bytes of iris pattern since 1993, using image signal processing algorithm based on Gabor eblet transform. Iridian's PC Iris (a method of acquiring iris images reflected in concave mirrors) and Panasonic's BM-ET100 (camera use).

Fingerprint recognition technology consists of sensor hardware for reading a fingerprint and an algorithm to interpret it. Fingerprint sensor hardware is a wave method of obtaining an active or passive image of infrared, ultrasonic or visible light on the contact surface and measuring the contact pressure with a silicon semiconductor device. The algorithm extracts the features from the fingerprint image and recognizes them by sorting, matching, and comparing the scores. Sensor manufacturers include Veridicom, ST Micro, and Authentec. Sony's FIU-710. Optical sensors include manufacturers such as Digital persona, Identicator, and Nitgen.

The biological information mainly used in the present invention is iris, fingerprint or voice information, and most preferably fingerprint information.

The iris, fingerprint or voice is picked up by a camera or a contact pressure sensor or microphone and the sensor is integrated into the wireless communication terminal. Cameras and microphones mounted on them can be used as fingerprint and iris or voice sensors or biometric information input means.

The output mode for outputting the confidential data information may be made by various methods such as voice, key manipulation or motion sensor. When the biometric sensor is a fingerprint sensor, an output mode (or sensor input mode) for outputting the confidential data information is conveniently performed by input of a button disposed in the vicinity of the fingerprint sensor window.

The confidentiality data information is most simply displayed on the screen of the wireless communication terminal. The confidentiality data information may be automatically output to the authentication request interface of the authentication request server. This output can be wired or wireless. The radio is preferably short-range radio, for example, can be output by an infrared chip, ZigBee chip, Bluetooth or RF chip.

As one of the confidentiality data information, an algorithm for generating a one time password (OTP) in a wireless communication terminal may be performed in hardware or software, but it is convenient in many ways. Even if implemented in software, it can be embedded or downloaded via wired or wireless. Algorithms for generating the above unpredictable codes are well known. For example, a hashing algorithm is known as a one-way function. MD4, MD5, RC4, IDEA, HS5DM, SMD and the like are used. Also known as the RSA algorithm. These algorithms can be written using the Java language and downloaded over wired or wireless. This one-time password is generated by the algorithm according to the user's identification code (PIN) and the time of the portable password generator. The user's identification code (PIN) is integrated into the user's algorithm and the calculation of the algorithm is performed by the acceptance of the biometric sensor in the one-time password output mode and output to the display means or output means. Alternatively, a separate access password may be required along with the biometric information. The sequence of the random number generation procedure is installed in wired or wireless or built-in with the above algorithm. The wireless communication terminal enters the cipher output mode by a button or other input means, and the cipher output mode can be displayed by a screen, an LED or a voice. Alternatively, the proximity sensor recognizes that the living body is in proximity and may enter the cryptographic output mode. Depending on the type of sensor, a fingerprint or eyeball is placed on the sensor or a separate ciphertext is set on the microphone. If the communication terminal accepts the biometric information, it outputs a password. The password is displayed and the user enters the displayed password directly, but can be output directly to the authentication request interface of the authentication request server automatically or by infrared, Bluetooth or other wireless means depending on the authentication request server and the authentication request interface. Here, the authentication request interface is a state of an authentication request server for inputting an authorization request control signal, for example, a password input screen of an authentication request server. The wireless terminal generates random numbers according to the time value, and the one-time password entered in the authentication request server or the authentication request server is authenticated by comparing the random number generated according to the time value and the individual identification code (PIN) value in the authentication server. Do this.

The authentication request server and the authentication server may be physically integrated or operated separately from each other, and may share some or all of user information by connecting to a network. The authentication server is a secured database that stores data for authentication, authentication daemon, authentication process manager, real-time authentication monitor, management program based on strong mutual authenticaton, logger, etc. In addition to the security of the system itself, it is desirable to protect in a structure that can prevent intrusion on the network. It also operates as a dual server to enhance reliability.

When the connection to the authentication request server is made by the mobile communication terminal, that is, when the purchase is made in a shopping mall, the financial business is performed, or the mail server is accessed by the mobile communication terminal, the input of a password is required in the password request screen of the authentication request server. It can be input automatically by key operation or other input operation. When the authentication interface of the authentication request server is the password request mode of the access controller, the password of the wireless communication terminal may be automatically output to the password request mode wirelessly.

Hereinafter, the present invention will be described with reference to the drawings.

1 is an authentication request server 30 connected to a user PC 20 and an internet network by a wireless communication terminal according to the present invention, an authentication server 40 connected to the authentication request server 30, and the authentication server 40 and It consists of a wireless network connecting the wireless communication terminal 10 connected to the mobile communication network. Password generation occurs only in the authentication server 40 and transmits the OTP through the mobile communication terminal 10 selected by the user, and the communication terminal notifies the user that the OTP has been received by the LED or the sound and enters the OTP output mode. When the fingerprint is placed on the fingerprint sensor 19, the disposable password appears on the display 11 with acceptance. The user inputs this OTP to the authentication request server 30 through the user PC so that the authentication request server performs authentication. Receipt of OTP consists of voice or data codes including SMS (simple message service). In this way, you need to communicate with the server to receive the password.

2 relates to a portable cryptographic generator according to the present invention. The button 24 enters the password generation mode (or the password output mode) and the fingerprint sensor 19 is fingerprinted and a one-time password appears on the display 11 with acceptance. When the user accesses the authentication request server 30 through the PC terminal 20 and the user inputs the one-time password on the password request screen, the authentication request server 30 is connected with the user's personal information inputted by the authentication server ( 40), the authentication server compares the time value with the random number generated according to the personal identification code (PIN) found by the user's personal information and performs authentication.

Figure 3 is a schematic diagram of the operation configuration of the one-time password generation program used in the cellular phone password generator of the present invention. Inside the mobile communication terminal 10, the communication module device unit 12, the memory control unit 13, the central processing unit 14, the mobile communication terminal operating system 15, the installation command input unit 16, biometrics And a sensor unit 19 and a screen display unit 11. The program is downloaded through the communication module device unit 12 using the mobile communication network. At this time, the downloaded program is stored and installed in the storage unit 17 after the central processing unit 14 processes the following process.

 1) The central processing unit 14 requests the memory control unit 13 for information on the currently available storage capacity. The memory control unit 13 checks the capacities of the internal memory device and the expansion memory device 17, and transfers the information to the central processing unit 14.

2) The central processing unit 14 temporarily stores in the storage unit 17 via the memory control unit 13 if there is sufficient storage space compared to the capacity of the program to be downloaded and the storage capacity that can be stored at present. If the storage space is not sufficient, the user may select whether or not to delete the existing stored data on the screen display unit 11.

3) The temporarily downloaded one-time password generation program prepares an installation procedure according to the instruction of the screen display unit 11 under the control of the central processing unit 14.

Such a method is controlled and managed by the central processing unit 14 and installed in the mobile communication terminal 10, and the PIN information, which is a user's own code, is integrated in the one-time password generation program in the mobile communication terminal operating system 15.

The user enters the password generation mode by operating the button 21 and places the fingerprint on the fingerprint sensor 19 in the biometric activation state and the disposable password appears on the display 11 with acceptance.

The present invention can be used even without memorizing a password, and even if the wireless communication terminal is lost, the fixed password alone can not access the one-time password, the security is high and in some cases the password can be automatically entered or wirelessly entered wireless Provide a communication terminal. In addition, it provides a device that can safely and efficiently carry out the authorization process in various fields of living, including commerce, with a simple operation of the wireless terminal.

Claims (16)

Transmitting and receiving module for communicating voice or data; Output means; Data storage means; Input means; A sensor for recognizing biometric information; And computing means for controlling the elements, the data information being stored in advance or required for confidentiality generated by itself or transmitted and received by communication by the sensor for recognizing the biometric information in the confidentiality data information output mode. Wireless communication terminal that checks the biometric information of the recipient The wireless communication terminal of claim 1, wherein the data information requiring confidentiality includes a one-time password generated therein. The wireless communication terminal of claim 1, wherein the data information requiring confidentiality includes data information transmitted and received by communication. The wireless communication terminal of claim 1, wherein the confidential information data includes mobile phone identification information. The wireless communication terminal of claim 1, wherein the confidential information data includes mobile phone owner personal information. The biometric information according to any one of claims 1 to 5, wherein the biometric information is face, iris, fingerprint, or voice information, and the data information which is output from the output means or which requires processed confidentiality is an authorization control code or User's Wireless Communication Terminal The wireless communication terminal of claim 6, wherein the authorization control code or signal includes all or part of information for verifying the account of the mobile phone owner. The wireless communication terminal of claim 7, wherein the biometric information is a fingerprint. The wireless communication terminal of claim 8, wherein the output mode of the confidentiality data information is made by input of a button disposed near a fingerprint sensor window. The wireless communication terminal of claim 9, wherein the wireless communication terminal is converted by a proximity sensor when a finger is placed on a fingerprint sensor window in an output mode of the confidential data information. The wireless communication terminal according to claim 10, wherein the confidential communication data is converted into the output mode of the confidential data when the confidential data is received by the communication terminal. The wireless communication terminal of claim 7, wherein the confidentiality data information is automatically output to the authentication request interface of the authentication request server. The wireless communication terminal of claim 12, wherein confidentiality data information is output by short-range wireless to an authentication request interface of the authentication request server. The wireless communication terminal of claim 13, wherein the short range radio is an infrared chip, a Zigbee chip, a Bluetooth, or an RFid chip. The wireless communication terminal according to claim 1, wherein the output means is a screen display means, the data information requiring confidentiality is a one time password or a fixed password, and the screen display means displays the one time password or a fixed password. The wireless communication terminal according to claim 11, wherein the confidential information data is displayed in a one-dimensional or two-dimensional pattern or a color pattern.

Images