KR20070044720A - System and method for the one-time password's authentication by the human-face image - Google Patents

Abstract

The present invention relates to a one-time password authentication system and method using a face image, the face recognition logic algorithm in the face image is used as an encryption algorithm for generating a one-time password, and at the same time the means for encrypting the electronic transaction path information of the electronic transaction party In this way, the one-time password is generated and authenticated in a way that is included in the one-time password and also includes transaction time, thereby providing a more secure one-time password authentication.

In addition, the present invention relates to a one-time password authentication system and method for self-identification applying a new type of face image that may be selectively received by the mobile phone and receive user authentication by using a face image of the person who is required by the electronic transaction party. .

Therefore, the present invention provides a one-time password authentication system and method that provides an effect that can prevent the actual damage to the electronic trading party even if the one-time password received by the mobile phone is exposed to the outside by Trojan horse, phishing, pharming, keyboard hacking. .

Description

System and method for the One-Time Password's authentication by the human-face image}

1 is a block diagram illustrating a network configuration of a one-time password authentication system using a face image according to an embodiment of the present invention.

2 is a block diagram illustrating a configuration of a one-time password authentication system using a face image according to an embodiment of the present invention.

3 is a block diagram of data transmission and reception for one-time password authentication using a face image according to an embodiment of the present invention

4 is a diagram illustrating the configuration of a web page for user authentication in an Internet web server according to the present invention.

5A and 5B are views for explaining random number generation according to the application of an encryption pattern according to a preferred embodiment of the present invention.

6 is a view for explaining a one-time password standardization generation unit according to an embodiment of the present invention.

7 is a one-time password authentication flowchart using a face image according to an embodiment of the present invention

<Explanation of symbols for the main parts of the drawings>

10: user computer 12: web server 13: authentication system

14: SMS server computer 16: User information input unit 17: Central control unit

18: one-time password generation unit

19: Facial image random number extraction unit 20: Disposable password standardization generation unit

24: one-time password validity judgment unit 21, 22, 23, 26: database

44: Digital still face image

In the present invention, in the generation and authentication of one-time password for user authentication in non-face-to-face electronic transaction, one-time-use password information and transaction time of the user who wants to receive and receive the one-time password to the mobile phone are disposable with face recognition pattern-based pattern recognition technology. The present invention relates to a one-time password authentication system and method for a mobile phone using a face image whose security is enhanced by including a password in a generated manner.

Conventional user authentication method is the most common ID and password method, but in order to cope with the security risks that the password of the private information is exposed to the outside, important one-time password authentication method is used in important electronic transactions such as financial transactions. One-time password (OTP) authentication is also known as one-time authentication, and typical authentication protocols include the Challenge / Response protocol, the Time-Based Implicit Challenge protocol, and the one-way hash ( One-Way Hash) protocol is used. In the cipher protocol, if the pair of ciphers is “North” and “Noodle”, if the questioner asks “North”, the other party should answer “Noodle”. This method has a problem that a user must have multiple encryption keys when connecting to multiple servers. That is, they must have a cryptographic key mechanism that performs the same function or a random number table with different pairs of ciphers. The time cipher protocol reads the clock of the user's computer, encrypts the value, transmits it with the user's name, decrypts it with the shared key on the other server, and allows authentication if the clock on the server is almost the same as the time read. This method is mainly used when the server does not have a means to generate a passphrase because the risk of hacking is high by receiving the user's transmission and sending it directly to the server. The one-way hash authentication protocol generates a new password every time using the one-way hash function. The initial hash value is obtained by hashing the public initial value and the user's secret phrase, and the first hash value is input to the second hash function. The process is repeated 500 to 1000 times to generate a password. In authentication, the server stores the password of each user's most recent connection. If the user requests a connection with a new password, the server hashes this value and checks if it is the same as the previous password. Authentication method.

Although there is a one-time password authentication method based on the above security technologies (HSM: Hardware Security Module), it is inconvenient to operate it whenever you learn how to use the crypto token and trade it. There is a problem that cryptographic token mechanism cost must be added to the user.

Recently, there has been a problem that the decryption of the mathematical hash algorithm “SHA-1”, which is widely used worldwide, is proved by the one-time password encryption algorithm.The safety of the mathematical hash algorithm is calculated by increasing the computational power of the computer. As the speed increases, additional technical countermeasures are needed to increase the decryption computation of hash algorithms, and another alternative to the above problems is the development of a one-time password authentication protocol with a logical encryption algorithm.

In addition, the case where the one-time password authentication method using a mobile phone is used for electronic payment has an advantage that it can be conveniently used without additional cost compared to the crypto token method. As an authentication protocol using a mobile phone, when the server generates a one-time password and transmits it to the user's mobile phone, the user sends back the one-time password received through the Internet web page to the server, and the server determines the identity of the one-time password.

The one-time password authentication methods do not include the user's e-commerce relationship information in the one-time password, but simply use the one-time password represented by a random number system for authentication. Therefore, unlike the encryption token method, there is a possibility that another person intercepts the one-time password in the authentication method for transmitting and receiving the one-time password to the mobile phone. That is, there is a problem in that the validity of the electronic transaction cannot be verified in a case where the person requesting the one-time password and the person used for authentication are different, and the biometric information of the party cannot be recorded by additional authentication security means. In particular, in a non-face-to-face electronic transaction, a one-time password for personal authentication may be easily stolen if it is leaked to others in real time by hacking, phishing, pharming, etc. by a Trojan horse of a personal computer.

An object of the present invention is to solve the above problems, the server transmits the one-time password containing the user's connection path and access time information secured by the encryption algorithm to the user's mobile phone, and again to the server for authentication The one-time password and the data transmission / reception authentication method that can verify the validity of the user's connection path and access time.The security that can confirm the identity of the user who calls the one-time password to the mobile phone and the user who requests the one-time password authentication. The present invention provides a mobile phone disposable password authentication system and method using the improved face image.

In addition, another object of the present invention is to generate a one-time password including the access path and the access time almost as public information and to complicate the encryption system for authentication. A mobile phone using a face image including a generation part of a single-password function with a polynomial function result value data structure by applying random number to the face image by applying the algorithm to the face image and applying the connection path information, access time information, and encryption pattern random number information as variable values To provide a one-time password authentication system and method.

In addition, another object of the present invention is a method for transmitting the user's digital face image online to the server each time in the step of requesting the server for a one-time password for electronic transaction authentication, the one-time password as the face image of the authentication party of the one-time password By creating and authenticating, to provide a mobile phone disposable password authentication system and method using a face image with improved security for the identity of the user calling the one-time password to the mobile phone.

Disposable password authentication system using a face image of the present invention for achieving the above object, has a preset face image database, a preset password pattern database, an issuance condition database, a mobile phone number database, the face recognition pattern A one-time password generation unit including a random number extraction unit applied to a face image by an algorithm and a one-time password normalization generation unit including the connection path and access time information of a user received through the Internet as a result of the encryption function, a one-time password validity determination unit, and It includes a central control unit that separates the one-time password call and authentication signal processing.

In addition, the single-use password central control unit using the face image according to the present invention includes a user information input unit for distinguishing whether the one-time password call step or authentication step according to the data configuration of the user information transmitted from the Internet web server .

In addition, the random number extraction unit of the authentication system according to the present invention as a random number to the (x, y) coordinate value or color information of the image pixel extracted in the encryption pattern corresponding to both eyes reference point of one face image read from the database as a random number Create

In addition, the random number extraction unit of the authentication system according to the present invention has a variety of random number generation multiplied by n multiplied by n types of face image database and m types of cryptographic pattern databases.

In addition, the standardization generation unit of the authentication system according to the present invention uses the random number generated by the random number extraction unit, the time of the one-time password generation by the clock of the authentication system, and the IP address information transmitted from the Internet web server as a condition variable And a one-time password normalization generation unit of a generation condition synchronization method for generating a password.

In addition, an issuance condition database is provided for synchronization of one-time password generation in the calling and authentication steps according to the present invention, and the database image of the face image and password pattern used for generating the one-time password and the one-time password generation time are stored for each ID. Manage.

In addition, when providing a face image online to generate a disposable password of the present invention, the face image is also stored and managed in the issuance condition database.

In addition, the one-time password validity determination unit of the present invention determines the identity of the one-time password generated in each of the calling step and the authentication step, and at the same time simultaneously authenticates the validity of time for the time difference in the call step and the authentication step.

In addition, the network configuration for one-time password authentication using the face image according to the present invention is connected to the user computer and the network, the Internet web server for collecting and transferring user information and the one-time password authentication system and the generated one-time password of the user It consists of an SMS server and a mobile phone for sending texts to a mobile phone.

In addition, the web page configuration of the Internet web server for one-time password authentication of the present invention consists of a page for transmitting the ID and calling the one-time password to the mobile phone and two pages for requesting authentication by transmitting the one-time password called to the mobile phone. .

In addition, in order to apply the user's face image to the one-time password generation in the configuration of the web page of the present invention, the user's still face image is automatically acquired and displayed on the web page, and at the same time includes a web page for transmitting to the authentication system. .

In addition, the encryption pattern of the present invention is a triangle encryption pattern in which two vertices of a triangle correspond to both eye reference points of the face image, and the other one vertex is designated at an arbitrary position in the face by the authentication system administrator.

In addition, as the display method or recording method of the encryption pattern of the present invention, only the location information value of the other arbitrary input point except for the two eye reference points that are automatically set in the face image is stored. Location information for the other vertex normalized with a triangular cryptographic pattern fixed as a (0,100) reference point for the distance to the right eye and the rotational conditions.

On the other hand, in the one-time password authentication method using a face image according to another aspect of the present invention, the user computer is registered while transmitting the ID and IP address information to the one-time password authentication system through a web page transmitted from an Internet web server Calling the one-time password on the mobile phone and sending the one-time password sent to the mobile phone back to the authentication system through another web page of the Internet web server, the authentication system is valid with the same IP address included in the one-time password and the one-time password is valid. The one-time password authentication step of determining the period and notifying the authentication result to the Internet web server.

In addition, the one-time password calling step of the present invention, the step of calling the one-time password through the web page provided by the Internet web server, the Internet web server to produce the IP address and ID of the user computer into a single data packet and the one-time password Transmitting the one-time password generated by the one-time password authentication system to the pre-registered mobile phone via the SMS server.

In addition, the one-time password authentication step of the present invention, the step of transmitting the received one-time password through the web page provided by the Internet web server, the Internet web server, the IP address of the user computer and the one-time password and ID of one Producing a data packet and transmitting to the one-time password authentication system, and determining the validity of the user information of the one-time password transmitted by the one-time password authentication system and transmitting the authentication result to the Internet web server.

In another embodiment, the one-time password calling step may include providing a face image of the user through a web page provided by an internet web server and calling the one-time password.

Hereinafter, with reference to the accompanying drawings will be described in detail the detailed techniques applied to the one-time password authentication system and method using a face image in accordance with an embodiment of the present invention.

1 is a block diagram illustrating a network configuration of a one-time password authentication system using a face image according to an embodiment of the present invention. Referring to FIG. 1, a one-time password authentication system using a mobile phone may include a user's computer 10, an internet web server 12, a mobile phone 11, a short message service (SMS) server 14, and a one-time password authentication system ( 13) is included.

In the following description of the present invention, the user's computer 10 and the Internet web server 12 are connected to the wired and wireless Internet, and the one-time password authentication system 13 connected to the Internet web server 12 is a one-time password call step. It transmits the output signal to the text message SMS server 14 to the mobile phone 11, and also transmits the output signal in the authentication step to the Internet web server 12. In addition, the authentication result transmitted to the Internet web server 12 is notified to the computer 10 connected to the Internet web server 12 for user authentication, the Internet web server 12 approves the user authentication. In the present invention, the function of the Internet web server 12 is a web page for obtaining an Internet Protocol (IP) address and ID (ID) and a one-time password from the user computer 10 and delivering the one-time password to the one-time password authentication system 13. Perform configuration and functions. In addition, the IP address includes both a floating IP and a fixed IP address. When the user needs to acquire a still face image of the user, the Internet web server 12 drives a PC camera built in the computer 10 and software for recognizing the positions of both eyes in the face image in the user computer 10. Acquire a still face image and transmit it to the one-time password authentication system 13. In addition, the one-time password authentication system 13 generates a one-time password and transmits it to a mobile phone, and performs a function of determining the validity of the one-time password for authentication, and transmits the subsequent authentication result to the Internet web server. In addition, the one-time password is delivered to the SMS server 14 with the mobile number registered for each user ID, the SMS server 14 transmits the one-time password to the corresponding mobile phone number over the wireless network.

2 is a block diagram illustrating the configuration of a one-time password authentication system using a face image according to an embodiment of the present invention. Referring to FIG. 2, the one-time password authentication system 13 may include a one-time password generation unit 18 including a face image random number extraction unit 19 and a one-time password normalization generation unit 20, and a one-time password validity determination unit ( And a central control unit 17 including a user information input unit 16, a disposable password output unit 25, and an authentication result output unit 27, and a face image as a database for generating and transmitting the disposable password. 21, an encryption pattern 22, an issuance condition 23 database, and a mobile phone number 26 database.

In the following detailed description of the present invention one-time password authentication system 13, the user information input unit 16 according to the data configuration of the user information transmitted from the Internet web server 12 signal to distinguish whether it is a one-time password call step or authentication step Perform the function of processing. The one-time password authentication system 13 transmits the one-time password to the external SMS server 14 through the one-time password generation unit 18 and the one-time password output unit 25 in the calling step, and in the authentication step, the Internet web. The one-time password transmitted from the server 12 and the one-time password generated by the one-time password generation unit 18 are transmitted to the one-time password validity determining unit 24 and the validity authentication result is transmitted through the external Internet web through the authentication result output unit 27. It includes a central control unit 17 to perform a function for transmitting to the server (12). The one-time password authentication system 13 is a computer device that also includes a communication unit for transmitting and receiving to and from an external computer device, in addition to the central control unit 17 that performs arithmetic processing functions with a main computing device and a memory device.

In addition, the disposable password generation unit 18 is composed of a face image random number extraction unit 19 and the disposable password standardization generation unit 20. In addition, the face image random number extractor 19 reads out one face image and a password pattern from a preset face image 21 database and a preset password pattern 22 database, and extracts a face image extracted by a face recognition logic algorithm. The encryption pattern is applied based on the reference point position of both eyes, and the (x, y) coordinate at the image pixel location point extracted by the encryption pattern or the RGB color and YCbCr color value (0-255) in the face image It is used as a random number for the one-time password generation of the present invention.

At this time, the face image random number extractor 19 generates the number of random numbers multiplied by n and m by the face image database 21 including n face images and the encryption pattern database 22 including m encryption patterns. It can provide variety.

In addition, the one-time password standardization generation unit 20 may include IP information as external input information of the one-time password authentication system 13, random numbers generated by the face image random number extraction unit 19 as internal generation information, and the authentication system 13. When creating a one-time password from a clock operating at, all the instantaneous time, minute, second values are substituted into the encryption function to generate a standardized one-time password. Therefore, in order to synchronize the one-time password generated in the call step and the one-time password regenerated in the authentication step, it can be said that the condition synchronization one-time password authentication method must match all variable information values assigned to the encryption function.

At this time, in order to synchronize the one-time password generation conditions, the issuance condition 23 database stores the information on the one-time password generation conditions in the calling step for each ID, and serves to call and use them again in the authentication step. The detailed data configuration includes the circulating number information read out for each user ID from the face image 21 database and the password pattern 22 database to generate a one-time password except for the IP address, which is external input information. It also includes the password creation time. In addition, if the face image used to generate the one-time password is transmitted from the user's computer 10 in real time, the face image data is recorded including the user ID.

In addition, the one-time password output unit 25 receives the one-time password generated in the calling step from the one-time password generation unit 18, the external SMS together with the mobile number and the one-time password from the mobile number 26 database registered for each user ID Send to server.

In addition, the one-time password validity determination unit 24 is a function that operates only in the authentication step, receiving the regenerated one-time password from the one-time password generation unit 18, and at the same time the user passes the one-time password delivered to the user mobile phone 11 in the calling step Retransmission is received via the information input unit 16, and performs the function of verifying the two different one-time password identity. In addition, by comparing the time recorded in the issuance condition (23) database used to generate the one-time password with the time when the one-time password generation unit 18 regenerates for authentication, it is also a function of determining whether it is within a preset validity period. To perform. Of course, it means that the validity period can be freely set to 30 seconds, 1 minute, 1 hour, etc. In addition, the authentication result transmitted from the one-time password validity determination unit 24 to the authentication result output unit 27 is the Internet web server 12 Is sent.

3 is a block diagram of data transmission and reception for one-time password authentication using a face image according to an embodiment of the present invention. Referring to FIG. 3, a user who owns a computer 10 and a mobile phone 11 and a web server 12 to provide Internet web service through one-time password authentication and an SMS server for performing one-time password authentication for each user ID ( 14) and a diagram illustrating a data transmission / reception process for authentication between the one-time password authentication system 13.

The data transmission and reception process for authentication consists of a step of calling the one-time password to the mobile phone and an authentication step of determining the validity of the one-time password transmitted through the Internet web page. Validation function is performed with the one-time password including the webpage access IP address information in the authentication step. In detail, when the user computer 10 requests authentication by ID from the web page 36 requesting authentication by ID provided from the web server 12 (38a), the web server 12 inputs from the user. The ID and the IP address of the user computer 10 are produced as one data packet (38b), and the data packet produced by the one-time password authentication system 13 is transmitted (38c). The one-time password authentication system 13 generates a one-time password using the input data (38d), transmits the one-time password to the SMS server 14 (38e), and the SMS server 14 is registered in advance by ID. The single-use password information is transmitted to the mobile phone 11 number (38f). The user transfers the one-time password directly called by the web page from the mobile phone 11 to the Internet web page of the user computer 10 (38g), and transmits the input one-time password to the web server 12 (38h). . The web server 12 produces the single-use password and ID input from the user and the IP address of the user computer 10 into one data packet again (38i), and transmits to the one-time password authentication system 13 (38j), The one-time password authentication system 13 performs a process of determining the validity of the one-time password (38k), and transmits the authentication result to the web server 12 (38m), the web server 12 is a user computer according to the authentication result The authentication process for accessing the web server 12 of (10) is approved (38n) and the authentication process is terminated with a web page 37 displaying the authentication result on the user computer.

4 is a diagram illustrating the configuration of a web page for user authentication in an internet web server according to the present invention. Referring to FIG. 4, the web page for authentication provided from the internet web server 12 to the user computer 10 includes a web page 41a for inputting a user ID and calling the one-time password to the mobile phone 11; Since it is managed in the same session and consists of a web page 42 for inputting and transmitting the one-time password called by the mobile phone (11). At this time, each web page is provided with an input window 43 and the transmission button 45. In addition, when a user's face image is to be used for authentication using a PC camera, the one-time password may be called to the web page 41b including the still face image 44. In this case, the user computer 10 automatically runs a separate face recognition software to automatically obtain a still face image suitable for authentication and display it on a web page. The face recognition software used at this time is produced based on the function of finding the image mass corresponding to both eyes in the face image by the face image random number extraction unit.

5A and 5B are views for explaining random number generation by applying an encryption pattern according to a preferred embodiment of the present invention. 5A and 5B, an embodiment in which the same encryption patterns 55a and 55b are applied to different still face images in order to generate random numbers in the face image random number extracting unit 19 of the disposable password authentication system 13 will be described. It is shown.

First, the encryption pattern of the embodiment of the present invention means a triangle pattern, and in detail, two vertices of the triangle correspond to both eyes of the face image and the other one vertex is designated as an arbitrary position in the face by the authentication system administrator. Means triangle pattern.

The encryption pattern designation method extracts an image blob representing the position of both eyes in the face image by face recognition technology in order to automatically set both eye reference points corresponding to two vertices of a triangle in an arbitrary face image. Then, run the software that sets the center of the mass as the reference point for both eyes, and in the next step, if the authentication system administrator designates an arbitrary position in the face using a mouse that is an external device of the computer, the randomly designated points are summed together to form an encryption pattern. Constitute three vertices. In this case, when the administrator designates two or more input points, the encryption pattern may be generated as many as the designated number as a method in which each input point corresponds to one password pattern. In addition, since the face recognition technology for automatically setting both eye reference points of the face applies conventional techniques, detailed description thereof will be omitted.

As described above, since two vertices of a triangle are automatically set as the method of displaying the encryption pattern data, only the location information values of the other vertices are recorded and the other vertex position information is displayed. For the distance and rotation between them, the left eye reference point is set to (0,0) and the right eye position is fixed to (0,100). .

At this time, in the present invention, the encrypted pattern that is normalized and recorded is used in the same meaning as the position information coordinate value corresponding to the other one vertex, and if the vertex position is the right direction of the left eye, “+ x” is the left direction “-x” This is the normalized (x, y) position coordinate, which is "+ y" if it is above the baseline of the left and right eyes, and "-y" if it is down.

In the embodiment of the present invention applied to two different face images in order to generate a single-use password with one cryptographic pattern read from the cryptographic pattern database, each eye reference point is respectively used by using face recognition software on two different face images. Then, the two eyes are matched with each other by transforming the shape resembling the encryption pattern triangle, and then extracting the position of the other input point. At this time, since the encryption pattern is a value to which rotation is not applied, the face image 51b rotates together with a similar shape size of the triangle to match both eye reference points.

Therefore, in the present invention, in the face image to which one preset encryption pattern is applied, the other one inputted by the administrator according to the change in pose size of the face size change, position change, rotation, tilting, and panning The position of the vertex of can vary. In addition, the color value of the pixel for the other one vertex varies according to the illumination change of the face image and the camera type. In addition, various digital still face images acquired by the same person in various user environments vary. Therefore, the face image, which is the biometric information of the user to which the encryption pattern is applied, has a technical feature that the face image of the user can be used as a one-time use method by various information attributes that can be obtained at the other vertex.

The random number extracted by the face image random number extracting unit according to the present invention has a lower left vertex of the face image image with respect to a pixel corresponding to the other vertex position extracted by applying the encryption pattern to the face image (0, This coordinate value is converted and displayed by the normal image coordinate display method of 0).

Therefore, one identical encryption pattern applied to two different face images 51a and 51b is expressed in the shape similar to the position of the nose, but one vertex position except the reference point of both eyes is converted and displayed by the normal image coordinates. The value depends on the face image.

In addition, in the present invention, in addition to the image coordinate random number described above, the color value of the same pixel may be added as a random number.

6 is a view for explaining the one-time password standardization generation unit according to a preferred embodiment of the present invention. Referring to FIG. 6, a password pattern random number value 62 extracted as a face image and a password pattern as internal generated information of the one-time password authentication system 13, and a connection path and a connection time 61 as electronic connection environment information of an external user. ) Is input to the encryption function of the one-time password normalization generation unit 20 to generate a one-time password.

The one-time password normalization generation unit 20 substitutes the image coordinate information, the IP address information, and the visual information as the extracted random number into a previously defined polynomial equation, performs arithmetic operation, and obtains a result value. The decision unit 64 repeatedly increases the result value by repeatedly performing arithmetic operation up to a threshold value or more to secure the diversity of the disposable password. To 65 to generate a one-time password with standardized digits.

In other words, to create a 36-digit, four-digit one-time password containing numbers 1 to 10 and letters a to z, a 4-step IP address consisting of numbers, from 1 second to 60 seconds, 1 minute to 60 minutes, and 1 hour The random values (x1, y1) and (x2, y2) extracted as two cryptographic patterns from the image coordinates of 320 x 240 at a specific time from 2 to 24 o'clock are substituted into the arithmetic function set as a variable, and the result of the arithmetic function The cumulative calculation is performed until the size of is greater than the power of 36 (1679616). The final result is converted to 36 digits, and the value exceeding 4 digits is discarded. Can be generated. At this time, the negative number in the above variable is converted to an absolute value and reflected in the arithmetic function, and the value of "0" is discarded in the multiplication.

7 is a one-time password authentication flow chart using a face image according to an embodiment of the present invention. Referring to Figure 7, the entire authentication sequence can be described by dividing into two steps, the user registered in advance while transmitting the ID and IP address information to the one-time password authentication system through a web page transmitted from the Internet web server Calling the one-time password with the mobile phone of the mobile phone, and sending the one-time password sent to the mobile phone back to the authentication system through another web page of the Internet web server, the authentication system is the same as the IP address included in the one-time password and the one-time password validity period. And determining the one-time password authentication step of notifying the authentication result to the Internet web server.

In detail, first, a registered user requests a single-use password issuance to the Internet web server through the web page 41a or 41b provided by the Internet web server 12 to the user computer 10. In another embodiment, in order to use the face image of the user to be used for generating the one-time password, it may be used as a step of calling the one-time password including the still face image automatically obtained from the user computer.

In the next step, the Internet web server 12 manufactures the IP address and ID of the user computer in one packet, and sends the packet data generated at the same time as requesting the one-time password issuance to the one-time password authentication system 13. S720)

In the next step, the one-time password generated by the one-time password authentication system 13 is transmitted to the user's pre-registered mobile phone number using the SMS server 14 (S730).

The one-time password received by the registered user's mobile phone is transmitted to the web server through the next step web page 42 operating in the same session as the web page 41a or 41b of the calling step (S740).

In the next step, the Internet web server 12 reconstructs the one-time password transmitted through the web page 42 and the IP address and ID of the user computer 10 into one packet, and authenticates the one-time password authentication system 13. Send for (S750).

In the next step, the one-time password authentication system 13 determines the validity including the user information of the transmitted one-time password, that is, the IP address identity and the expiration date of the one-time password, and transmits the authentication result to the Internet web server 12. S760)

In the last step, the Internet web server 12 determines whether the user computer 10 is connected to the Internet according to the authentication result of the authentication system 13, and notifies the network (S770).

The present invention is not limited to the above-described embodiments and may be variously modified and changed by those skilled in the art, which are included in the spirit and scope of the present invention as defined in the appended claims.

As described above, according to the disposable password authentication system and method using the face image of the present invention, the following effects are provided.

First, the authentication system generates a one-time password, transmits it to the mobile phone, and then again authenticates the one-time password including the route information, and is simple as a software module unlike the one-time password authentication method by a separate hardware device. It can be used easily, and the cost is small, and security against external leakage of disposable password by means of phishing pharming keyboard hacking Trojan, etc. is high.

In addition, the access path information as personal information is encrypted and included in the one-time password and is a method of authenticating, which is a personal information type security authentication method that cannot be used as tracking information unless separately stored and managed by the authentication system.

The one-time password is a security pattern that cannot easily mimic the one-time password by a method in which the password pattern based on the position of both eyes of the face image and the random numbers converted by the face recognition logic algorithm are included in the one-time password generation condition variables. There is a castle.

In addition, since the present invention has a feature that a one-time password generation service is possible even with a face image of another person, the security system to which the biometric technology is applied has an effect of giving the individual user the option to use the biometric information of the individual.

In addition, the one-time password authentication method of the present invention is an authentication means having a very high 1: 1 relationship between the face image and the one-time password composed of letters / numbers, and storing all the one-time passwords and issuing conditions transmitted to the mobile phone by ID. Then, it provides a new digital face image security storage method that can determine whether the individual face image stored in the authentication system is a forged face image, or the same face image used in the one-time password generation.

By providing a face image online to generate a one-time password, it may be used as a one-time authentication means of biometric information for identification of the one-time password user. Therefore, even if the face image biometric information of the person is exposed to the outside, the face image newly used for authentication is a biometric information security authentication method that can be protected.

Claims (17)

In the disposable password authentication system using a face image, A preset face image database, a preset password pattern database, an issuance condition database and a cell phone number database; Generation of one-time password including random number extraction unit applying encryption pattern to face image with face recognition algorithm and one-time password standardization generation unit including user's connection path IP address and one-time password generation time information received as the result of encryption function And a single-use password validity determining unit and a central control unit for signal processing by separating the one-time password calling step and the authentication step. The method of claim 1, wherein the central control unit, Disposable password authentication system, characterized in that it comprises a user information input unit for signal processing according to whether the one-time password call step or the authentication step according to the data configuration of the user information transmitted from the Internet web server. The method of claim 1, wherein the random number extraction unit, Image coordinate (x, y) coordinate value or color information of the image pixel extracted by converting the encryption pattern into a similar shape so that both eye images of the face image and the encryption pattern read out from the face image database and the encryption pattern database one by one Disposable password authentication system, characterized in that to generate a random number. The method of claim 3, wherein the random number extraction unit, A one-time password authentication system having a variety of random number generation multiplied by n and m by n types of face image databases and m types of encryption pattern databases. According to claim 1, Disposable password standardization generation unit, A one-time password of the generation condition synchronization method that generates a one-time password using all of the random number generated by the random number extraction unit, the time of generating the one-time password by the clock of the authentication system, and the IP address information transmitted from the Internet web server as a condition variable. Disposable password authentication system including a standardized generation unit. The method of claim 5, wherein for the synchronization of the one-time password generation conditions in the calling step and the authentication step, Issuing condition database having a database, characterized in that the one-time password authentication system characterized in that for storing the database image of the face image and password pattern used in the one-time password generation and the one-time password generation time by ID. The method of claim 6, wherein the issuance condition database includes: When providing a face image online to generate a one-time password, one-time password authentication system, characterized in that the face image is also stored and managed in the issuance condition database. The method of claim 1, wherein the one time password validity determining unit, The one-time password authentication system, characterized in that for determining the identity of the one-time password generated in each of the call step and the authentication step, and at the same time to simultaneously authenticate the time validity of the time difference in the call step and the authentication step. According to claim 1, Network configuration for one-time password authentication using a face image, One-time password authentication, consisting of an Internet web server connected to the user's computer and the network to collect and transmit user information, a one-time password authentication system, and an SMS server and a mobile phone to send the generated one-time password to the user's mobile phone. system. The method of claim 9, wherein the Internet web server, It consists of web page for sending ID and calling one-time password to mobile phone and web page for authentication to enter and send one-time password called to mobile phone to web page. IP address collected from user computer is also used as one-time password authentication system. Disposable password authentication system, characterized in that for performing a function to deliver. The method of claim 10, wherein the web page for calling the one-time password to the mobile phone, In order to apply the user's face image to the one-time password generation, one-time password authentication system, characterized in that it automatically acquires the still face image of the user and displays on a web page, and at the same time transmits to the authentication system. The method of claim 3, wherein the encryption pattern, A one-time password authentication system, characterized in that two vertices of the triangle correspond to both eye reference points of the face image and the other one vertex is designated by the authentication system manager as an arbitrary position in the face. The method of claim 12, wherein the display or recording method of the encryption pattern, It saves only the location information value of one random input point except for the reference point of both eyes that is automatically set in the face image.At the same time, the shape of the saved data is the left eye as (0,0) reference point and the distance and rotation to the right eye Disposable password authentication system, characterized in that the position information for the other one vertex normalized by a triangular cryptographic pattern fixed to the (0,100) reference point for the condition. In the one-time password authentication method using a face image according to another aspect of the present invention, Calling, by the user computer, the one-time password to a registered mobile phone while transmitting the ID and IP address information to the one-time password authentication system through a web page transmitted from an internet web server; When the one-time password sent to the mobile phone is sent back to the authentication system through another web page of the Internet web server, the authentication system determines the identity of the IP address included in the one-time password and the validity period of the one-time password and notifies the authentication result to the Internet web server. Disposable password authentication method comprising a one-time password authentication step. The method of claim 14, wherein the one-time password call step, Calling a one-time password through a web page provided by an internet web server; An internet web server producing the IP address and ID of the user computer into a single data packet and transmitting the single IP packet to the one-time password authentication system; The one-time password authentication method comprising the step of transmitting the one-time password generated by the one-time password authentication system to a mobile phone registered through the SMS server. The method of claim 14, wherein the one-time password authentication step, Transmitting the received mobile phone password through a web page provided by an internet web server; An internet web server producing an IP address, a one-time password, and an ID of a user computer into one data packet and transmitting the data to a one-time password authentication system; Determining the validity of the user information of the one-time password transmitted by the one-time password authentication system and transmitting the authentication result to an internet web server. The method of claim 15, wherein the calling of the one-time password through a web page provided by the Internet web server includes providing a face image of the user through the web page and calling the one-time password.

Images