KR20170107409A - Method and apparatus for authenticating using biometric information - Google Patents

Abstract

An authentication method and apparatus using biometric information are disclosed. The authentication system according to one embodiment comprises: a biometric information storage server for storing registration biometric information acquired from each of at least one client; a target client included in the at least one client, acquiring authentication biometric information of a user and encrypting the authentication biometric information by using a unique cryptographic key; and a decryption key storage server for storing at least one decryption key. A method for controlling the decryption key storage server includes the steps of: acquiring an identifier of the target client and the encrypted authentication biometric information; acquiring registration biometric information for matching, wherein the registration biometric information is encrypted by a client which has transmitted the registration biometric information, and the registration biometric information corresponding to the identifier among the registration biometric information; extracting a decryption key corresponding to the identifier among the at least one decryption key; decrypting the encrypted authentication biometric information and registration biometric information corresponding to the identifier using the decryption key corresponding to the identifier; determining whether the decrypted authentication biometric information and the registration biometric information corresponding to the identifier are matched with each other; and providing the matching result to the biometric information storage server or the target client. The at least one decryption key may be stored in the decryption key storage server separate from the biometric information storage server in which the registration biometric information is stored to improve the security of the authentication system. According to the present invention, a user can safely store biometric information on a network.

Description

Technical Field [0001] The present invention relates to an authentication method and apparatus using biometric information,

The following embodiments relate to an authentication method and apparatus using biometric information.

Techniques using various signals and data that can be extracted from a living body and using them in various systems are being developed. In particular, a biometric authentication technique for constructing a security system using biometric information is attracting attention. For example, in the biometric authentication technique, a signal or information associated with a living body is extracted from a user, and the extracted signal or information is compared with previously stored information to confirm that the user is a person and authenticated as a user.

Such a biometric authentication technique can also be implemented on a network. For example, a biometric information recognizer that recognizes biometric information can authenticate a user through communication with a server. More specifically, the biometric information recognizer encrypts the biometric information acquired from the user, and transmits the biometric information to a server that stores biometric information registered in advance. The server decrypts the encrypted biometric information acquired from the biometric information recognizer, And verifies the user by comparing the information with biometrics information registered in advance. At this time, according to the related art, since a decryption key for decrypting biometric information and biometric information registered in advance are stored in the server, a malicious external hacking attempt can be concentrated on one server, and when the server is hacked , The biometric information of the user can be leaked.

Accordingly, in recent years, efforts to implement biometric authentication technology more securely on a network have continued.

A problem to be solved by the present invention is to provide a method and an apparatus for authenticating a user by safely storing biometric information of a user and decrypting biometric information.

An authentication system according to an embodiment of the present invention includes a biometric information storage server for storing biometric information for registration acquired from each of at least one client; A target client included in the at least one client, for acquiring biometric information for authentication of a user and encrypting the biometric information for authentication using a unique cryptographic key; And a decryption key storage server for storing at least one decryption key, wherein the control method of the decryption key storage server comprises: acquiring the identifier of the target client and the encrypted biometric information for authentication; Acquiring the biometric information for registration, the biometric information for registration is encrypted by a client that has transmitted the biometric information for registration, and acquiring registration biometric information corresponding to the identifier of the biometric information for registration, ; Extracting a decryption key corresponding to the identifier among the at least one decryption key; Decrypting the encrypted biometric information for authentication and biometric information for registration corresponding to the identifier using the decryption key corresponding to the identifier; Determining whether the decrypted biometric information for authentication and the biometric information for registration corresponding to the identifier are matched with each other; And providing the matching result to the biometric information storage server or the target client, wherein the at least one decryption key is used for storing the biometric information stored in the registration biometric information storage And the decryption key is stored in the decryption key storage server separated from the server.

An authentication system according to an embodiment of the present invention includes a biometric information storage server for storing biometric information for registration acquired from each of at least one client; A target client included in the at least one client, for acquiring biometric information for authentication of a user and encrypting the biometric information for authentication using a unique cryptographic key; And a decryption key storage server for storing at least one decryption key, wherein the control method of the biometric information storage server acquires the identifier of the target client and the encrypted biometric information for authentication according to the user authentication request of the target client step; Extracting registration biometric information corresponding to the identifier of the target client among the biometric information for registration - the biometric information for registration is encrypted by a client that has transmitted the registration biometric information; Acquiring a matching result of authentication biometric information decrypted based on at least a part of the biometric information for registration corresponding to the identifier and the at least one decryption key; And providing information on the matching result or the matching result to the target client, wherein the registration biometric information includes at least one of the decryption key And is stored in the biometric information storage server separated from the storage server.

An authentication system according to an embodiment of the present invention includes a biometric information storage server for storing biometric information for registration acquired from each of at least one client; A target client included in the at least one client, for acquiring biometric information for authentication of a user and encrypting the biometric information for authentication using a unique cryptographic key; At least one sub-matching server for decrypting the authentication biometric information using a decryption key; And a matching server for matching a part of the biometric information for registration with the authentication biometric information, wherein the control method of the matching server comprises: obtaining the encrypted biometric information for authentication; Acquiring registration biometric information, wherein the registration biometric information is encrypted by a client that has transmitted the registration biometric information, and acquiring registration biometric information corresponding to the identifier of the target client among the registration biometric information ; In order to decrypt the encrypted biometric information for authentication and the biometric information for registration corresponding to the identifier, the encrypted biometric information for authentication and the biometric information for registration corresponding to the identifier are provided to the at least one sub matching server step; Acquiring the decrypted biometric information for authentication and biometric information for registration corresponding to the identifier; Determining whether the decrypted biometric information for authentication and the biometric information for registration corresponding to the identifier are matched with each other; And providing the matching result to the biometric information storage server or the target client, wherein the decryption key is a key for decrypting the registration biometric information from the biometric information storage server And is stored in at least one of the matching server and the sub matching server.

It is to be understood that the solution of the problem of the present invention is not limited to the above-mentioned solutions, and the solutions which are not mentioned can be clearly understood by those skilled in the art to which the present invention belongs It will be possible.

According to the present invention, there is an effect that a user can safely store biometric information on a network.

According to the present invention, there is an effect that the biometric information of the user is encrypted and decrypted on the network and the biometric information is not leaked.

According to the present invention, there is an effect that the user is authenticated using the biometric information more safely and conveniently.

1 is a diagram of an authentication system in accordance with one embodiment.
2 is a diagram for explaining an authentication system according to an embodiment in more detail.
3 is a diagram for explaining the configuration of registration biometric information or authentication biometric information according to an embodiment.
4 is a diagram for explaining an authentication system when a sub-matching server according to an embodiment exists.
5 is a diagram for explaining a hub server according to an embodiment.
FIG. 6 is a diagram for explaining a decoding method when there is a sub-matching server according to an embodiment.
7 is a flowchart illustrating a method of controlling a decryption key storage server according to an embodiment of the present invention.
8 is a flowchart illustrating a method of controlling a biometric information storage server according to an exemplary embodiment of the present invention.
9 is a flowchart illustrating a method of controlling a matching server according to an exemplary embodiment of the present invention.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. However, the present invention is not limited to or limited by the embodiments. In addition, the same reference numerals shown in the drawings denote the same members.

In the drawings, the thicknesses of the layers and regions are exaggerated for clarity and the element or layer is referred to as being "on" or "on" Included in the scope of the present invention is not only directly above another element or layer but also includes intervening layers or other elements in between. Like reference numerals designate like elements throughout the specification.

In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail. In addition, numerals (e.g., first, second, etc.) used in the description of the present invention are merely an identifier for distinguishing one component from another.

Hereinafter, an electronic apparatus related to the present invention will be described in more detail with reference to the drawings. The suffix "module" and " part "for the components used in the following description are given or mixed in consideration of ease of specification, and do not have their own meaning or role.

Hereinafter, the access management system will be described. The access management system may refer to a system that manages access to the door only by the authorized person in the door installed environment. The access control system may be used in an indoor environment such as an office or a research center, or may be used in an external environment having an access restricted area outside a building such as a military unit.

<Authentication system using single stage decryption>

1 is a diagram of an authentication system in accordance with one embodiment.

Referring to FIG. 1, the authentication system may include a target client 110, a biometric information storage server 120, and a decryption key storage server 130.

The target client 110 is a client of all clients. The client obtains biometric information, requests user authentication to the external device based on the biometric information, and transmits information on the authentication result or the authentication result according to the user authentication request There may be at least one in the authentication system as an acquiring device. In some embodiments of the present invention, the client may be a biometric information recognizer that obtains biometric information directly from a user, or may be a terminal that acquires biometric information from the biometric information recognizer.

In one embodiment, the biometric information recognizer may be defined as an apparatus including a sensor for sensing biometric information. For example, the biometric information may include fingerprint information of a user, electrocardiogram (ECG) information, electromyography (EMG) information, iris information, blood vessel information, vein information, voice information, face information, And the sensor indicates a device for sensing at least one of the biometric information.

In addition, in one embodiment, a terminal for acquiring biometric information from a biometric information recognizer is a device for acquiring biometric information by communicating with a biometric information recognizer, including a fixed terminal such as a desktop computer, A portable terminal such as a smart phone, a tablet, a laptop computer, a personal digital assistant (PDA), or a wearable device (e.g., wearable watch, wearable band).

The target client 110 may be defined as a client requesting a user authentication request from the biometric information storage server 120 or the decryption key storage server 130 among at least one client included in the authentication system.

In addition, the biometric information storage server 120 may be defined as a server that stores biometric information from at least one client in advance. Here, the biometric information stored in advance may be referred to as registration biometric information, and may serve as reference information for authenticating a user.

Also, the decryption key storage server 130 may store at least one decryption key. Here, the decryption key may represent information for decrypting the biometric information encrypted by the client.

Further, in the authentication system of Figs. 1 and 2, the decryption of encrypted biometric information can be performed by one server (e.g., decryption key storage server 130). Hereinafter, the decoding performed by one server can be expressed as a single stage decoding.

The encryption and the decryption may be performed by a symmetric type encryption decryption method or an asymmetric type encryption decryption method. Here, the symmetric-type encryption / decryption scheme refers to an algorithm or a method in which the encryption key used for encryption and the decryption key used for decryption are the same. On the other hand, the asymmetric encryption / decryption scheme refers to a different encryption key and decryption key.

Examples of the symmetric key include 3DES (Triple Data Encryption Standard), AES (Advanced Encryption Standard), SEED, ARIA (Academy, Research Institute, Agency) DES (Data Encryption Standards), CRYPTON, RIJNDAEL, CAST256, RC6, RC5, SEA, DESX, RC5, BLOWFISH, CAST128, SAFER, and the like. Examples of the asymmetric key include RSA (Rivest Shamir Adleman), EIGamal (RSA), RC2, RC2, TWOFISH, MARS, SERPENT, SKIPJACK, IDEA (International Data Encryption Algorithm) , An ECC (Elliptic Curve Crypto system), a DSS (Digital Signature Standard), and PKP (Public Key Partners). Of course, the symmetric key or the asymmetric key is not limited to the above example, and the information used in the symmetric type encryption decoding method or the asymmetric type encryption decoding method not mentioned above may also be included in the symmetric key or the asymmetric key.

The decryption key storage server 130 may match the biometric information stored in the biometric information storage server 120 with the biometric information acquired from the target client 110. The decryption key storage server 130 may be a matching server Can be expressed.

The hardware configuration of the client, the biometric information storage server 120, and the decryption key storage server 130 are as follows. The client, the biometric information storage server 120, and the decryption key storage server 130 are classified according to their roles. May be the same / similar. For example, the biometric information storage server 120 and the decryption key storage server 130 may be implemented as a server device or a fixed terminal or a mobile terminal.

In some embodiments of the invention, a registration operation and an authentication operation may be performed in an authentication system. Here, the authentication operation refers to an operation of confirming whether the user of the biometric information obtained by the target client 110 is a user of the biometric information stored in the biometric information storage server 120 in advance, &Lt; / RTI &gt;

In the registration operation, the target client 110 may designate the biometric information storage server 120 as a server for storing registration biometric information, and designate the decryption key storage server 130 as a server for storing the decryption key. In the biometric information storage server 120 and the decryption key storage server 130, at least one client including the target client 110 may be designated as a device for requesting user authentication. Accordingly, the security of the user authentication can be improved by receiving the user authentication through the communication with the target clients 110 in advance.

In addition, in the registration operation, the target client 110 can provide biometric information for registration to the biometric information storage server 120. [ To this end, biometrics information for registration may be obtained from a user, the obtained biometrics information for registration may be encrypted using a unique cryptographic key, and then encrypted biometrics information may be transmitted to the biometrics information storage server 120. That is, the target client 110 provides the biometric information for registration in the encrypted state to the biometric information storage server 120, but the decryption key for decrypting the biometric information encrypted for registration in the biometric information storage server 120 is Not provided. Accordingly, the biometric information storage server 120 can not decrypt the encrypted biometric information even if it is acquired. Therefore, even if the biometric information storage server 120 is hacked and the encrypted biometric information for registration is leaked, the encrypted biometric information for registration is not decrypted due to the non-acquisition of the decryption key. Therefore, the possibility of biometric information leakage due to the hacking of the biometric information storage server 120 is reduced.

In addition, in the registration operation, the target client 110 can provide the biometric information storage server 120 with the identifier of the target client 110 together with the encrypted registration biometric information. Here, the identifier of the target client 110 indicates information that can distinguish the target client 110 among a plurality of clients. For example, the identifier of the target client 110, the serial number of the target client 110, The information may be in any format as long as the information can identify the target client 110 such as the order of the target client 110 among the clients.

Specifically, the biometric information storage server 120 can acquire encrypted registration biometric information from not only the target client 110 but also other clients. In the authentication operation, the biometric information storage server 120 transmits the encrypted registration biometric information Can be provided. However, if encrypted biometric information from a client other than the target client 110 is provided to the decryption key storage server 130 despite the user authentication request from the target client 110, the decryption key storage server 130 130 may decrypt encrypted biometric information for registration from a client other than the target client 110, may result in inefficiency. In order to prevent such inefficiency, the target client 110 provides the biometric information storage server 120 with the identifier of the target client 110 together with the encrypted biometric information for registration, and transmits a user authentication request from the target client 110 The biometric information storage server 120 may provide only the encrypted registration biometric information corresponding to the identifier of the target client 110 among the stored encrypted biometric information to the decryption key storage server 130. [

In addition, in the registration operation, the target client 110 may provide the decryption key to the decryption key storage server 130. [ Here, the decryption key corresponds to the unique encryption key of the target client 110 and means information capable of decrypting the biometric information encrypted by the target client 110. [

More specifically, the decryption key storage server 130 can acquire the decryption key from not only the target client 110 but also other clients, and decrypts the encrypted biometrics information for registration and the encrypted biometrics information for authentication in the authentication operation . However, when the decryption key storage server 130 performs the decryption using the entire decryption key stored in the decryption key storage server 130, the encrypted registration biometric information and the decryption key that does not correspond to the encrypted biometric information for authentication Decryption is performed by using the key. In order to prevent such a problem, the decryption key storage server 130 extracts a decryption key corresponding to the identifier of the target client 110 among all the decryption keys stored in the decryption key storage server 130, and uses the extracted decryption key The encrypted biometric information for registration and the encrypted biometric information for authentication can be decrypted.

In one embodiment, the target client 110 can encrypt biometric information for registration and biometric information for authentication acquired in the authentication operation with the same cryptographic key. In this case, the target client 110 can provide the decryption key storage server 130 with a decryption key that can decrypt both the encrypted biometric information for registration and the biometric information for encrypted authentication.

In another embodiment, the target client 110 can encrypt biometric information for registration and biometric information for authentication acquired in the authentication operation with different cryptographic keys. In this case, the target client 110 can separately provide a decryption key for decrypting encrypted biometric information for registration and a decryption key for decrypting encrypted biometric information for authentication.

Further, in one embodiment of the present invention, the target client 110 may provide the decryption key storage server 130 with the identifier of the target client 110 together with the decryption key. Accordingly, when the encrypted biometric information corresponding to the identifier of the target client 110 is acquired from the biometric information storage server 120, the decryption key storage server 130 stores the decryption key corresponding to the identifier of the target client 110 The encrypted biometric information can be decrypted.

In the authentication operation, the target client 110 acquires and encrypts the biometric information for authentication, and provides the encrypted biometric information for authentication to the biometric information storage server 120. In addition, the biometric information storage server 120 provides encrypted biometric information for registration and biometric information for authentication to the decryption key storage server 130. Further, the decryption key storage server 130 decrypts the biometrics information for registration and the encrypted biometrics information for authentication using the decryption key, then matches the decrypted biometrics information for registration with the decrypted biometrics information for authentication, And provides the matching result to the biometric information storage server 120 or the target client 110. Thereafter, when the decrypted registration biometric information is matched with the decrypted authentication biometric information as a result of the matching, the biometric information storage server 120 provides information indicating that the user is authenticated to the target client 110, , And provides information to the target client 110 that the user is not authenticated.

The authentication operation in the authentication system will be described in more detail in Fig.

2 is a diagram for explaining an authentication system according to an embodiment in more detail.

Referring to FIG. 2, the authentication system may include a target client 210, a biometric information storage server 220, and a decryption key storage server 230. 1 is directly applied to the target client 210 and the description of the biometric information storage server 120 of FIG. 1 is stored in the biometric information storage server 220 And the decryption key storage server 230 of FIG. 1 is applied to the decryption key storage server 230 as it is.

First, the target client 210 may include a communication interface 211, a biometric information obtaining unit 212, and a control unit 213.

The communication interface 211 may include one or more modules that enable network communication between the target client 210 and the external device. For example, the communication interface 211 includes a wireless communication module such as a wireless Internet interface such as a wireless LAN (WLAN), a WiFi, and a short-range communication interface such as Bluetooth and ZigBee, And can communicate data with the outside through the wireless communication module. Of course, the communication interface 211 may include not only a wireless communication module but also a wired communication module. As described above, the communication interface 211 can be applied to the communication interface 221 of the biometric information storage server 220 and the communication interface 231 of the decryption key storage server 230.

Further, the biometric information acquiring unit 212 can acquire the biometric information of the user. For example, the biometric information acquiring unit 212 may acquire biometric information of a user from the interface 211. When the biometric information acquiring unit 212 is a sensor, it may acquire biometric information directly from the user have. As another example, when the biometric information is fingerprint information, the biometric information obtaining unit 212 may obtain the fingerprint image as biometric information, or may obtain information on the minutiae extracted from the fingerprint image as biometric information.

The control unit 213 controls the overall operation of the target client 210. In particular, the control unit 213 receives the registration request or the authentication request from the user or the external device, encrypts the biometric information, and requests the user authentication.

In some embodiments of the present invention, upon receiving a registration request, the control unit 213 performs the registration operation described above. As described above, in the registration operation, the control unit 213 obtains the biometric information for registration from the user, encrypts the biometric information for registration using the unique encryption key, and transmits the encrypted biometric information to the biometric information storage server 220. The control unit 213 also provides a decryption key for decrypting the encrypted biometric information for registration to the decryption key storage server 230. [

Further, in some embodiments of the present invention, the control unit 213 performs an authentication operation when receiving an authentication request. First, in the authentication operation, the control unit 213 acquires authentication biometric information from the biometric information acquisition unit 212. [ Here, the biometric information for authentication is distinguished from biometric information for registration, and may be defined as biometric information for comparison with biometric information for registration to authenticate a user.

Further, the control unit 213 encrypts biometric information for authentication using a unique encryption key. Here, the symmetric key or the asymmetric key may be applied to the unique cryptographic key. However, the unique encryption key must correspond to the decryption key provided to the decryption key storage server 230 in the registration operation. That is, the controller 213 must provide a decryption key to the decryption key storage server 230 so that the decryption key storage server 230 can decrypt the decryption key.

In one embodiment, the control unit 213 can update a unique cryptographic key with a new cryptographic key. In this case, before the decryption key storage server 230 decrypts the biometric information encrypted with the new encryption key, the decryption key storage server 230 decrypts the biometric information encrypted with the new encryption key, The decryption key storage server 230 should be provided with a decryption key corresponding to the new encryption key so that the biometric information encrypted with the new encryption key can be decrypted.

Furthermore, in some embodiments of the present invention, the control unit 213 may assign an attribute that can distinguish registration biometric information from authentication biometric information to authentication biometric information and registration biometric information.

In one embodiment, the attribute may include a use identifier indicating the use of the biometric information. In this case, the control unit 213 generates the use identifier, and can give the use identifier to the biometric information according to the use of the biometric information.

In another embodiment, the attribute may include a validity period for which biometric information can be used. In this case, the control unit 213 generates a registration validity period indicating the valid period of the biometric information for registration or an authentication valid period indicating the valid period of the biometric information for authentication, and gives a registration validity period or authentication validity period to the biometric information . At this time, the registration validity period may be longer than the authentication validity period.

For example, when the control unit 213 acquires biometric information from the biometric information acquiring unit 212 in the registration operation, the control unit 213 recognizes the acquired biometric information as biometric information for registration, A first usage identifier and / or a registration validity period that can indicate that biometric information is for registration can be given. As another example, when the control unit 213 acquires the biometric information from the biometric information acquiring unit 212 in the authentication operation, the control unit 213 recognizes the acquired biometric information as authentication biometric information, A second usage identifier and / or an authentication validity period that can indicate that the biometric information is for authentication.

Further, in some embodiments of the present invention, in the authentication operation, the control unit 213 may request the biometric information storage server 220 to authenticate the user. However, the present invention is not limited to this, and the controller 213 can request a user authentication request to a server other than the biometric information storage server 220 or the decryption key storage server 230, May transmit a user authentication request to the biometric information storage server 220.

In addition, the control unit 213 can provide the encrypted biometric information for authentication to the biometric information storage server 220. [ If the controller 213 provides encrypted authentication biometric information to the separate server, the separate server may provide the encrypted authentication biometric information to the biometric information storage server 220.

In addition, the control unit 213 can provide the biometric information storage server 220 with the identifier of the target client 210 together with the encrypted biometric information for authentication. Using the identifier of the target client 210, the biometric information storage server 220 or the decryption key storage server 230 can confirm that the encrypted biometric information for authentication is provided from the target client 210.

The control unit 213 can also provide the decryption key storage server 230 with the encrypted biometric information for authentication and the identifier of the target client 210. [ In this case, the decryption key storage server 230 obtains the encrypted registration biometric information from the biometric information storage server 220, acquires the encrypted authentication biometric information from the target client 210, The encrypted biometric information for registration and the encrypted biometric information for authentication can be decrypted using the decryption key corresponding to the identifier of the encrypted biometric information.

Also, in some embodiments of the present invention, the biometric information storage server 220 may include a communication interface 221, a biometric information storage unit 222, and a control unit 223.

The communication interface 221 includes one or more modules that enable network communication between the biometric information storage server 220 and the external device. The communication interface 221 is connected to the communication interface 211 of the target client 210 The description can be applied as it is.

In addition, the biometric information storage unit 222 may store the biometric information for registration obtained from each of the clients in the registration operation. At this time, the registration biometric information stored in the biometric information storage unit 222 can be encrypted by each of the clients providing the biometric information for registration. Accordingly, the biometric information storage server 220 can store the encrypted biometric information for registration, and can not decrypt the encrypted biometric information for registration unless the decryption key is obtained.

In addition, the control unit 223 collectively manages the overall operation of the biometric information storage server 220. [

According to one embodiment, in the authentication operation, the control unit 223 can acquire the encrypted biometric information for authentication and the identifier of the target client 210 according to the user authentication request. Then, the control unit 223 stores encrypted biometrics information, encrypted biometrics information for authentication, and an identifier of the target client 210 in the form of a decryption key for decrypting the encrypted biometrics information for registration and biometrics information for encrypted authentication To the server (230). However, when the control unit 223 provides the decryption key storage server 230 with all the encrypted biometric information stored in the biometric information registration unit 222, the decryption key storage server 230 in the biometric information storage server 220, The inefficiency of acquiring the entire encrypted biometric information encrypted by the decryption key storage server 230 occurs. Accordingly, the control unit 223 extracts the encrypted registration biometric information corresponding to the identifier of the target client 210 from all of the encrypted registration biometric information, and the encrypted registration biometric information corresponding to the identifier of the target client 210 It is possible to provide only the biometric information to the decryption key storage server 230.

In addition, in one embodiment, the control unit 223 can check the registration validity period of the encrypted biometric information for registration and, when the registration validity period has expired, remove the encrypted biometric information for registration.

Also, in some embodiments of the present invention, the decryption key storage server 230 may include a communication interface 231, a decryption key storage unit 232, and a control unit 233. [

The communication interface 221 includes one or more modules for enabling network communication between the decryption key storage server 230 and the external device. The communication interface 231 is connected to the communication interface 211 of the target client 210 The description can be applied as it is.

Also, the decryption key storage unit 232 may store the decryption key obtained from each of the clients in the registration operation.

In addition, the control unit 233 collectively manages the overall operation of the decryption key storage server 230.

In the authentication operation, the control unit 233 can acquire the encrypted registered biometric information, the encrypted biometric information for authentication, and the identifier of the target client 210. [ At this time, the encrypted registration biometric information acquired by the control unit 233 may correspond to the identifier of the target client 210. [

In one embodiment, the decryption key storage server 230 may receive the encrypted registration biometric information, the encrypted biometric information for authentication, and the identifier of the target client 210 from the biometric information storage server 220. In this case, even when the decryption key storage server 230 communicates with the biometric information storage server 220 without communicating with the target client 210, the encrypted biometric information and the encrypted biometric information for encrypted authentication are decrypted .

In another embodiment, the decryption key storage server 230 obtains the encrypted biometric information for authentication from the target client 210 and the identifier of the target client 210 according to the user authentication request of the target client 210, The encrypted biometric information for registration can be obtained from the biometric information storage server 220. [

In order to decrypt the encrypted registration biometric information and the encrypted biometric information for authentication, the control unit 233 decrypts the decryption key corresponding to the identifier of the target client 210 among the decryption keys stored in the decryption key storage unit 232 Can be extracted. The control unit 233 can decrypt the encrypted registration biometric information and the encrypted authentication biometric information using the decryption key corresponding to the identifier of the target client 210. [

Further, the control unit 233 can determine whether the decrypted biometric information for registration and the decrypted biometric information for authentication match. Here, the registration biometric information and the authentication biometric information are matched, which means that the biometric information for registration and the biometric information for authentication are similar enough to indicate that the biometric information of the same user is the same.

The control unit 233 extracts the degree of similarity between the decrypted biometric information for registration and the decrypted biometric information for authentication, and when the extracted degree of similarity is equal to or greater than a predetermined reference value, the decrypted biometric information for registration and the decrypted biometric information It can be determined that the biometric information for authentication is matched.

For example, when the biometric information is fingerprint information, the control unit 233 can extract the minutiae points of the decrypted biometric information for registration and the minutiae points of the decrypted biometric information for authentication. The control unit 233 compares the similarities between the minutiae points of the decoded biometric information for registration and the minutiae points of the decrypted biometric information for authentication, and if the similarity is equal to or greater than a predetermined reference value, the decoded minutiae of the biometric information for registration and the decrypted authentication It can be determined that the minutiae points of the biomedical information are matched.

In addition, the control unit 233 can provide the matching result to the biometric information storage server 220. In this case, when it is determined that the biometric information for registration and the biometric information for authentication are matched, the control unit 223 of the biometric information storage server 220 provides the result that the user is authenticated to the target client 210, (For example, service information that the biometric information storage server 220 provides to the target client 210 when the user is authenticated) to the client 210. [ When it is determined that the biometric information for registration and the biometric information for authentication are not matched, the control unit 223 of the biometric information storage server 220 can provide the result to the target client 210 that the user is authenticated.

However, in one embodiment, the control unit 233 may provide the matching result directly to the target client 210. [

Further, in one embodiment, the control unit 233 can confirm the registration valid period of the encrypted biometric information for authentication, and can remove the encrypted biometric information for authentication when the validity period expires.

Further, in some embodiments of the present invention, the matching of the decrypted biometric information for registration and the decrypted biometric information for authentication may be performed in the biometric information storage unit 220. [

For example, the control unit 223 acquires the identifier of the target client 210 and the encrypted biometric information for authentication from the target client 210 according to the user authentication request of the target client 210, The encrypted registered biometric information corresponding to the identifier of the target client 210 can be extracted from the encrypted registered biometric information stored in the registered biometric information. Unlike the above-described embodiment, the control unit 223 does not provide the encrypted registration biometric information, the encrypted biometric information for authentication, and the identifier of the target client 210 to the decryption key storage server 230, Acquires a decryption key corresponding to the identifier of the target client 210 from the key storage server 230, encrypts the biometrics information for registration using the decryption key corresponding to the identifier of the target client 210, Information can be decoded. Thereafter, the control unit 223 can determine whether the decrypted biometric information for registration and the decrypted biometric information for authentication are matched, and provide the user authentication result according to the matching result to the target client 210.

When biometrics information and a decryption key encrypted for registration are stored in one server, when the server is hacked, encrypted biometrics information for registration and a decryption key are leaked together, so that the biometrics information of the user can be used for crimes.

In the meantime, the encrypted biometric information is stored in the biometric information storage server 220 and the decryption key is stored in the decryption key storage server 230 separated from the biometric information storage server 220, as in the above- do. Even if the biometric information storage server 20 is hacked and the encrypted registration biometric information flows out, the encrypted biometric information for registration is not decrypted due to the absence of the decryption key. Also, even if the decryption key storage server 230 is hacked and a decryption key flows out, no living body is exposed due to the absence of the encrypted registration biometric information. Thus, as in the embodiments of the present invention, the security of the authentication system can be improved by storing the encrypted biometric information for registration and the decryption key in different servers.

3 is a diagram for explaining the configuration of registration biometric information or authentication biometric information according to an embodiment.

3, the biometric information for registration and the biometric information for authentication may be transmitted and received between the target client, the biometric information storage server, and the decryption key storage server in the form of a biometric information message 310. [ This biometric information message 310 may be generated at the target client.

Specifically, the biometric information message 310 may include a target client identifier field 311, an encrypted biometric information field 312, a validity period field 313, and an application identifier 314.

The target client identifier field 311 may include an identifier of the target client, and the encrypted biometric information field 312 may include encrypted biometric information for registration or biometric information for encrypted authentication.

The validity period field 313 may include a registration validity period or an authentication validity period. In the use identifier field 314, a first use identifier that can indicate registration biometric information or a biometric information item 2 Application identifier may be included.

3, the biometric information message 310 is shown to include both the target client identifier field 311, the encrypted biometric information field 312, the validity period field 313, and the use identifier field 314, The biometric information message 310 includes a target client identifier field 311 and an encrypted biometric information field 312. The biometric information message 310 includes a validity period field 313 or a use identifier field 314, And may not include both the validity period field 313 and the use identifier field 314.

<Authentication system using multi-stage decryption>

4 is a diagram for explaining an authentication system when a sub-matching server according to an embodiment exists.

Referring to FIG. 4, the authentication system may include a target client 410, a biometric information storage server 420, a matching server 430, and a plurality of sub matching servers 441, 442, and 443. In the example of FIG. 4, the sub-matching servers 441, 442, and 443 are represented by a plurality of, but not limited to, the sub-matching servers in the authentication system.

1 and 2, the configuration described for the target client 110 of FIG. 1 and the target client 210 of FIG. 2 may be applied as it is to the target client 410. The configuration of the biometric information storage server 420 may be applied to the biometric information storage server 220 of FIG. 1 and the biometric information storage server 230 of FIG. 2 as they are.

However, unlike the authentication system of FIG. 1 and FIG. 2, in the authentication system of FIG. 4, the decryption of encrypted biometric information can be performed by a plurality of servers instead of a single server. Hereinafter, the decoding performed by a plurality of servers can be expressed by multi-stage decoding. 4, the decryption of encrypted biometric information may be performed in a plurality of sub matching servers 441, 442, and 443 and a matching server 430. [ That is, the operation of the decryption key storage server in FIGS. 1 and 2 can be performed by the matching server 430 and the plurality of sub matching servers 441, 442, and 443.

In some embodiments of the invention, a registration operation and an authentication operation may be performed in an authentication system.

In the registration operation, the target client 410 can designate the biometric information storage server 420 as a server for storing biometric information for registration. In addition, the target client 410 may specify a server to store the decryption key. For example, the target client 410 designates a plurality of sub matching servers 441, 442, and 443 as a server for storing a decryption key, or a matching server 430 and a plurality of sub matching servers 441, 442, and 443, Can be specified together. Since the decryption is performed by the server storing the decryption key, the number of decryption steps can be determined by the target client 410 according to the number of servers designated as the server for storing the decryption key.

The biometric information storage server 420, the matching server 430 and the plurality of sub matching servers 441, 442 and 443 are devices for requesting user authentication and at least one client including the target client 410 Can be specified.

In addition, in the registration operation, the target client 410 can provide biometric information for registration to the biometric information storage server 420. [ To this end, it is possible to acquire registration biometric information from a user, encrypt the obtained registration biometric information using a unique encryption key, and transmit the encrypted registration biometric information to the biometric information storage server 420. In addition, the target client 410 may provide the decryption key storage server 130 with a decryption key corresponding to a unique encryption key.

In one embodiment, when performing encryption, the target client 410 may chain-encrypt biometric information for registration. For example, when n cryptographic keys are used, the target client 410 may encrypt the biometric information for registration by sequentially applying the first cryptographic key to the n-th cryptographic key. In addition, the target client 410 may provide n decryption keys corresponding to n cipher keys to the matching server 430 and / or the plurality of sub matching servers 441, 442, and 443, respectively. For example, when decryption is performed in the matching server 430 and the plurality of sub matching servers 441, 442, and 443, the target client 410 provides the first decryption key to the matching server 430, And provide one key to each of a plurality of sub matching servers 441, 442, and 443, respectively. In another example, when decryption is performed in a plurality of sub matching servers 441, 442, and 443, the target client 410 provides a first decryption key to the first sub matching server 441, One sub-matching server 442 and one sub-matching server 443, respectively.

In another embodiment, when performing encryption, the target client 410 may distribute and encrypt biometric information for registration. For example, when the n cipher keys are used, the target client 410 divides the biometric information for registration into n pieces and applies each of the n cipher keys, one for each of the n divided pieces of registration biometric information, . For example, when three cryptographic keys are used, the target client applies the first cryptographic key to the divided first biometric information for registration, applies the second cryptographic key to the divided second biometric information for registration, It is possible to encrypt each of the three divided biometric information for registration by applying the third cipher key to the biometric information for the registered biometric information. In addition, the target client 410 may provide n decryption keys corresponding to n cipher keys to the matching server 430 and / or the plurality of sub matching servers 441, 442, and 443, respectively.

In addition, in the registration operation, the target client 410 may provide the identifier of the target client 410 to the biometric information storage server 420. [ Using the identifier of the target client 410, the biometric information storage server 420 can identify the encrypted biometric information acquired from the target client 410 from the encrypted biometric information acquired from the plurality of clients, Matching server 441, 442, and 443 can identify the decryption key obtained from the target client 410 among the decryption keys obtained from the plurality of clients.

Further, in some embodiments of the present invention, the target client 410 pre-stores encrypted biometric information for registration and identifiers of each of a plurality of clients from each of the plurality of clients. In addition, when receiving the authentication request from the target client 410, the biometric information storage server 420 performs the authentication operation. First, in the authentication operation, the target client 410 acquires the biometric information for authentication from the user or an external device (e.g., iris recognition device).

In addition, the target client 410 encrypts biometric information for authentication using a unique encryption key. Here, the unique encryption key must correspond to the decryption key provided to the matching server 430 and / or the plurality of sub matching servers 441, 442, and 443 in the registration operation. That is, the target client 410 may include a matching server 430 and / or a plurality of sub-matching servers 441, 442, 443 so as to be decrypted by the matching server 430 and / or the plurality of sub matching servers 441, , 443).

In addition, in some embodiments of the present invention, the target client 410 stores an attribute (e.g., the above-described use identifier, validity period) capable of distinguishing biometric information for registration from biometric information for authentication with biometric information for registration Biometric information for authentication can be given.

Further, in some embodiments of the present invention, in the authentication operation, the target client 410 may make a user authentication request to the biometric information storage server 420. [ However, the present invention is not limited to this, and the target client 410 can request a user authentication request to a server other than the biometric information storage server 420 or the matching server 430, And may transmit a user authentication request to the biometric information storage server 420.

In addition, the target client 410 may provide encrypted authentication biometric information to the biometric information storage server 420. If the target client 410 provides the encrypted authentication biometric information to the separate server, the separate server may provide the encrypted authentication biometric information to the biometric information storage server 420.

In addition, the target client 410 can provide the biometric information storage server 420 with the identifier of the target client 410 together with the encrypted authentication biometric information. However, the present invention is not limited to this, and the target client 410 may provide the authentication server 420 with the encrypted authentication biometric information and the identifier of the target client 410. [

Also, in some embodiments of the present invention, the biometric information storage server 420 may obtain the encrypted biometric information for authentication and the identifier of the target client 410 according to the user authentication request. Then, the biometric information storage server 420 encrypts biometric information for registration, biometric information for authentication, and an identifier of the target client 410 in order to decrypt encrypted biometric information for registration and biometric information for encrypted authentication To the matching server 430. The biometric information storage server 420 extracts the encrypted registration biometric information corresponding to the identifier of the target client 410 from all the encrypted biometric information for registration and transmits the encrypted registration biometric information corresponding to the identifier of the target client 410 Only the biometric information can be provided to the matching server 430.

In addition, the biometric information storage server 420 can confirm the registration validity period of the encrypted registration biometric information, and can remove the encrypted biometric information for registration when the registration validity period has expired.

Further, in some embodiments of the present invention, the matching server 430 and / or the plurality of sub matching servers 441, 442, and 443 may store the decryption key obtained from each of the plurality of clients and the identifier of each of the plurality of clients in advance do. In the authentication operation, the matching server 430 can obtain the encrypted registration biometric information, the encrypted authentication biometric information, and the identifier of the target client 410. [ The matching server 430 also provides at least a part of the encrypted registration biometric information to the plurality of sub matching servers 441, 442 and 443, at least a part of the encrypted authentication biometric information and the identifier of the target client 410 can do.

The matching server 430 and / or the plurality of sub matching servers 441, 442, and 443 may decrypt the encrypted biometric information and the encrypted biometric information for authentication using the target decryption keys 410 Can be extracted from the decryption key. The matching server 430 and / or the plurality of sub matching servers 441, 442, and 443 may use the decryption key corresponding to the identifier of the target client 410 to encrypt the biometrics information for registration and the encrypted biometrics information for authentication It can be decoded.

In one embodiment, the matching server 430 and / or the plurality of sub matching servers 441, 442 and 443 may "cascade" encrypted biometric information for registration and biometric information for encrypted authentication.

For example, if the target client 410 provides the first decryption key to the matching server 430 among the n decryption keys and provides the decryption keys to the plurality of sub matching servers 441, 442, and 443 one by one The matching server 430 decrypts the encrypted registration biometric information and the encrypted authentication biometric information using the first decryption key. Also, the first sub-matching server 441 decrypts biometrics information for registration and biometrics information for authentication decrypted by the matching server 430 using the second decryption key. Also, the second sub matching server 442 and the N &lt; th &gt; sub matching server 443 may also use the decryption key corresponding to the identifier of the target client 410 stored in advance to categorize the biometric information for registration and the biometric information for authentication Decryption. In this case, the Nth sub-matching server 443 can finally complete the decryption, and the Nth sub-matching server 443 decodes the decoded data in the matching server 430 so that the matching is performed in the matching server 430 Registration biometric information and decrypted biometric information for authentication can be transmitted. However, the present invention is not limited to this, and the Nth sub matching server 443 may match the decrypted biometric information for registration and the decrypted biometric information for authentication. As another example, the target client 410 does not provide the decryption key to the matching server 430 among the n decryption keys, but provides one decryption key to each of the plurality of sub matching servers 441, 442, and 443 In this case, the matching server 430 provides the encrypted registration biometric information and encrypted authentication biometric information to the first sub matching server 441. Also, the first sub-matching server 441 decrypts biometrics information for registration and biometrics information for authentication acquired from the matching server 430 using the first decryption key. Also, the second sub matching server 442 and the N &lt; th &gt; sub matching server 443 may also use the decryption key corresponding to the identifier of the target client 410 stored in advance to categorize the biometric information for registration and the biometric information for authentication Decryption. In this case, the Nth sub-matching server 443 can finally complete the decryption by the Nth sub matching server 443, and the Nth sub matching server 443 decodes the matching data in the matching server 430 so that the matching is performed in the matching server 430 The biometrics information for registration and the decrypted biometric information for authentication may be transmitted or the biometrics information for registration decrypted by the Nth sub matching server 443 and the decrypted biometric information for authentication may be matched.

In another embodiment, the matching server 430 and / or the plurality of sub matching servers 441, 442 and 443 may "divide" encrypted biometric information for registration and biometric information for encrypted authentication.

For example, when the matching server 430 receives the first decryption key among the n decryption keys, the first encrypted biometric information of the encrypted registration biometric information divided into n, and the encrypted authentication biometric information And the plurality of sub matching servers 441, 442, and 443 divides one of the remaining decryption keys, one of the remainder of the divided and encrypted biometric information for registration, and the encrypted authentication When acquiring one of the remaining pieces of biometric information, the matching server 430 decrypts the first encrypted biometric information for registration and the first encrypted biometric information for authentication using the first decryption key. The plurality of sub-matching servers 441, 442, and 443 are configured to divide and divide encrypted divided biometric information stored in each of the plurality of sub matching servers 441, 442, and 443 and biometric information for authentication And decodes it using the decryption key corresponding to the identifier of the target client 410 stored in each of the plurality of sub matching servers 441, 442 and 443. In addition, the matching server 430 acquires divided biometric information for registration and biometric information for division that are decoded by the plurality of sub matching servers 441, 442, and 443, integrates the obtained biometric information for registration, Biometric information for registration can be obtained, and the obtained biometric information for authentication can be integrated to obtain decrypted biometric information for authentication.

As another example, a plurality of sub-matching servers 441, 442, and 443 may include one of n decryption keys, one of encrypted biometric information for registration divided into n, and one of encrypted biometric information for encrypted authentication divided into n The plurality of sub matching servers 441, 442 and 443 are configured to divide and divide encrypted and divided biometric information stored in each of the plurality of sub matching servers 441, 442 and 443, And decrypts the biometric information using the decryption key corresponding to the identifier of the target client 410 stored in each of the plurality of sub matching servers 441, 442, and 443. In addition, the matching server 430 acquires divided biometric information for registration and biometric information for division that are decoded by the plurality of sub matching servers 441, 442, and 443, integrates the obtained biometric information for registration, Biometric information for registration can be obtained, and the obtained biometric information for authentication can be integrated to obtain decrypted biometric information for authentication.

Also, the matching server 430 can determine whether the decrypted biometric information for registration and the decrypted biometric information for authentication match. 1 and FIG. 2 can be directly applied to the determination of whether or not the matching is performed, and thus a detailed description thereof will be omitted.

In addition, the matching server 430 may provide the matching result to the biometric information storage server 420. However, the matching server 430 may directly provide the matching result to the target client 410.

In addition, in one embodiment, the matching server 430 may check the registration validity period of the encrypted biometric information for authentication, and may remove the encrypted biometric information for authentication when the validity period has expired.

As described above, the security of the authentication system can be improved by storing the encrypted registration biometrics information and the decryption key in different servers. In addition, in the embodiments of FIG. 4, a plurality of decryption keys are provided, a plurality of decryption keys are not distributed in one server but are distributed and stored in a plurality of servers, and encrypted biometric information can be decrypted have. That is, when a decryption key is stored in each of the matching server 430 and the plurality of sub matching servers 441, 442, and 443, even if one of the servers is hacked and a decryption key is leaked, Information can not be decoded. Therefore, according to the embodiment of FIG. 4, the security of the authentication system can be further improved.

5 is a diagram for explaining a hub server according to an embodiment.

5, the authentication system may include a target client 510, a biometric information storage server 520, a hub server 530, and a plurality of matching servers 541, 542, and 543. 5, each of the matching servers 541, 542, and 543 of FIG. 5 may include at least one sub matching server (e.g., a plurality of sub matching servers 441, 442, and 443). 5, a plurality of matching servers are included in the embodiment of FIG. 5, and a hub server 530 is added. The target client 510, the biometric information storage server 520, The configuration described for the target client 410, the biometric information storage server 420, and the matching server 430 may be applied to the servers 541, 542, and 543 as they are.

In some embodiments of the invention, a registration operation and an authentication operation may be performed in an authentication system.

In the registration operation, the target client 510 may specify a server to store the decryption key and may provide information to the hub server 530 about the assignment. For example, the target client 510 may designate a first matching server 541 of a plurality of matching servers 541, 542, and 543 as a server to store a decryption key, and the hub server 530 may specify a target client 510 May have obtained information that the first matching server 541 has designated the server to store the decryption.

In addition, in the registration operation, the hub server 530 can acquire the decryption key from the target client 510 and receive the decryption key from the matching server (in this example, the first matching server (Step 541). Of course, when the matching server obtains a plurality of decryption keys from the hub server 530, the matching server may provide one decryption key to each of the predetermined sub matching servers.

In the authentication operation, the hub server 530 obtains the identifier of the target client 510 from the biometric information storage server 520 or the target client 510, and performs a plurality of matching using the identifier of the target client 510 The server 541, 542, and 543 may designate a matching server to be decrypted. Accordingly, the hub server 530 can transmit the encrypted registration biometric information, the encrypted authentication biometric information, and the identifier of the target client 510 from the biometric information storage server 520 to the designated matching server.

The hub server 530 may request the matching server for matching registration biometric information and authentication biometric information to obtain the matching result from the designated matching server and output the matching result to the biometric information storage server 520. [ Or to the target client 510.

FIG. 6 is a diagram for explaining a decoding method when there is a sub-matching server according to an embodiment.

Referring to FIG. 6, the first sub-matching server 620 and the second sub-matching server 630 are dependent on the matching server 610 and perform decoding of the encrypted biometric information under the control of the matching server 610.

In one embodiment, the matching server 610 includes decryption keys 1, 2, 3 (611, 612, 613) for decrypting encrypted biometric information at each of the first, second, and third clients. In addition, the first sub-matching server 620 is for decrypting the encrypted biometric information generated by the first client, that is, corresponding to the decryption key 1 611, And a decryption key 3-1 (622) including the key 1-1 (621) and corresponding to the decryption key 3 (613). The second sub matching server 630 includes a decryption key 1 611 corresponding to the decryption key 1 611 and a decryption key 2-1 632 corresponding to the decryption key 2 612 .

As a specific example, the matching server 610 may obtain the identifier of the first client from the biometric information storage server. In this case, the matching server 610 can extract the decryption key 1 (611) among the decryption keys 611, 612, and 613 as a decryption key to be decrypted using the identifier of the first client. In addition, the matching server 610 may transmit the identifier of the first client to the first sub matching server 620 and the second sub matching server 630. In this case, the first sub-matching server 620 selects the decryption key 1-1 (621) as a decryption key for performing decryption using the identifier of the first client, and the second sub-matching server 630 selects the decryption key 1-1 The decryption key 1-2 (631) can be selected by using the identifier of the decryption key to be decrypted. Accordingly, the biometric information encrypted by the second client is decrypted by the matching server 610, the first sub matching server 620, and the second sub matching server 630.

As another example, the matching server 610 may obtain the identifier of the second client from the biometric information storage server. In this case, the matching server 610 can extract the decryption key 2 612 among the decryption keys 611, 612, and 613 as a decryption key to be decrypted using the identifier of the second client. In addition, the matching server 610 may transmit the identifier of the second client to the first sub matching server 620 and the second sub matching server 630. In this case, since the first sub-matching server 620 does not include the decryption key corresponding to the identifier of the second client, the second sub-matching server 630 does not extract the decryption key and uses the identifier of the second client The decryption key 2-1 (632) can be selected as a decryption key for decryption. Accordingly, the biometric information encrypted by the second client is decrypted by the matching server 610 and the second sub matching server 630, and decrypted by the first sub matching server 620 is not performed.

7 is a flowchart illustrating a method of controlling a decryption key storage server according to an embodiment of the present invention.

Referring to FIG. 7, the authentication system includes a biometric information storage server, a target client, and a decryption key storage server. Specifically, the biometric information storage server stores the biometric information for registration acquired from each of the at least one client, the target client is included in at least one client, acquires the biometric information for authentication of the user, And encrypts biometric information for authentication, and the decryption key storage server can store at least one decryption key. That is, at least one decryption key is stored in a decryption key storage server separate from the biometric information storage server storing the biometric information for registration in order to improve the security of the authentication system.

In the control method of the decryption key storage server, the decryption key storage server may acquire the identifier of the target client and the encrypted biometric information for authentication (710).

Also, the decryption key storage server obtains biometrics information for registration for matching. Registration biometric information corresponding to the identifier in the registration biometric information can be obtained (720). Here, the biometric information for registration can be encrypted by the client that has transmitted the biometric information for registration.

Also, the decryption key storage server may extract a decryption key corresponding to the identifier among at least one decryption key (730).

The decryption key storage server may decrypt the encrypted biometric information for authentication and biometric information for registration corresponding to the identifier using the decryption key corresponding to the identifier (740).

Also, the decryption key storage server can determine whether the decrypted biometric information for authentication and the biometric information for registration corresponding to the identifier are matched (750).

Also, the decryption key storage server may provide the matching result to the biometric information storage server or the target client (760).

The control method of the decryption key storage server shown in FIG. 7 may be applied to the control method of FIG. 1 through FIG. 6 as it is, so that detailed description will be omitted.

8 is a flowchart illustrating a method of controlling a biometric information storage server according to an exemplary embodiment of the present invention.

Referring to FIG. 8, the authentication system includes a biometric information storage server, a target client, and a decryption key storage server. Specifically, the biometric information storage server stores the biometric information for registration obtained from each of the at least one client, the target client is included in at least one client, acquires biometric information for authentication of the user, And the decryption key storage server stores at least one decryption key. That is, the biometric information for registration is stored in the biometric information storage server separate from the decryption key storage server in which at least one decryption key is stored in order to improve the security of the authentication system.

The biometric information storage server in the control method of the biometric information storage server can acquire the identifier of the target client and the biometric information for the authentication according to the user authentication request of the target client (810).

Further, the biometric information storage server may extract registration biometric information corresponding to the identifier of the target client among the biometric information for registration (820). In this case, the biometric information for registration can be encrypted by the client that has transmitted the biometric information for registration.

Further, the biometric information storage server may obtain the matching result of the biometric information for registration corresponding to the identifier and the decrypted biometric information for authentication (830).

In addition, the biometric information storage server may provide information on the matching result or the matching result to the target client (840).

The control method of the biometric information storage server shown in FIG. 8 can be applied to the control method of FIG. 1 through FIG. 6 as it is, so that a detailed description will be omitted.

9 is a flowchart illustrating a method of controlling a matching server according to an exemplary embodiment of the present invention.

Referring to FIG. 9, the authentication system includes a biometric information storage server, a target client, at least one sub matching server, and a matching server. Specifically, the biometric information storage server stores the biometric information for registration acquired from each of the at least one client, the target client is included in at least one client, acquires the biometric information for authentication of the user, And the at least one sub matching server decrypts the biometric information for authentication using the decryption key, and the matching server can match some of the biometric information for registration with the biometric information for authentication. That is, the decryption key is stored in at least one of a matching server or a sub-matching server in which registration biometric information is separated from the biometric information storage server in order to improve the security of the authentication system.

In the control method of the matching server, the matching server can acquire encrypted biometric information for authentication (910).

In addition, the matching server may acquire registration biometric information, and may acquire registration biometric information corresponding to the identifier of the target client among the registration biometric information (920). In this case, the biometric information for registration can be encrypted by the client that has transmitted the biometric information for registration.

The matching server also provides biometric information for authentication and biometric information for registration corresponding to the identifier to the at least one sub matching server for decoding the encrypted biometric information for authentication and the biometric information for registration corresponding to the identifier (930).

Further, the matching server can acquire biometric information for authentication and biometric information for registration corresponding to the identifier (940).

Further, the matching server can determine whether the decrypted biometric information for authentication and the biometric information for registration corresponding to the identifier are matched (950).

In addition, the matching server may provide the matching result to the biometric information storage server or the target client (960).

The contents of the control method of the matching server shown in FIG. 9 through the FIG. 1 through FIG. 6 can be applied as they are, so that detailed description will be omitted.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI &gt; or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (1)

A biometric information storage server for storing biometric information for registration acquired from each of at least one client;
A target client included in the at least one client, for acquiring biometric information for authentication of a user and encrypting the biometric information for authentication using a unique cryptographic key; And
A decryption key storage server control method in an authentication system including a decryption key storage server storing at least one decryption key,
Obtaining an identifier of the target client and the encrypted biometric information for authentication;
Acquiring the biometric information for registration, the biometric information for registration is encrypted by a client that transmitted the biometric information for registration, and acquiring biometric information for registration corresponding to the identifier in the biometric information for registration, ;
Extracting a decryption key corresponding to the identifier among the at least one decryption key;
Decrypting the encrypted biometric information for authentication and biometric information for registration corresponding to the identifier using the decryption key corresponding to the identifier;
Determining whether the decrypted biometric information for authentication and the biometric information for registration corresponding to the identifier are matched with each other; And
Providing the matching result to the biometric information storage server or the target client
And decrypting the decrypted key.

Images