KR20190136884A - Electronic device for authenticating user and operating method thereof - Google Patents

Abstract

Various embodiments of the present invention relate to an electronic device for authenticating a user using biometric information of the user and an operation method thereof. According to the present invention, the electronic device comprises a communication circuit, a biometric sensor, and a processor operatively connected to the communication circuit and the biometric sensor. The processor may be configured to obtain first biometric information of a user using the biometric sensor, generate second biometric information for authenticating the user based on a combination of the first biometric information and unique information corresponding to the user, and transmit the second biometric information to an authentication server using the communication circuit, so that the authentication server authenticates fourth biometric information generated based on a combination of third biometric information of the user and the unique information with respect to the second biometric information.

Description

ELECTRONIC DEVICE FOR AUTHENTICATING USER AND OPERATING METHOD THEREOF}

Various embodiments of the present disclosure relate to an electronic device and an operation method thereof for authenticating a user using biometric information of the user.

Portable electronic devices such as smart phones are not limited to basic services such as phone calls and text transmission, but provide various and complicated financial services such as purchase and payment of goods, deposit and withdrawal and remittance services.

In a financial service provided through a portable electronic device, an authentication method used to verify a user and process a payment may be performed by using a user's biometric information (eg, a fingerprint, etc.) in a method using numbers, codes, or patterns. It is evolving. The method using the biometric information of the user can provide a strong security to the user compared to the method using the existing numbers, codes or patterns in that it is almost impossible to seize another person.

The authentication method using the user's biometric information may include a method of performing user authentication in the portable electronic device, or a method of performing user authentication in a server that previously received the user's biometric information from the portable electronic device.

Among the biometric information-based authentication schemes currently in use, a method of performing user authentication inside a portable electronic device without going through a server requires that biometric information be managed by each electronic device when a user uses a plurality of electronic devices. There are disadvantages.

A method of performing user authentication in a server has a disadvantage in that biometric information may leak in a data transmission section between an electronic device and a server. Unlike the number, code, or pattern, the biometric information used for user authentication cannot be modified or updated by the user, and serious security incidents may occur when the biometric information is leaked or copied by another person. Accordingly, the electronic device may transmit the unidirectionally converted biometric information to the server so that the biometric information of the user is not leaked in the data transmission interval. However, even if the same user inputs his or her biometric information on the same electronic device, biometric information having the same content may not be input every time, and such a small difference in biometric information is completely different when the biometric information is encrypted. Can be converted to a value. That is, even if the same user attempts to authenticate a user using his / her biometric information, false acceptance may occur frequently in which authentication fails due to confusion with other users.

According to various embodiments of the present disclosure, in order to reduce a probability of misrecognition occurring in a user authentication process using biometric information, biometric information independent of a characteristic of an electronic device is generated, and biometric information independent of a characteristic of the electronic device is generated. The information generated by combining user identification information is converted. Since the misrecognition generated during the user authentication process using the biometric information depends on the entropy of the input biometric information, the input biometric information is combined with user information that is not affected by external factors, and the information generated by the combining By encrypting, the entropy of the biometric information can be increased, and the probability of occurrence of a false recognition occurring in the user authentication process can be reduced.

Technical problems to be achieved by the present invention are not limited to the above-mentioned technical problems, and other technical problems not mentioned above may be clearly understood by those skilled in the art from the following description. There will be.

An electronic device according to various embodiments of the present disclosure may include a communication circuit, a biometric sensor, a processor operatively connected to the communication circuit and the biometric sensor, and the processor may include a first biometric user's first biometric device. Acquiring information, and generating second biometric information for authenticating the user based on a combination of the first biometric information and the unique information corresponding to the user, and wherein the authentication server is configured to generate the third biometric information of the user. The second biometric information may be configured to be transmitted to the authentication server using the communication circuit to authenticate the fourth biometric information generated based on the combination of the unique information with respect to the second biometric information.

An electronic device according to various embodiments of the present disclosure includes a communication circuit, a biometric sensor, a processor operatively connected to the communication circuit and the biometric sensor, and the processor requests execution of a function requiring biometric authentication of a user. Receiving, using the biometric sensor, obtaining first biometric information of the user, and generating second biometric information for authenticating the user based on a combination of the first biometric information and the unique information corresponding to the user. The second biometric information is transmitted to an authentication server, and the second biometric information indicates a signal indicating that the third biometric information of the user and the fourth biometric information generated based on the combination are authenticated. Received from the authentication server, and in response to receiving the signal may be set to execute the function.

By additionally combining the user's biometric information with the unique information based on the user's personal information, the false acceptance rate (FAR) of the user's biometric authentication can be reduced. In addition, by adjusting the combination ratio between the user's biometric information and the user's unique information according to the policy, it is possible to adjust the ratio of authentication by the same user as the false recognition rate (FAR).

1 is a block diagram of an electronic device in a network environment according to various embodiments of the present disclosure.
2 is a schematic diagram illustrating a user authentication system using biometric information according to various embodiments of the present disclosure.
3 is a block diagram of an electronic device according to various embodiments of the present disclosure.
4 is a block diagram of a processor according to various embodiments of the present disclosure.
5 is a diagram illustrating a data flow between a first electronic device, a second electronic device, and an authentication server according to various embodiments of the present disclosure.
6 is a diagram illustrating a method of registering biometric information in an authentication server in a first electronic device according to various embodiments of the present disclosure.
FIG. 7 is a diagram for describing a method of obtaining, by a first electronic device, a device independent biometric first biometric information according to various embodiments of the present disclosure; FIG.
8 is a diagram for describing a method of obtaining, by a first electronic device, second biometric information to be transmitted to an authentication server according to various embodiments of the present disclosure.
FIG. 9 is a diagram for describing a method of obtaining, by a first electronic device, second biometric information to be transmitted to an authentication server according to various embodiments of the present disclosure; FIG.
10 is a diagram for describing a method of obtaining, by a first electronic device, second biometric information to be transmitted to an authentication server according to various embodiments of the present disclosure.
FIG. 11 is a diagram for describing a method of authenticating, by a second electronic device, biometric information through an authentication server according to various embodiments of the present disclosure; FIG.
12 is a diagram illustrating a method of differently adjusting a coupling ratio according to an attribute of a function to be performed by a second electronic device according to various embodiments of the present disclosure.
FIG. 13 is a diagram for describing a method of obtaining, by a second electronic device, fourth biometric information to be transmitted to an authentication server according to various embodiments of the present disclosure; FIG.
14 is a diagram illustrating signaling between a first electronic device and a plurality of external servers including an authentication server according to various embodiments of the present disclosure.
FIG. 15 is a diagram illustrating signaling between a second electronic device and a plurality of external servers including an authentication server according to various embodiments of the present disclosure.
FIG. 16 is a diagram for describing a plurality of cases that may occur when the same user combines biometric information and unique information according to a first combining ratio in different devices according to various embodiments of the present disclosure.
FIG. 17 is a diagram for describing a plurality of cases that may occur when the same user combines biometric information and unique information according to a second combining ratio in different devices according to various embodiments of the present disclosure.
FIG. 18 is a diagram illustrating a case where authentication fails when different users combine biometric information and unique information according to a first combining ratio in different devices according to various embodiments of the present disclosure.
19 is a schematic diagram illustrating a user authentication system using biometric information according to various embodiments of the present disclosure.
20 is a diagram illustrating an operation of registering a reference image with respect to a verification server in a first electronic device according to various embodiments of the present disclosure.
FIG. 21 is a diagram illustrating an operation of registering biometric information with a verification server in a second electronic device according to various embodiments of the present disclosure. Referring to FIG.
22 is a diagram illustrating a user interface of the first electronic device 1910 according to various embodiments of the present disclosure.
FIG. 23 is a diagram illustrating a user interface of a second electronic device 1920 according to various embodiments of the present disclosure.
In connection with the description of the drawings, the same or similar reference numerals may be used for the same or similar components.

1 is a block diagram of an electronic device 101 in a network environment 100, according to various embodiments. Referring to FIG. 1, in the network environment 100, the electronic device 101 communicates with the electronic device 102 through a first network 198 (eg, a short-range wireless communication network) or the second network 199. The electronic device 104 may communicate with the server 108 through a long range wireless communication network. According to an embodiment of the present disclosure, the electronic device 101 may communicate with the electronic device 104 through the server 108. According to an embodiment, the electronic device 101 may include a processor 120, a memory 130, an input device 150, an audio output device 155, a display device 160, an audio module 170, and a sensor module. 176, interface 177, haptic module 179, camera module 180, power management module 188, battery 189, communication module 190, subscriber identification module 196, or antenna module 197. ) May be included. In some embodiments, at least one of the components (for example, the display device 160 or the camera module 180) may be omitted or one or more other components may be added to the electronic device 101. In some embodiments, some of these components may be implemented in one integrated circuit. For example, the sensor module 176 (eg, fingerprint sensor, iris sensor, or illuminance sensor) may be implemented embedded in the display device 160 (eg, display).

The processor 120, for example, executes software (eg, the program 140) to execute at least one other component (eg, hardware or software component) of the electronic device 101 connected to the processor 120. It can control and perform various data processing or operations. According to one embodiment, as at least part of the data processing or operation, the processor 120 may transmit the command or data received from another component (eg, the sensor module 176 or the communication module 190) to the volatile memory 132. Can be loaded into, processed in a command or data stored in volatile memory 132, and stored in the non-volatile memory (134). According to an embodiment, the processor 120 may include a main processor 121 (eg, a central processing unit or an application processor), and a coprocessor 123 (eg, a graphics processing unit, an image signal processor) that may be operated independently or together. , Sensor hub processor, or communication processor). Additionally or alternatively, the coprocessor 123 may be set to use lower power than the main processor 121 or to be specialized for its designated function. The coprocessor 123 may be implemented separately from or as part of the main processor 121.

 The coprocessor 123 may, for example, replace the main processor 121 while the main processor 121 is in an inactive (eg, sleep) state, or the main processor 121 may be active (eg, execute an application). At least one of the components of the electronic device 101 (eg, the display device 160, the sensor module 176, or the communication module 190) together with the main processor 121 while in the) state. Control at least some of the functions or states associated with the. According to one embodiment, the coprocessor 123 (eg, an image signal processor or communication processor) may be implemented as part of other functionally related components (eg, camera module 180 or communication module 190). have.

The memory 130 may store various data used by at least one component (eg, the processor 120 or the sensor module 176) of the electronic device 101. The data may include, for example, software (eg, the program 140) and input data or output data for a command related thereto. The memory 130 may include a volatile memory 132 or a nonvolatile memory 134.

In one embodiment, at least one processor (eg, processor 120 or coprocessor 123) or memory 130 may be divided into two or more regions that are distinguished from each other. The two or more areas may be logically separated from each other (eg, in security attributes or access rights) or may be physically separated. For example, the at least one processor or memory 130 may be secured with a first zone (eg, Normal World) for executing general purpose software, such as the TrustZone. This may be divided into a second area (eg, Secure World) for executing the necessary software.

The program 140 may be stored as software in the memory 130, and may include, for example, an operating system 142, middleware 144, or an application 146.

The input device 150 may receive a command or data to be used for a component (for example, the processor 120) of the electronic device 101 from the outside (for example, a user) of the electronic device 101. The input device 150 may include, for example, a microphone, a mouse, or a keyboard.

The sound output device 155 may output a sound signal to the outside of the electronic device 101. The sound output device 155 may include, for example, a speaker or a receiver. The speaker may be used for general purposes such as multimedia playback or recording playback, and the receiver may be used to receive an incoming call. According to one embodiment, the receiver may be implemented separately from or as part of a speaker.

The display device 160 may visually provide information to the outside (eg, a user) of the electronic device 101. The display device 160 may include, for example, a display, a hologram device, or a projector and a control circuit for controlling the device. According to an embodiment of the present disclosure, the display device 160 may include touch circuitry configured to sense a touch, or a sensor circuit (eg, a pressure sensor) set to measure the strength of the force generated by the touch. have.

The audio module 170 may convert sound into an electric signal or, conversely, convert an electric signal into a sound. According to an embodiment of the present disclosure, the audio module 170 may acquire a sound through the input device 150, or may output an external electronic device (for example, a sound output device 155 or directly or wirelessly connected to the electronic device 101). Sound may be output through the electronic device 102 (eg, a speaker or a headphone).

The sensor module 176 detects an operating state (eg, power or temperature) of the electronic device 101, or an external environmental state (eg, a user state), and generates an electrical signal or data value corresponding to the detected state. can do. According to an embodiment of the present disclosure, the sensor module 176 may include, for example, a gesture sensor, a gyro sensor, an air pressure sensor, a magnetic sensor, an acceleration sensor, a grip sensor, a proximity sensor, a color sensor, an infrared sensor, a biometric sensor, It may include a temperature sensor, a humidity sensor, or an illuminance sensor.

The interface 177 may support one or more designated protocols that may be used for the electronic device 101 to be directly or wirelessly connected to an external electronic device (for example, the electronic device 102). According to an embodiment of the present disclosure, the interface 177 may include, for example, a high definition multimedia interface (HDMI), a universal serial bus (USB) interface, an SD card interface, or an audio interface.

The connection terminal 178 may include a connector through which the electronic device 101 may be physically connected to an external electronic device (eg, the electronic device 102). According to an embodiment, the connection terminal 178 may include, for example, an HDMI connector, a USB connector, an SD card connector, or an audio connector (eg, a headphone connector).

The haptic module 179 may convert an electrical signal into a mechanical stimulus (eg, vibration or movement) or an electrical stimulus that can be perceived by the user through tactile or kinetic senses. According to one embodiment, the haptic module 179 may include, for example, a motor, a piezoelectric element, or an electrical stimulation device.

The camera module 180 may capture still images and videos. According to an embodiment, the camera module 180 may include one or more lenses, image sensors, image signal processors, or flashes.

The power management module 188 may manage power supplied to the electronic device 101. According to an embodiment, the power management module 188 may be implemented, for example, as at least part of a power management integrated circuit (PMIC).

The battery 189 may supply power to at least one component of the electronic device 101. According to an embodiment, the battery 189 may include, for example, a non-rechargeable primary cell, a rechargeable secondary cell, or a fuel cell.

The communication module 190 may establish a direct (eg wired) communication channel or wireless communication channel between the electronic device 101 and an external electronic device (eg, the electronic device 102, the electronic device 104, or the server 108). Establish and perform communication over established communication channels. The communication module 190 may operate independently of the processor 120 (eg, an application processor) and include one or more communication processors supporting direct (eg, wired) or wireless communication. According to an embodiment, the communication module 190 may include a wireless communication module 192 (eg, a cellular communication module, a near field communication module, or a global navigation satellite system (GNSS) communication module) or a wired communication module 194 (eg, It may include a local area network (LAN) communication module, or a power line communication module. The corresponding communication module of these communication modules may be a first network 198 (e.g. a short range communication network such as Bluetooth, WiFi direct or infrared data association (IrDA)) or a second network 199 (e.g. cellular network, the Internet, or Communicate with external electronic devices via a telecommunications network, such as a computer network (eg, LAN or WAN). These various types of communication modules may be integrated into one component (eg, a single chip) or may be implemented by a plurality of components (eg, a plurality of chips) separate from each other. The wireless communication module 192 uses subscriber information (e.g., international mobile subscriber identifier (IMSI)) stored in the subscriber identification module 196 in a communication network such as the first network 198 or the second network 199. The electronic device 101 may be checked and authenticated.

The antenna module 197 may transmit or receive a signal or power to an external (eg, an external electronic device) or from the outside. According to one embodiment, the antenna module 197 may include one or more antennas, from which at least one antenna suitable for a communication scheme used in a communication network, such as a first network 198 or a second network 199, For example, it may be selected by the communication module 190. The signal or power may be transmitted or received between the communication module 190 and the external electronic device through the at least one selected antenna.

At least some of the components are connected to each other and connected to each other through a communication method between peripheral devices (eg, a bus, a general purpose input and output (GPIO), a serial peripheral interface (SPI), or a mobile industry processor interface (MIPI)). For example, commands or data).

 According to an embodiment of the present disclosure, the command or data may be transmitted or received between the electronic device 101 and the external electronic device 104 through the server 108 connected to the second network 199. Each of the electronic devices 102 and 104 may be a device of the same or different type as the electronic device 101. According to an embodiment of the present disclosure, all or part of operations executed in the electronic device 101 may be executed in one or more external devices among the external electronic devices 102, 104, or 108. For example, when the electronic device 101 needs to perform a function or service automatically or in response to a request from a user or another device, the electronic device 101 instead of executing the function or service itself. In addition to or in addition, one or more external electronic devices may be requested to perform at least a part of the function or the service. The one or more external electronic devices that receive the request may execute at least a part of the requested function or service, or an additional function or service related to the request, and transmit a result of the execution to the electronic device 101. The electronic device 101 may process the result as it is or additionally and provide the result as at least a part of the response to the request. To this end, for example, cloud computing, distributed computing, or client-server computing technology may be used.

2 is a schematic diagram illustrating a user authentication system using biometric information according to various embodiments of the present disclosure.

Referring to FIG. 2, a user authentication system 200 using biometric information may include a first electronic device 210, a second electronic device 220, and an authentication server 230 (eg, the server 108 of FIG. 1). It may include.

In an embodiment, the first electronic device 210 and the second electronic device 220 may be the electronic device 101 shown in FIG. 1.

In an embodiment, the first electronic device 210 and the second electronic device 220 may be electronic devices used by the same user 240.

According to an embodiment, the first electronic device 210 and the second electronic device 220 may be electronic devices owned by the same user based on the same time point. For example, the first electronic device 210 may be a smart phone, and the second electronic device 220 may be a tablet PC.

In another embodiment, the first electronic device 210 and the second electronic device 220 may not be owned by the same user based on the same viewpoint. For example, the user may replace his mobile terminal (eg, smart phone) from the first electronic device 210 to the second electronic device 220.

In an embodiment, the first electronic device 210 may register the user's biometric information with the authentication server 230 for the user's biometric authentication. According to an embodiment of the present disclosure, the first electronic device 210 may set biometric authentication for a specific function that may be performed by the first electronic device 210. In other words, when the first electronic device 210 is requested to execute the specific function, the first electronic device 210 may be configured to perform biometric authentication first and to execute the specific function only when the biometric authentication is successfully completed. In another embodiment, when the first electronic device 210 is requested to execute the specific function from another electronic device (eg, the second electronic device 220) different from the first electronic device 210, the first electronic device 210 performs biometric authentication. First, the authentication server 230 may be requested to execute the specific function only when the biometric authentication is successfully completed.

According to an embodiment of the present disclosure, the second electronic device 220 may transmit the biometric information of the user to the authentication server 230 and request authentication of the transmitted biometric information. In other words, the first electronic device 210 may be a device that transmits reference biometric information to be used for authentication of biometric information transmitted from another electronic device (eg, the second electronic device 220) to the authentication server 230. The second electronic device 220 may transmit the biometric data transmitted by the second electronic device 220 based on reference biometric information transmitted from another electronic device (eg, the first electronic device 210) to the authentication server 230. It may be a device for requesting authentication of the information to the authentication server 230.

According to an embodiment of the present disclosure, biometric information of a user registered in the authentication server 230 from the first electronic device 210 may be different from biometric information of a user requested to be authenticated from the second electronic device 220. This is because the same biometric information is not received every time even if the biometric information is received from the same user. However, the received biometric information itself is not transmitted to the authentication server 230, but the processed information based on the received biometric information (e.g., feature information extracted from the received biometric information) is stored in the authentication server ( Since the biometric information is transmitted to the electronic device 230, biometric information having the same value may be transmitted from the first electronic device 210 and the second electronic device 220 to the authentication server 230.

Hereinafter, the biometric information transmitted from the first electronic device 210 to the authentication server 230 is the second biometric information, and the biometric information transmitted from the second electronic device 220 to the authentication server 230 is the fourth biometric information. I will list. The first biometric information is biometric information used in the generation of the second biometric information, and the third biometric information is biometric information used in the generation of the fourth biometric information, which will be described below.

In an embodiment, the biometric information of the user may include at least one of a fingerprint image, a face image, an iris image, and voice data.

In one embodiment, the authentication server 230 is a device that performs authentication of the fourth biometric information received from the second electronic device 220 based on the second biometric information received from the first electronic device 210. Can be. The authentication server 230 may store the second biometric information received from the first electronic device 210 in the storage of the authentication server 230. The authentication server stores the authentication server 230 by mapping the second biometric information received from the first electronic device 210 with the user's unique information (or information paired with the user's unique information) or the user's account information. Can save to wealth. The authentication server 230 storing the second biometric information may receive the fourth biometric information and may authenticate the fourth biometric information by comparing the received fourth biometric information with the second biometric information. The authentication server 230 may authenticate the fourth biometric information based on a result of comparing the fourth biometric information with the second biometric information. The authentication server 230 may determine that the fourth biometric information is successfully authenticated only when the fourth biometric information and the second biometric information have the same value, and the difference between the fourth biometric information and the second biometric information is predetermined. It may be determined that the fourth biometric information has been successfully authenticated only when included within. The authentication server 230 may transmit the authentication result of the fourth biometric information to the second electronic device 220.

In one embodiment, the authentication server 230 may correspond to a particular function. A specific function may mean one distinct application. For example, when a user sets biometric authentication for execution of a messenger application, the first electronic device 210 may transmit second biometric information to a first authentication server corresponding to the messenger application. As another example, when a user sets biometric authentication for execution of a cloud application, the first electronic device 210 may transmit second biometric information to a second authentication server corresponding to the cloud application.

In another embodiment, a specific function may mean one command among various commands that can be implemented in one distinct application. For example, when the user sets biometric authentication for login in the bank application, the first electronic device 210 may transmit second biometric information for login to the first authentication server corresponding to the login in the bank application. For another example, when a user sets biometric authentication for money transfer in a bank application, the first electronic device 210 may transmit second biometric information for money transfer to a second authentication server corresponding to the money transfer in the bank application. . Of course, since the login and the transfer are all functions within the same bank application, the first electronic device 210 transmits the second biometric information for login and the second biometric information for the transfer to the authentication server corresponding to the bank application. It may be.

3 is a block diagram of an electronic device according to various embodiments of the present disclosure.

In an embodiment, the electronic device 300 may be any one of a first electronic device (eg, the first electronic device 210 of FIG. 2) or a second electronic device (eg, the second electronic device 220 of FIG. 2). It can be one.

In an embodiment, the electronic device 300 may include a wireless communication circuit 310, a biometric sensor 320 (eg, the sensor module 176 of FIG. 1), a memory 330 (eg, the memory 130 of FIG. 1). ), A camera 340 (eg, the camera module 180 of FIG. 1), a display 350 (eg, the display device 160 of FIG. 1), or a processor 120.

In an embodiment, the wireless communication circuit 310 may be used to transmit and receive data between the electronic device 300 and an external device (eg, the authentication server 230 of FIG. 2). For example, the wireless communication circuit 310 may include or be at least a portion of a communication module (communication module 190 of FIG. 1). In an embodiment of the present disclosure, the electronic device 300 may transmit data generated by or stored in the electronic device 300 to the external device using the wireless communication circuit 310, and may be transmitted from the external device. Command or data can be received. For example, the first electronic device 210 generates second biometric information to be transmitted to the authentication server (for example, the authentication server 230 of FIG. 2), and transmits the generated second biometric information to the wireless communication circuit 310. It can be transmitted to the authentication server 230 by using. As another example, the second electronic device 220 transmits the fourth biometric information to be transmitted to the authentication server 230 to the authentication server 230, and then the fourth biometric information is successfully authenticated from the authentication server 230. An indication message may be received using the wireless communication circuit 310.

In one embodiment, the biometric sensor 320 may sense (or obtain) biometric information of the user. In an embodiment, the biometric sensor 320 may include at least one of a fingerprint sensor, a face recognition sensor, an iris sensor, and a microphone. For example, the fingerprint sensor may acquire a fingerprint image of the user as the biometric information of the user.

In an embodiment, the camera 340 may acquire an image of an external subject of the electronic device. For example, the camera 340 may acquire an image of the ID card including the user's unique identification information based on the user's manipulation.

In one embodiment, the display 350 may visually provide information to the outside of the electronic device. For example, when the second electronic device 220 receives information from the authentication server 230 indicating that authentication of the fourth biometric information is successfully completed, the second electronic device 220 indicates that the authentication of the fourth biometric information has been successfully completed. May be displayed on the display 350.

In one embodiment, the memory 330 is a command for an operation or function to be performed by the electronic device 300, or generated by the electronic device or from an external (eg, user) or external device (eg, the authentication server 230). You can save the received data. For example, the memory 300 may store the biometric information of the user acquired through the biometric sensor 320 or store the first biometric information or the second biometric information obtained by processing the acquired biometric information. have.

In one embodiment, the processor 120 may control the overall operation of the electronic device 300. For example, the processor 120 may generate or acquire first biometric information as device independent biometric information based on biometric information of a user acquired through the biometric sensor 320. For another example, the processor 120 may generate or obtain second biometric information based on a combination of the first biometric information and the unique information corresponding to the user.

4 is a block diagram of a processor according to various embodiments of the present disclosure.

Referring to FIG. 4, the processor 120 may include a device independent biometric information generator 410, a unique information combiner 420, and a converter 430.

The device independent biometric information generator 410 may generate the device independent biometric information based on the biometric information of the user received through the biometric sensor (eg, the biometric sensor 320 of FIG. 3). The device independent biometric information may be biometric information in which sensor-specific deviations according to hardware or software specifications of the biometric sensors 320 included in the electronic device (for example, the electronic device 300 of FIG. 3) are removed. Hereinafter, the device independent biometric information may be described as first biometric information or third biometric information.

In one embodiment, the device independent biometric information generation unit may communicate with an external server to remove the sensor-specific deviation from the biometric information of the user received through the biometric sensor 320. For example, the device independent biometric information generating unit may receive data for removing a sensor-specific deviation from a device independent server (hereinafter, referred to below).

In another embodiment, the device independent biometric information generation unit may receive data for removing a sensor-specific deviation from a memory.

The unique information combiner 420 may combine identity information corresponding to the user with the first biometric information (or third biometric information). In one embodiment, the unique information corresponding to the user may be a user's name, gender, or information identifying the user (eg, a social security number in Korea, or a social security number in the United States). In one embodiment, the unique information corresponding to the user may be image information obtained by photographing a physical object (for example, a Korean resident registration card or a US driver's license, etc.) containing information for identifying a user. The unique information corresponding to the user may mean a digital ID.

In an embodiment, the unique information combiner 420 may communicate with an external server to obtain unique information corresponding to the user. For example, the unique information combiner 420 may obtain the unique information corresponding to the user from an identification server (hereinafter, referred to as an identification server). The unique information combiner may transmit information of a subscriber identity module (SIM) card installed in (or mounted on) the electronic device 300 to an ID server, and receive unique information of a user corresponding to the SIM card from the ID server. .

In one embodiment, the unique information combining unit 420 may combine the information obtained from the ID server with the first biometric information (or third biometric information), and from the information obtained from the ID server, a feature value ) May be extracted and the extracted feature value may be combined with the first biometric information. In another embodiment, the unique information combiner 420 may receive a feature value extracted from the unique information of the user from the ID server.

The conversion unit 430 converts the combination of the first biometric information and the unique information corresponding to the user, so that the first electronic device (eg, the first electronic device 210 of FIG. 2) is connected to the authentication server (eg, FIG. Information to be transmitted to the authentication server 230 of FIG. 2. Information to be transmitted by the first electronic device 210 to the authentication server 230 may be described as second biometric information. The conversion unit 430 converts the combination of the third biometric information and the unique information corresponding to the user, so that the second electronic device (eg, the second electronic device 220 of FIG. 2) is connected to the authentication server 230. Information to be transmitted can be generated. Information to be transmitted to the authentication server 230 by the second electronic device 220 may be described as fourth biometric information.

In an embodiment, the transform unit 430 may generate second biometric information by performing a one-way transform on the combined information. For example, unidirectional transformation may include bio-hashing or key extraction methods in a broad sense.

In one embodiment, the conversion unit 430 performs a one-way conversion on the combined information, thereby generating a biometric unique feature value or a unique key as the second biometric information. Can be. When a unique key is generated as the second biometric information, a public key / unique key algorithm can be used.

5 is a diagram illustrating a data flow between a first electronic device, a second electronic device, and an authentication server according to various embodiments of the present disclosure.

Referring to FIG. 5, a user authentication method using biometric information according to various embodiments of the present disclosure may be largely divided into a registration process and an authentication process. The registration process is performed between the first electronic device (eg, the first electronic device 210 of FIG. 2) and the authentication server (eg, the authentication server 230 of FIG. 3), and the authentication process is performed by the second electronic device (eg: It may be made between the second electronic device 220 and the authentication server 230 of FIG. 2. As described above, the registration process and the authentication process may be performed by the same user although the devices are different. Hereinafter, the registration process and the authentication process will be described separately. In the description of FIG. 5, the member numbers of the respective components included in the first electronic device 210 and the second electronic device 220 include an index 1 or 2 for distinguishing a device including the components. It is. For example, the member number 320-1 is assigned to the biometric sensor of the first electronic device 210 and 320-2 to the biometric sensor of the second electronic device 220.

The registration process may be initiated or triggered by a user's input of the first electronic device 210. The first electronic device 210 may be started or triggered by an input of a user associated with a specific function (or indicating a specific function). For example, the first electronic device 210 may receive a user input for requesting to execute a specific function. As another example, the first electronic device 210 may receive a user input for setting biometric authentication to a specific function. That is, when the first electronic device 210 is requested to execute a specific function in the future, the first electronic device 210 may request a biometric authentication and receive a user input requesting to execute the specific function only when the biometric authentication is successfully completed. .

In an embodiment, the biometric information of the user registered in the registration process may correspond to the specific function. For example, the biometric information registered in the authentication server 230 in correspondence with the first function is different from the biometric information registered in the authentication server 230 in response to the second function (eg, generated in a different manner or in different combination ratios). Can be created based on As another example, the biometric information for setting biometric authentication to the first function may be stored in a first authentication server corresponding to the first function, and the biometric information for setting biometric authentication to the second function may be a second function. It may be stored in the second authentication server corresponding to the.

In one embodiment, execution of a specific function may mean execution of an individual application (eg, a shopping application, a cloud application, etc.) installed in the electronic device, and during execution of the individual application installed in the electronic device, It may also mean the execution of one of several commands (eg, payment within a shopping application) that can be implemented in. For example, the first electronic device 210 receives a user input requesting to release a lock mode (eg, sleep mode including a power saving mode, display lock mode, etc.) only when biometric authentication is successfully completed in the future. In response to this, the registration process of the user's biometric information may be started. For another example, the first electronic device 210 may initiate a registration process of the user's biometric information in response to receiving a user input requesting to execute a shopping application only when biometric authentication is successfully completed in the future.

According to an embodiment of the present disclosure, the first electronic device 210 may receive a user input for determining a personality (or characteristic) of biometric authentication to be set for a specific function. Although details will be described later, the nature of biometric authentication may vary according to a combination ratio of the first biometric information and the unique information corresponding to the user. For example, when the relative ratio of the first biometric information is increased, biometric authentication with the biometric information highlighted may be set. For example, when the relative ratio of the unique information corresponding to the user is increased, biometric authentication in which the unique information corresponding to the user is emphasized may be set. The first electronic device 210 may receive a user input indicating which of the biometric information and the unique information to set biometric authentication further emphasized with respect to the specific function. For example, the first electronic device 210 may receive a user input for requesting to set biometric authentication considering only about 100% biometric information for the payment function of the shopping application. As another example, the first electronic device 210 may request to set biometric authentication reflecting about 80% of biometric information and reflecting about 20% of unique information corresponding to a user, for execution of a shopping application. Can be received. In another embodiment, the first electronic device 210 may combine the first biometric information and the unique information corresponding to the user according to a default combining ratio (for example, 5: 5) regardless of a user input.

In an embodiment, the registration process may be initiated by the first electronic device 210 regardless of a user input. For example, the registration process may be started in the process of setting out of box of the first electronic device 210.

In an embodiment of the present disclosure, the first electronic device 210 may receive biometric information of the user through the biometric sensor 320-1 in response to receiving a user input associated with a specific function. The first electronic device 210 may activate the deactivated biometric sensor 320-1 or output a message notifying the user that the biometric information of the user is ready to be obtained.

In an embodiment, the biometric information of the user received through the biometric sensor 320-1 may be transferred to the processor 120-1 or the device independent biometric information generator 410-1. The processor 120-1 or the device independent biometric information generating unit 410-1 may receive data for removing a deviation for each sensor from the DI server 510.

In one embodiment, the DI server 510 may be connected with a plurality of client devices. The D1 server 510 may receive a data request for correcting biometric information from at least one client device and provide requested data in response to receiving the data request. Here, the correction of the biometric information may mean the removal of the deviation according to the device-specific characteristics of the biometric sensor included in each device. The DI server 510 may include a database that stores data mapped to a plurality of client devices or to biometric sensors included in the plurality of client devices. The data mapped to the plurality of electronic devices or the biometric sensors included in the plurality of electronic devices includes parameter data for removing deviations according to device-specific characteristics (ie, hardware or software specifications) of the biometric sensors. can do.

In one embodiment, the device independent biometric information generation unit 410-1 uses the biometric information of the user received from the biometric sensor 320-1 and the data received from the DI server 510 as device independent biometric information. The first biometric information may be generated. The device independent biometric information generator 410-1 may generate the first biometric information by applying the data received from the DI server 510 to the biometric information of the user received from the biometric sensor 320-1. The first biometric information generated by the device independent biometric information generator 410-1 may be transferred to the unique information combiner 420-1.

In an embodiment, the unique information combiner 420-1 may concatenate the first biometric information with the unique information corresponding to the user. The unique information combiner 420-1 may obtain unique information corresponding to the user from the ID server 520. In an embodiment, the unique information combiner 420-1 may obtain the unique information itself corresponding to the user from the ID server 520, and from the unique information corresponding to the user, from the ID server 520. The extracted feature value may be received. For example, the unique information combiner 420-1 may obtain random bit information generated by using the unique information corresponding to the user as a seed, from the ID server 520. When the unique information itself corresponding to the user is obtained from the ID server 520, the feature value may be extracted from the information acquired by the unique information combiner 420-1.

The unique information combiner 420-1 may transmit a signal for requesting unique information to the ID server 520 before obtaining the unique information. The signal for requesting the unique information includes at least one of information related to a subscriber identity module installed in the first electronic device 210 and an image (eg, an image of a physical ID card) stored in the memory 330-1. It may include.

The unique information combiner 420-1 may transmit information in which the first biometric information and the unique information are combined to the converter 430-1.

In one embodiment, an identification server 520 may be connected with a plurality of client devices. The ID server 520 may receive, from at least one client device, a request for unique information corresponding to a user of the at least one client device and provide the requested data in response to receiving the request for the unique information. Can be. In one embodiment, the request for unique information may include information of a SIM card installed in at least one client device. For example, the ID server 520 may be a carrier server operated by a main carrier.

In one embodiment, the reason why the unique information combining unit 420-1 combines the unique information corresponding to the user with the first biometric information is that a misrecognition of biometric authentication is performed by the biometric information input for biometric authentication. Because it depends on entropy. The smaller the entropy of the biometric information input for biometric authentication, the higher the false recognition rate of biometric authentication. Therefore, when combining biometric information input for biometric authentication with information that is not externally affected (ie, unique information corresponding to a user), entropy of biometric information input for biometric authentication can be increased, As a result, the false recognition rate of biometric authentication can be reduced.

According to an embodiment, the conversion unit 430-1 may generate second biometric information to be transmitted to the authentication server 230 by converting the combination of the first biometric information and the unique information corresponding to the user. The conversion unit 430-1 may generate a unique biometric characteristic value or a unique key by performing a one-way transformation on the combined information. In one embodiment, when the conversion unit 430-1 generates a unique key, the hint data may be generated together. In one embodiment, the hint data generated during the registration process may be used as the base data in restoring the same key during the authentication process.

In an embodiment, the second biometric information generated by the converter 430-1 may be transmitted to the authentication server 230. The hint data may be additionally transmitted to the authentication server 230 according to the generation method of the second biometric information. In one embodiment, account information of the user may be additionally transmitted to the authentication server 230. The account information of the user may be transmitted to the authentication server 230 separately from the second biometric information (or hint data). For example, the account information of the user may be transmitted to the authentication server 230 before receiving the biometric information through the biometric sensor.

In an embodiment, the second biometric information may be stored in the storage 530 of the authentication server 230. The second biometric information may be stored in the storage unit 530 of the authentication server 230 by mapping the user's unique information (or information paired with the user's unique information) or the user's account information. The second biometric information may be stored in the storage unit 530 of the authentication server 230 in addition to the user's unique information and the like by mapping with the specific function related to the start of the registration process. The second biometric information is stored in the storage unit 530 of the authentication server 230 by mapping the second biometric information to information about a coupling ratio associated with the second biometric information (or used in the generation of the second biometric information) in addition to the user's unique information. ) Can be stored. The second biometric information stored in the storage unit 530 may be provided to the matching unit 540 to determine whether to authenticate the fourth biometric information transmitted from the second electronic device 220.

The authentication process may be initiated or triggered by an input of a user who uses the second electronic device 220. The second electronic device 220 may be started or triggered by a user input associated with a specific function (or indicating a specific function). For example, the second electronic device 220 may receive a user input for executing a shopping application or a cloud application. As another example, the second electronic device 220 may input a user input for requesting payment of a specific product in a running shopping application, or a user input for requesting download of data stored in a cloud server in a running cloud application. May be received.

In an embodiment of the present disclosure, the second electronic device 220 that receives the user input may attempt to connect to an external server (eg, the authentication server 230) corresponding to the specific function. The second electronic device 220 may transmit user account information corresponding to the user of the second electronic device 220 to the authentication server 220. For example, the second electronic device 220 which has received a user input for executing a shopping application, may display the authentication server 230 corresponding to the execution of the shopping application in order to display an initial screen or an initial user interface of the shopping application. You can try to connect.

In an embodiment of the present disclosure, the second electronic device 220 that receives the user input attempts to connect to an external server (or an authentication server 230) corresponding to the specific function, and the external server (or an authentication server ( 230), it may be requested to perform biometric authentication first. For example, the authentication server 230 confirms that the biometric authentication is set from the first electronic device 210 when the specific function is executed, and performs the biometric authentication on the second electronic device 220 first. You can send a message asking you to do so.

According to an embodiment of the present disclosure, the message transmitted to the second electronic device 220 by the authentication server 230 may include information about a combination ratio of biometric information and unique information corresponding to a user. For example, the authentication server 230 retrieves an item corresponding to the specific function and the user account information from the storage unit 530 of the authentication server 230, thereby combining biometric information and unique information corresponding to the user. The information on the ratio may be checked and the confirmed information may be transmitted to the second electronic device 220.

In an embodiment, the combining ratio of the biometric information and the unique information corresponding to the user may be determined during the registration process. The combination ratio of the biometric information and the unique information corresponding to the user may be determined based on a user input during registration, or based on an attribute of the specific function.

In an embodiment, the second electronic device 220 receives the biometric information of the user through the biometric sensor 320-2 in response to receiving a message requesting to first perform biometric authentication from the authentication server 230. can do. In another embodiment, the second electronic device 220 may obtain biometric information of the user based on the information stored in the memory 330-2. For example, the information stored in the memory 330-2 may be biometric information used for internal authentication (eg, authentication for unlocking a lock screen) of the second electronic device 220. The second electronic device 220 compares the biometric information of the user received through the biometric sensor with the biometric information stored in the memory 330-2 and if the difference is within a specified range, the memory 330-. Information stored in 2) (that is, biometric information used for internal authentication of the second electronic device 220) may be provided to the device independent biometric information generation unit 410-2 or the unique information combining unit 420-2. have.

In one embodiment, the device independent biometric information generation unit 410-2 uses the biometric information of the user received from the biometric sensor 320-2 and the data received from the DI server 510 as device independent biometric information. The third biometric information may be generated.

In an embodiment, the unique information combiner 420-2 may combine the third biometric information with the unique information corresponding to the user.

In an embodiment, the conversion unit 430-2 may generate fourth biometric information to be transmitted to the authentication server 230 by converting the combination of the third biometric information and the unique information corresponding to the user. The conversion unit 430-2 may generate a unique biometric characteristic value or a unique key by performing a one-way transformation on the combined information. In an embodiment, the conversion unit 430-2 may receive the hint data corresponding to the user from the authentication server 230 before generating the fourth biometric information. The conversion unit 430-2 may generate fourth biometric information to be transmitted to the authentication server 230 more quickly by using the received hint data.

In an embodiment, the conversion unit 430-2 may transmit the fourth biometric information to the authentication server 230. For example, when the biometric characteristic value is generated as the fourth biometric information, the conversion unit 430-2 may transmit the biometric characteristic value to the authentication server 230. For another example, the conversion unit 430-2 may derive a public key and a unique key from the biometric unique feature value, and transmit the digitally signed information to the authentication server 230 using the unique key.

In an embodiment, the authentication server 230 that receives the fourth biometric information may determine whether to authenticate the fourth biometric information by using the second biometric information. The authentication server 230 may authenticate the fourth biometric information with respect to the second biometric information. In one embodiment, the authentication server 230 may authenticate the fourth biometric information based on a result of comparing the second biometric information with the fourth biometric information. For example, the authentication server 230 may determine that the fourth biometric information is successfully authenticated with respect to the second biometric information only when the fourth biometric information is the same as the second biometric information. For another example, the authentication server 230 may determine that the fourth biometric information has been successfully authenticated with respect to the second biometric information only when the difference between the fourth biometric information and the second biometric information is included in the specified range.

6 is a diagram illustrating a method of registering biometric information in an authentication server in a first electronic device according to various embodiments of the present disclosure.

6 may be performed by a first electronic device (eg, the first electronic device 210) or a processor (eg, the processor 120-1) of the first electronic device. Hereinafter, the operations disclosed in FIG. 6 will be described as being performed by the first electronic device 210.

The operations disclosed in FIG. 6 may be performed on a second area for executing software requiring security.

In operation 610, the first electronic device 210 may obtain first biometric information of the user using a biometric sensor (eg, the biometric sensor 320-1 of FIG. 3). In an embodiment, the first biometric information may be information in which the deviation of each sensor is removed from the biometric information of the user received through the biometric sensor 320-1.

Although not shown, the first electronic device 210 may receive a user input associated with a specific function before obtaining the first biometric information. For example, when the first electronic device 210 is subsequently requested to execute a specific function, the first electronic device 210 may receive a user input requesting biometric authentication and requesting to execute the specific function only when the biometric authentication is successfully completed. Can be. Upon receiving the user input, the first electronic device 210 may activate the biometric sensor 320-1 which has been deactivated, or output a message such as "Please contact your thumb with the fingerprint sensor" on the display. .

In operation 620, the first electronic device 210 may obtain unique information corresponding to the user. In one embodiment, the first electronic device 210 provides information on the SIM card installed in the first electronic device 210 to the ID server, and from the ID server (for example, the ID server 520 of FIG. Unique information of the user corresponding to the card may be obtained. For example, the first electronic device 210 may obtain, from the ID server 520, at least one piece of unique information of a user's name, social security number, gender, and age corresponding to the SIM card. According to another embodiment, the first electronic device may obtain unique information corresponding to the user based on the information acquired using the sensor. For example, the first electronic device may photograph a physical ID card including the user's unique identification information with a camera and acquire the user's unique information using the captured image. For example, the first electronic device may obtain unique information corresponding to the user from the captured image by using the OCR technique. According to another embodiment, the first electronic device may obtain unique information corresponding to the user by using information related to the IP address of the first electronic device.

In operation 630, the first electronic device 210 obtains second biometric information for authenticating the user based on a combination of the first biometric information and the unique information (or a feature value extracted from the unique information). can do. According to an embodiment of the present disclosure, the first electronic device 210 may acquire the second biometric information by combining the first biometric information and the unique information at a predetermined ratio and performing unidirectional transformation on the combined information.

In an embodiment of the present disclosure, the first electronic device 210 combines the first biometric information and the unique information in one designated ratio and performs unidirectional transformation on the combined information to thereby convert one second biometric information. Can be obtained.

In another embodiment, the first electronic device 210 combines the first biometric information and the unique information in a plurality of specified ratios, and performs unidirectional transformation on the combined information to thereby convert the plurality of second biometric information. Can also be obtained. For example, the first biometric information and the unique information are respectively determined by a plurality of predetermined combination ratios (eg, 0:10, 1: 9, 2: 8 to 8: 2, 9: 1, and 10: 0). And a plurality of second biometric information may be obtained by performing unidirectional transformation on the combined information.

In operation 640, the first electronic device 210 may transmit the second biometric information to an authentication server (eg, the authentication server 230 of FIG. 2). In operation 640, when the first electronic device 210 transmits the second biometric information to the authentication server 230, the authentication server 230 may transmit the fourth biometric information of the user obtained from another electronic device. This is for enabling the authentication of the second biometric information. The fourth biometric information may be information generated based on a combination of the biometric information of the user received from the biometric sensor of the other electronic device and the unique information of the user. That is, the first electronic device 210 may transmit the second biometric information to the authentication server 230 so that the second biometric information is used as a reference for authentication of the fourth biometric information. .

According to an embodiment of the present disclosure, the first electronic device 210 may additionally transmit information indicating a combination ratio of the first biometric information and the unique information to the authentication server 230. That is, the first electronic device 210 may transmit, to the authentication server 230, information indicating whether the second biometric information is generated based on the binding ratio.

According to an embodiment of the present disclosure, the first electronic device 210 may additionally transmit account information of the user to the authentication server 230.

According to an embodiment, the first electronic device 210 may receive a signal indicating that the second biometric information is registered in the authentication server 230 from the authentication server 230. For example, the first electronic device 210 may store information indicating that the authentication server 230 stores the second biometric information in association with the user's account information (or in association with the specific function), It may be received from the authentication server 230.

7 is a diagram for describing a method of obtaining, by a first electronic device, first biometric information as device independent biometric information according to various embodiments of the present disclosure.

7 is a detailed flowchart of operation 610 of FIG. 6.

In operation 710, the first electronic device 210 may receive biometric information of the user through the biometric sensor 320-1. For example, the first electronic device 210 may acquire a digital image of a user's fingerprint through a fingerprint sensor.

In operation 720, the first electronic device 210 may receive information from the DI server (eg, the DI server 510 of FIG. 5) to remove the sensor-specific deviation from the input biometric information. For example, the first electronic device 210 may use identification information (eg, international mobile equipment identity (IMEI) information) of the first electronic device 210 or a biometric information used to receive biometric information of the user in operation 710. After transmitting information (eg, model name, manufacturer, manufacturing version, etc.) of the sensor 320-1 to the DI server 510, information for removing the deviation for each sensor may be received from the DI information 510. have.

In operation 730, the first electronic device 210 may obtain first biometric information as device independent biometric information based on the received information. For example, the first electronic device 210 applies the data received from the DI server 510 to the biometric information of the user received from the biometric sensor 320-1, thereby providing the first biometric information as device independent biometric information. Can be obtained.

8 is a diagram for describing a method of obtaining, by a first electronic device, second biometric information to be transmitted to an authentication server according to various embodiments of the present disclosure.

8 is a detailed flowchart of operation 630 of FIG. 6.

In operation 810, the first electronic device 210 may combine the first biometric information and the unique information corresponding to the user at a specified ratio. In an embodiment, the designated ratio may mean a relative ratio between the length of the first biometric information and the length of the unique information.

According to an embodiment of the present disclosure, the first electronic device 210 may adjust the length of the unique information to combine the first biometric information and the unique information at a specified ratio. This is because unlike the identification information (eg, IMEI information) of the device having a fixed length of information, the unique information corresponding to the user can adjust the length of the information relatively flexibly.

In one embodiment, the specified ratio may be determined based on user input. The first electronic device 210 may receive a user input indicating which of the biometric information and the unique information to set biometric authentication further emphasized with respect to the specific function. For example, the first electronic device 210 may receive a user input for requesting to set biometric authentication considering only about 100% biometric information, regardless of the unique information corresponding to the user. As another example, the first electronic device 210 may receive a user input for requesting to set up biometric authentication reflecting about 80% of biometric information and reflecting about 20% of unique information corresponding to a user.

In one embodiment, the specified ratio may be determined according to a specific application or an attribute of a specific function that may be performed within one application, regardless of the user's input.

In an embodiment, the property of the specific function may be at least one of content (or category) and importance, frequency of use, and preset security level of the specific function.

For example, when a user sets biometric authentication for execution of a messenger application, the combination ratio of the first biometric information and the unique information may be 5: 5. As another example, when a user sets biometric authentication for execution of a banking application, the combining ratio of the first biometric information and the unique information may be 8: 2. Since the messenger application corresponds to the "living" category, the banking application corresponds to the "financial" category, and the financial category is an application requiring more security than the living category, the ratio of biometric information may be increased.

In another example, when a user establishes biometric authentication for certain functions that can be performed within a shopping application, the combination of the first biometric information and the unique information for the ability to change the quantity of ordered items within the shopping application The ratio may be 5: 5. For another example, the combining ratio of the first biometric information and the unique information for the function of paying for the ordered item may be 8: 2. The ability to change the quantity of ordered goods is of intermediate importance for the purpose of "purchase of goods", and the ability to pay for ordered goods is a final step for the purpose of "buy goods", so it is relatively more important. The higher the rate of biometric information can be.

In operation 820, the first electronic device 210 may obtain second biometric information converted from the combined information. For example, the first electronic device 210 may obtain second biometric information by performing unidirectional transformation on the combined information.

The reason why the first electronic device 210 adjusts the ratio of the biometric-based information (for example, the first biometric information) and the personal information-based information (for example, the unique information corresponding to the user) may be due to the ratio. This corresponds to the rate of authentication by the same user as the recognition rate (FAR).

In an extreme example, when the first electronic device 210 combines the first biometric information and the unique information in a 0:10 ratio, authentication may be successful when the same personal information is verified regardless of the living body. This can lead to an improvement in the recognition rate. However, in this case, even if the same personal information is verified, it cannot be guaranteed 100% that the user is actually the same user (for example, if the son is using the father's smartphone), the weight of authentication by the same user will be reduced. There is no choice but to.

In another extreme example, when the first electronic device 210 combines the first biometric information and the unique information in a 10: 0 ratio, the terminal may be different from the user corresponding to the SIM of the first electronic device. Even in the terminal where the user's SIM is installed, authentication may succeed if only the biometric information is the same. In this case, since the biometric information is the same, authentication by the same user can be ensured. However, since the same information is not input every time due to the characteristics of the biometric information, the false recognition rate may not be improved.

In conclusion, the improvement of the false recognition rate and authentication by the same user are in a trade-off relationship with each other, which may be implemented according to the combined ratio of the first biometric information and the unique information for the user. Therefore, the combining ratio of the first biometric information and the unique information about the user may be changed according to the policy. Since the combining ratio of the first biometric information and the unique information is a matter of which the FAR improvement and the authentication by the same user are more important, the combining ratio is determined according to the attribute of the specific function requesting the biometric authentication. do. In addition, the coupling ratio may be determined according to user input.

FIG. 9 is a diagram for describing a method of obtaining, by a first electronic device, second biometric information to be transmitted to an authentication server according to various embodiments of the present disclosure; FIG.

9 is a detailed flowchart of operation 810 of FIG. 8.

In operation 910, the first electronic device 210 may determine a combination ratio of the first biometric information and the unique information based on the attribute of the function that requested the biometric authentication.

According to an embodiment, the function for requesting biometric authentication may mean a function associated with a user input received by the first electronic device 210 in operation 610. For example, when a user sets biometric authentication for execution of a messenger application, the function for requesting biometric authentication may mean execution of a messenger application.

In an embodiment, the attribute of the function that requested the biometric authentication may be at least one of the content (or category) and the importance, the frequency of use, and the preset security level of the function that requested the biometric authentication. The first electronic device 210 may determine one of a plurality of coupling ratios based on the property of the function for which the biometric authentication is requested. For example, the first electronic device 210 determines, with respect to the execution function of the shopping application, that the category of the shopping application corresponds to shopping (or finance), and thus, a plurality of combination ratios (eg, 0:10). , 1: 9, 2: 8? 8: 2, 9: 1, 10: 0). For another example, the first electronic device 210 may be configured to have the highest security level with respect to the execution function of the setting application that can change the setting of the first electronic device 210. As such, a binding ratio of 9: 1 may be determined among the plurality of binding ratios.

In operation 920, the first electronic device 210 may obtain second biometric information based on the determined coupling ratio. The first electronic device 210 may acquire the second biometric information by combining the first biometric information and the unique information at a determined combining ratio and converting the combined information in one direction.

10 is a diagram for describing a method of obtaining, by a first electronic device, second biometric information to be transmitted to an authentication server according to various embodiments of the present disclosure.

10 is a detailed flowchart of operation 820 of FIG. 8.

In operation 1010, the first electronic device 210 may obtain a biometric characteristic value or a unique key as second biometric information using the combined information.

According to an embodiment of the present disclosure, the first electronic device 210 may extract a biometric characteristic value from the combined information. In another embodiment, the first electronic device 210 may extract a unique key from the combined information through a method such as fuzzy extraction. According to another embodiment, the first electronic device 210 may extract a biometric unique feature value from the combined information and extract a unique key from the biometric unique feature value through a method such as fuzzy extraction.

In operation 1020, the first electronic device 210 may determine whether a unique key is obtained. When it is determined that the unique key is obtained, in operation 1030, the first electronic device 210 may obtain hint data. The hint data may be used as the base data in restoring the same key in the authentication process. That is, the second electronic device 220 may restore the same key by using the hint data.

In operation 1030, when it is determined that the unique key is not obtained, the first electronic device 210 may proceed to the next step without acquiring the hint data. In other words, the hint data can be obtained only when a unique key is obtained.

FIG. 11 is a diagram for describing a method of authenticating, by a second electronic device, biometric information through an authentication server according to various embodiments of the present disclosure; FIG.

The operations disclosed in FIG. 11 may be performed by a second electronic device (eg, the second electronic device 220) or a processor (eg, the processor 120-2) of the second electronic device. Hereinafter, operations described in FIG. 11 are performed by the second electronic device 220.

The operations disclosed in FIG. 11 may be performed on a second area for executing software requiring security.

In operation 1110, the second electronic device 220 may be requested to execute a function requiring biometric authentication of the user. For example, the second electronic device 220 may receive a user input for executing a function requiring biometric authentication of the user. For another example, the second electronic device 220 may be requested to execute a function requiring biometric authentication of a user according to a pre-stored reservation command. As another example, the second electronic device 220 may receive data (eg, a text message, a phone call, an update notification associated with an application installed on the second electronic device, etc.) from the outside, and thus, may require a user's biometric authentication. You may be asked to run it.

Whether the biometric authentication of the user is required to execute a specific function may be preset. For example, the user may preset to execute the messenger application only when the biometric authentication of the user is successfully completed. In another example, the user may pre-set the payment to the user's account within the shopping application only if the user's biometric authentication is successfully completed.

In operation 1120, the second electronic device 220 may obtain third biometric information of the user using a biometric sensor (eg, the biometric sensor 320-2 of FIG. 5). According to an embodiment, the third biometric information may be information in which the deviation of each sensor is removed from the biometric information of the user received through the biometric sensor 320-2.

In operation 1130, the second electronic device 220 may obtain unique information corresponding to the user. In an embodiment, the second electronic device 220 provides the ID server 520 with information of the SIM card installed in the second electronic device 220, and from the ID server 520 the user of the user corresponding to the SIM card. Unique information can be obtained. According to another embodiment, the second electronic device 220 may obtain unique information corresponding to the user based on the information obtained using the sensor. For example, the second electronic device may photograph the physical ID card including the user's unique identification information with a camera and acquire the user's unique information using the captured image. For example, the second electronic device 220 may obtain unique information corresponding to the user by using an optical character recognition (OCR) technique in the captured image.

In operation 1140, the second electronic device 220 may obtain fourth biometric information for authenticating the user based on the combination of the third biometric information and the unique information corresponding to the user. According to an embodiment of the present disclosure, the second electronic device 220 may acquire the fourth biometric information by combining the third biometric information and the unique information corresponding to the user at a specified ratio and performing unidirectional transformation on the combined information. have. According to an embodiment of the present disclosure, the second electronic device 220 receives information about a specific binding rate for generating the fourth biometric information from the authentication server 230 and then uses the third biometric information and the user at the specific binding rate. Unique information corresponding to may be combined.

In operation 1150, the second electronic device 220 may transmit the fourth biometric information to the authentication server 230. According to an embodiment, the second electronic device 220 may transmit the biometric characteristic value obtained by performing one-way conversion on the combined information to the authentication server 230. In another embodiment, the second electronic device 220 may derive the public key and the unique key from the bio-unique characteristic value, and transmit the digitally signed information to the authentication server 230 using the unique key.

According to an embodiment of the present disclosure, the second electronic device 220 additionally transmits, to the authentication server 230, information about a binding ratio associated with the fourth biometric information (that is, based on which binding ratio the fourth biometric information was generated). Can be.

In operation 1160, the second electronic device 220 may receive, from the authentication server 230, information indicating that the fourth biometric information is authenticated with respect to the second biometric information obtained from another electronic device. In an embodiment, the second biometric information may be information transmitted from the first electronic device 210 to the authentication server 230. For example, when the fourth biometric information and the second biometric information are biometric characteristic values, the second electronic device 220 may receive the fourth biometric information from the authentication server 230 and the fourth biometric information is the same as the second biometric information. Information indicating that the biometric information has been successfully authenticated with respect to the second biometric information may be received. For example, when the second biometric information is the public key and the fourth biometric information is electronically signed by the private key, the second electronic device 220 receives the authentication information from the authentication server 230. Information may also be received indicating that the information has been successfully verified.

In operation 1170, the second electronic device 220 may perform the function. According to an embodiment, in response to receiving information indicating that the fourth biometric information has been successfully authenticated with respect to the second biometric information, the second electronic device 220 may receive a second electronic device from the authentication server 230. 220 may perform the function. For example, the second electronic device 220 may execute a messenger application or approve a payment in a shopping application. For another example, the second electronic device 220 may download data corresponding to the user account to the second electronic device in the cloud application.

12 is a diagram illustrating a method of differently adjusting a coupling ratio according to an attribute of a function to be performed by a second electronic device according to various embodiments of the present disclosure.

Referring to FIG. 12A, the second electronic device 220 may receive a user input for requesting execution of a specific function (hereinafter, referred to as a first function) for which biometric authentication is set. For example, the second electronic device 220 may receive a user input for selecting an execution icon of a shopping application.

According to an embodiment of the present disclosure, the second electronic device 220 may confirm that biometric authentication is set for the execution of the first function and may provide a message for notifying the user to perform biometric authentication. For example, the second electronic device 220 may display a message 1210 such as "Try biometric authentication to run a shopping application". The message may be displayed as a pop-up window. The message may be provided in the form of a voice message. The second electronic device 220 may activate the biometric sensor 320-2 which has been deactivated.

According to an embodiment, the second electronic device 220 may generate fourth biometric information to be transmitted to the authentication server 230 using biometric information of the user received through the activated biometric sensor 320-2. The second electronic device 220 may generate fourth biometric information using the first coupling ratio. That is, the second electronic device 220 generates third biometric information as device independent biometric information by using the biometric information of the user received through the activated biometric sensor, and generates unique biometric information corresponding to the user at a first combining ratio. The fourth biometric information may be generated by combining and converting the combined information.

In an embodiment, the second electronic device 220 transmits the fourth biometric information to the authentication server 230, and the fourth biometric information is transmitted from the authentication server 230 to the second biometric information obtained from another electronic device. In response to receiving the information indicating that the user is authenticated, the shopping application may be executed.

Referring to FIG. 12B, the second electronic device 220 may receive a user input for requesting execution of a specific function (hereinafter, referred to as a second function) for which biometric authentication is set. For example, the second electronic device 220 may receive a user input for requesting payment of a specific product in the executed shopping application.

According to an embodiment of the present disclosure, the second electronic device 220 may confirm that the biometric authentication is set for the execution of the second function, and may provide a message for requesting the user to perform the biometric authentication. For example, the second electronic device 220 may display a message 1220 such as "Try biometric authentication to make a payment". The message may be displayed as a pop-up window. The message may be provided in the form of a voice message. The second electronic device may activate the biometric sensor that has been deactivated.

According to an embodiment, the second electronic device 220 may generate fourth biometric information to be transmitted to the authentication server 230 using biometric information of the user received through the activated biometric sensor 320-2. The second electronic device 220 may generate fourth biometric information using the second coupling ratio. That is, the second electronic device 220 generates third biometric information as device independent biometric information by using the biometric information of the user received through the activated biometric sensor, and generates unique biometric information corresponding to the user at a second combining ratio. The fourth biometric information may be generated by combining and converting the combined information.

In an embodiment, the second combining ratio may have a smaller ratio of unique information corresponding to the user in total than the first combining ratio. In other words, the ratio of the third biometric information may be greater. In one embodiment, the first binding ratio and the second binding ratio may be determined in the process of setting biometric authentication for the performance of the first function and the second function. The reason why the second combining ratio is set smaller than the ratio of the unique information relative to the first combining ratio is that the second function (the payment function within the shopping application) is the same as the user's identity than the first function (the shopping application execution function). This is because this is a more strongly requested feature. That is, the user may provide information related to the bonding ratio in the setting process, and the second electronic device may determine the bonding ratio based on the information provided in the setting process, and generate the fourth biometric information at the determined bonding ratio. .

The second electronic device 220 may generate fourth biometric information at different coupling ratios to execute different functions (or different applications) corresponding to the same category (eg, shopping or finance). have. The second electronic device 220 may determine the coupling ratio for generating the fourth biometric information by searching metadata of an application installed in the second electronic device 220. The second electronic device 220 determines a coupling ratio for generating the fourth biometric information based on data received from an external device (eg, a server) related to a function (or service) to be executed by the second electronic device 220. It may be.

FIG. 13 is a diagram for describing a method of obtaining, by a second electronic device, fourth biometric information to be transmitted to an authentication server according to various embodiments of the present disclosure; FIG.

FIG. 13 is a detailed flowchart of operation 1140 of FIG. 11.

In operation 1310, the second electronic device 220 may combine the third biometric information and the unique information corresponding to the user at a specified ratio.

According to an embodiment, in operation 1310, the second electronic device 220 may include information on a combining ratio at which the third biometric information and the unique information corresponding to the user are combined from the authentication server 230 corresponding to the function requested to be executed. Can be received. The second electronic device 220 may combine the third biometric information with the unique information based on the received information.

In another embodiment, the second electronic device 220 does not receive the information on the coupling ratio from the authentication server 230 or the third biometric device has a coupling ratio different from the coupling ratio included in the information received from the authentication server. You can also combine information with unique information. For example, the first electronic device 210 acquires the plurality of second biometric information by combining the first biometric information and the unique information with a plurality of predetermined combination ratios, and performing unidirectional transformation on the combined information. This can be registered in the authentication server 230. Although the second electronic device 220 receives the information on the first coupling ratio (eg, 2: 8) from the authentication server 230, the second electronic device 220 may be different from the first coupling ratio according to the current situation of the second electronic device. The third biometric information and the unique information may be combined in a ratio (eg 3: 7). The current situation of the second electronic device 210 may be related to a radio access technology (RAT) property of a communication network connected between the second electronic device 220 and the authentication server 230, whether or not it is public Wi-Fi. For example, when the second electronic device 220 is connected to the authentication server 230 through a public Wi-Fi network, which is relatively less secure than LTE, the second electronic device 220 may have biometric information rather than the first coupling ratio. The third biometric information and the unique information may be combined at a second combining ratio in which the ratio of R is increased.

In operation 1320, the second electronic device 220 may receive hint data for extracting a biometric characteristic value from the combined information. The hint data can be used as the basis data in recovering the same key of the authentication process. Although not shown, when the account information input from the second electronic device 220 is account information not stored in the database of the authentication server 230, the authentication server 230 may provide hint data to the second electronic device 220. May not be provided to.

In operation 1330, the second electronic device 220 may obtain fourth biometric information converted from the combined information. According to an embodiment of the present disclosure, the second electronic device 220 may convert the fourth biometric information from the combined information by using the hint data. In an embodiment, the fourth biometric information may be the same as the second biometric information transmitted to the authentication server 230 during the registration process. In another embodiment, the difference between the fourth biometric information and the second biometric information may be within a preset value.

14 is a diagram illustrating signaling between a first electronic device and a plurality of external servers including an authentication server according to various embodiments of the present disclosure.

Referring to FIG. 14, the plurality of external servers may include a DI server 510, an ID server 520, and an authentication server 230.

In operation 1410, the first electronic device 210 may receive biometric information of the user through the biometric sensor. Although not shown, the first electronic device 210 may receive a user input for setting biometric authentication to a specific function before receiving the biometric information of the user through the biometric sensor 320-1. In addition, the first electronic device 210 may receive a user input for determining the nature (or characteristic) of the biometric to be set for the specific function.

In operation 1420, the first electronic device 210 may transmit device information (or identification information) of the first electronic device 210 to the DI server 510. For example, the first electronic device 210 may transmit IMEI information of the first electronic device 210 to the DI server 510.

In operation 1430, the DI server 510 may transmit DI data to the first electronic device 210. In an embodiment of the present disclosure, the DI data may be data for removing a sensor-specific deviation from the biometric information of the user received through the biometric sensor 320-1 of the first electronic device 210.

In one embodiment, at least one of operation 1420 or operation 1430 may be performed before operation 1410.

In operation 1440, the first electronic device 210 may obtain first biometric information. According to an embodiment of the present disclosure, the first electronic device 210 may obtain first biometric information as device independent biometric information by using DI data. According to an embodiment of the present disclosure, the first electronic device 210 may obtain first biometric information by applying DI data to biometric information received through the biometric sensor 320-1.

In operation 1450, the first electronic device 210 may transmit a signal for requesting unique information about the user to the ID server 520. For example, the first electronic device 210 may provide the ID server 520 with information on the SIM card installed in the first electronic device 210.

In operation 1460, the first electronic device 210 may receive user specific information from the ID server 520. According to an embodiment of the present disclosure, the first electronic device 210 may receive unique information about the user corresponding to the SIM card from the ID server 520.

In operation 1470, the first electronic device 210 may obtain second biometric information. According to an embodiment of the present disclosure, the first electronic device 210 may obtain the second biometric information by combining the first biometric information and the unique information about the user at a predetermined ratio and performing one-way conversion on the combined information. According to an embodiment of the present disclosure, the first electronic device 210 may generate a biometric characteristic value by performing unidirectional transformation on the combined information.

In operation 1480, the first electronic device 210 may generate hint data. In one embodiment, the hint data may be base data used to restore a biometric characteristic value in another electronic device (for example, the second electronic device 220) that attempts biometric authentication.

In operation 1490, the first electronic device 210 may transmit the second biometric information and the hint data to the authentication server 230.

In operation 1495, the authentication server 230 may store second biometric information and hint data received from the first electronic device 210. According to an embodiment of the present disclosure, the authentication server 230 may map the second biometric information and the hint data received from the first electronic device 210 to the user account information and store the mapping information. In another embodiment, the authentication server 230 may store the second biometric information and hint data received from the first electronic device 210 by mapping the specific biometric information to the specific function that requested the registration process.

In operation 1497, the authentication server 230 may transmit a registration result to the first electronic device 210. In an embodiment, the authentication server 230 may transmit a signal to the first electronic device 210 indicating that the second biometric information was successfully registered with the authentication server 230. According to another embodiment, the authentication server 230 may transmit a signal indicating that registration of the second biometric information failed to the first electronic device 210.

FIG. 15 is a diagram illustrating signaling between a second electronic device and a plurality of external servers including an authentication server according to various embodiments of the present disclosure.

Referring to FIG. 15, the plurality of external servers may include a DI server 510, an ID server 520, and an authentication server 230.

Since operations 1510 to 1560 are substantially similar to operations 1410 to 1460 disclosed in FIG. 14, detailed descriptions thereof will be omitted.

However, the information obtained by applying the DI data received from the DI server 510 to the biometric information received through the biometric sensor 320-2 may be third biometric information. The third biometric information may have the same acquisition method as the first biometric information, but there may be a difference in the obtained device.

In operation 1570, the authentication server 230 may transmit hint data to the second electronic device 220. In one embodiment, the hint data transmitted from the authentication server 230 to the second electronic device 220 is the same data as the hint data transmitted from the first electronic device 210 to the authentication server 230 during the registration process. Can be.

Although not shown, before the authentication server 230 transmits the hint data to the second electronic device 220, the second electronic device 220 may request the hint data from the authentication server 230. According to an embodiment, when the second electronic device 220 requests the hint data from the authentication server 230, the second electronic device 220 may provide information about a user account corresponding to the user of the second electronic device 220. Can be additionally transmitted. In another embodiment, the second electronic device 220 may transmit information about a user account corresponding to the user of the second electronic device 220 before operation 1510.

According to an embodiment of the present disclosure, when the received user account corresponds to a previously stored account, the authentication server 230 may transmit the hint data to the second electronic device 220. That is, when the received user account does not correspond to the previously stored account, the authentication server 230 may cancel the authentication operation without transmitting the hint data to the second electronic device 220. The second electronic device 220 may provide the related information to the user in the form of a popup message. For example, the second electronic device 220 may display a pop-up message such as "not a registered user account" on the display.

In operation 1575, the second electronic device 220 may obtain fourth biometric information. According to an embodiment of the present disclosure, the second electronic device 220 may obtain the fourth biometric information by combining the third biometric information and the unique information about the user at a specified ratio and performing one-way conversion on the combined information. In one embodiment, the fourth biometric information may be at least one of a biometric unique feature value or a unique key. The second electronic device 220 may obtain fourth biometric information by using the received hint data.

In operation 1580, the second electronic device 220 may transmit the fourth biometric information to the authentication server 230. For example, the second electronic device 220 may transmit the biometric characteristic value to the authentication server 230.

In operation 1585, the authentication server 230 may match the fourth biometric information with previously stored biometric information. According to an embodiment, the previously stored biometric information may be second biometric information received from the first electronic device 210. The authentication server 230 may determine that the fourth biometric information is successfully authenticated only when the fourth biometric information and the second biometric information have the same value, and the difference between the fourth biometric information and the second biometric information is predetermined. It may be determined that the fourth biometric information has been successfully authenticated only when included within.

In operation 1590, the authentication server 230 may transmit a matching result to the second electronic device 220. In one embodiment, the authentication server 230 generates a message indicating that the fourth biometric information was successfully authenticated with respect to the second biometric information, or a message indicating that the fourth biometric information is not authenticated with respect to the second biometric information. 2, the electronic device 220 may transmit.

FIG. 16 is a diagram for describing a plurality of cases that may occur when the same user combines biometric information and unique information according to a first combining ratio in different devices according to various embodiments of the present disclosure.

Referring to FIG. 16, four cases corresponding to the first coupling ratio are disclosed. In each case, the first electronic device 210 registers the processed user's biometric information (eg, the second biometric information) to the authentication server 230, and the second electronic device 220 registers the processed user's biometric information. Attempt to authenticate the information (eg, the fourth biometric information) (or request to the authentication server).

In an embodiment, the first combining ratio may be a ratio of 1: 1 combining first biometric information (or third biometric information) and unique information corresponding to a user. The first combining ratio is a ratio of combining the first biometric information (third biometric information) and the unique information such that the length of the first biometric information (or third biometric information) is equal to the length of the unique information corresponding to the user. Can be.

According to an embodiment, the first biometric information generated by the first electronic device 210 and the second biometric information generated by the second electronic device 220 may be different from each other. The first biometric information and the second biometric information are both device-independent biometric information from which sensor-specific deviations have been removed. May differ from one another. For example, the first biometric information may be illustrated as ABC, and the second biometric information generated by the second electronic device may be illustrated as ABC. 16A, 16B, and 16C. For example, the first biometric information may be illustrated as ABC, and the second biometric information may be referred to as ABZ. (FIG. 16D)

According to an embodiment of the present disclosure, the first electronic device 210 may determine unique information corresponding to the user based on the information of the SIM card installed in the first electronic device 210. In addition, the second electronic device 220 may determine the unique information corresponding to the user based on the information of the SIM card installed in the second electronic device 220. The user removes the SIM card installed in the first electronic device 210 and installs it in the second electronic device 220, or the SIM card installed in the first electronic device 210 and the SIM card installed in the second electronic device 220 are installed. When corresponding to the same user, the unique information corresponding to the user, which is obtained by the first electronic device 210 and the second electronic device 220, may be the same.

FIG. 16A illustrates a case where authentication is successful because the second biometric information and the fourth biometric information are the same.

According to an embodiment, the first electronic device 210 and the second electronic device 220 may be extracted from the first biometric information and the unique information corresponding to the user (or the unique information corresponding to the user) at a first combining ratio. Feature values). For example, the information combined in the first electronic device 210 may be ABC123, and the information combined in the second electronic device 220 may be ABD123.

The first electronic device 210 and the second electronic device 220 may generate second biometric information or fourth biometric information by unidirectionally converting the combined information. According to an embodiment of the present disclosure, the first electronic device 210 may extract the biometric characteristic value az39 as the second biometric information from the combined information ABC123. In addition, the second electronic device 220 may extract the biometric characteristic value az39 as the fourth biometric information from the combined information ABD123. That is, the second electronic device 220 may generate the same bio-specific feature value az39 as the first electronic device 210 from the combined information ABC123 and ABD123 different from the first electronic device 210. have. According to an embodiment of the present disclosure, the second electronic device 220 may receive the hint data from the authentication server 230 before generating the biometric characteristic value, and use the received hint data to communicate with the first electronic device 210. It is possible to generate the same bio intrinsic feature value.

In an embodiment, the authentication server may authenticate the fourth biometric information with respect to the second biometric information, based on a result of comparing the second biometric information with the fourth biometric information. Since the fourth biometric information az39 is the same as the second biometric information az39, the authentication server determines that the fourth biometric information has been successfully authenticated with respect to the second biometric information, and that the fourth biometric information has been successfully authenticated. The indicating message may be transmitted to the second electronic device.

16B further illustrates a case of using a public key algorithm.

According to an embodiment, the first electronic device 210 may derive the public key and the unique key from the second biometric information az39 and transmit the derived public key to the authentication server 230. For example, the second electronic device 220 may derive a public key and a unique key from the fourth biometric information az39 and transmit electronically signed information to the authentication server 230 using the derived unique key. have.

When the electronically signed information transmitted from the second electronic device 220 is decrypted by the public key transmitted from the first electronic device 210, the authentication server 230 may convert the fourth biometric information to the second biometric information. It may be determined that the authentication was successfully performed, and a message indicating that the fourth biometric information was successfully authenticated may be transmitted to the second electronic device 220.

16C and 16D show a case in which authentication succeeds when the difference between the two biometric information and the fourth biometric information falls within a specified range even though the second biometric information and the fourth biometric information are not necessarily identical.

Since the process of combining the first biometric information and the unique information corresponding to the user is the same as that of FIG. 16A, a detailed description thereof will be omitted.

According to an embodiment, in FIG. 16C, the first electronic device 210 may generate the biometric characteristic value xyz986 as the second biometric information by, for example, converting the combined information ABC123 in one direction. . In addition, the second electronic device 220 may also generate the biometric characteristic value xyz987 as the fourth biometric information by unidirectionally converting the combined information ABD123.

If the difference value between the second biometric information (xyz986) and the fourth biometric information (xyz987) falls within the specified range, the authentication server 230 may determine whether the second biometric information and the fourth biometric information are not the same. It may be determined that the biometric information has been successfully authenticated with respect to the second biometric information.

The difference (or error) of the information before and after conversion can be maintained (before conversion-ABC / ABD, after conversion-xyz987 / xyz985). Since the total amount of information has increased, the proportion of the difference (or error) of the information in the whole can be further reduced. Therefore, compared with the case where biometric authentication is performed using only biometric information without considering unique information corresponding to a user, the false recognition rate may be further improved.

According to an embodiment, in FIG. 16D, the first electronic device 210 may generate the biometric characteristic value xyz986 as the second biometric information by, for example, converting the combined information ABC123 in one direction. In addition, the second electronic device 220 may also generate the biometric characteristic value xyz912 as the fourth biometric information by unidirectionally converting the combined information ABZ123.

The authentication server 230 confirms that the difference between the second biometric information xyz986 and the fourth biometric information xyz912 does not fall within the specified range, and determines that the fourth biometric information is not authenticated with respect to the second biometric information. can do.

FIG. 17 is a diagram for describing a plurality of cases that may occur when the same user combines biometric information and unique information according to a second combining ratio in different devices according to various embodiments of the present disclosure.

Referring to FIG. 17, four cases corresponding to the second bonding ratio are disclosed. In each case, the first electronic device 210 registers the processed user's biometric information (eg, the second biometric information) to the authentication server 230, and the second electronic device 220 registers the processed user's biometric information. Attempt to authenticate the information (eg, the fourth biometric information) (or request to the authentication server).

In an embodiment, the second combining ratio may be a ratio of 3: 7 combining first biometric information (or third biometric information) and unique information corresponding to a user. The second combining ratio is equal to the first biometric information (or the third biometric information) such that the ratio of the length of the first biometric information (or the third biometric information) to the length of the unique information corresponding to the user is 3: 7. It can be a ratio combining unique information.

For example, referring to FIG. 17A, the first electronic device 210 may combine the first biometric information ABC and the user unique information 1234567, and the second electronic device 220 may connect the third to the third electronic device 210. The biometric information ABD and the user unique information 1234567 may be combined (ABD1234567).

The first electronic device 210 and the second electronic device 220 may generate the second biometric information or the fourth biometric information by unidirectionally converting the combined information. According to an embodiment of the present disclosure, the first electronic device 210 may extract the biometric characteristic value 8zs5 as the second biometric information from the combined information ABC1234567. The second electronic device 220 may extract the same biometric characteristic value 8zs5 as the first electronic device as the fourth biometric information from the combined information ABD1234567. The first electronic device 210 and the second electronic device 220 may transmit the second biometric information and the fourth biometric information to the authentication server 230, and the authentication server 230 may transmit the second biometric information to the second biometric information. Since the biometric information is the same as the biometric information, it may be determined that the fourth biometric information has been successfully authenticated with respect to the second biometric information.

The description of FIG. 17B differs from the description of FIG. 16B, in that only the bonding ratio is different, and the rest is the same.

FIG. 17C illustrates a case in which the fourth biometric information is successfully authenticated with respect to the second biometric information even if the difference between the first biometric information and the third biometric information is somewhat large, unlike FIG. 16C.

According to an embodiment of the present disclosure, the first electronic device 210 combines the first biometric information ABC and the unique information 1234567 corresponding to the user, and performs one-way conversion on the combined information to generate the second biometric information xysab02. Can be generated. In addition, the second electronic device 220 may generate the fourth biometric information xxyab25 by combining the third biometric information ABZ and the unique information corresponding to the user 1234567 and performing one-way conversion on the combined information. Can be.

In FIG. 16D, the authentication server 230 determines that the fourth biometric information is not authenticated with respect to the second biometric information because the difference between the second biometric information and the fourth biometric information does not fall within the designated range. In contrast, the authentication server 230 may determine that the fourth biometric information has been successfully authenticated with respect to the second biometric information because the difference between the second biometric information and the fourth biometric information falls within a specified range. The reason is that the difference (or error) between the first biometric information and the third biometric information is maintained before and after the conversion, but in FIG. 17C than in FIG. 16D, as the ratio of the biometric information in the total information becomes lower, the difference (or error) This is because the proportion of) decreases. Therefore, unlike FIG. 16D, in FIG. 17C, the authentication server 230 may determine that the fourth biometric information is successfully authenticated with respect to the second biometric information.

FIG. 17D illustrates a case in which the difference between the first biometric information and the third biometric information is greater than that in FIG. 17C. Since the case of FIG. 17 has a smaller ratio of biometric information than that of FIG. 16, even if the difference between the first biometric information ABC and the third biometric information ADZ increases somewhat, biometric information may be successfully authenticated. Is as confirmed in FIGS. 16D and 17C. However, in FIG. 17D, the difference between the first biometric information ABC and the third biometric information ADZ becomes larger, so that the difference between the second biometric information xytzm51 and the fourth biometric information xytzm17 corresponds to a specified range. You will not. The authentication server 230 determines that the fourth biometric information is not authenticated with respect to the second biometric information, and transmits a message indicating that the authentication of the fourth biometric information failed to the second electronic device 220.

Although not shown, when using the first biometric information ABC and the third biometric information ADZ as they are, but using the binding ratio as the third binding ratio (eg, 1: 9), the authentication server 230 may use the fourth biometric information ABC. It may be determined that the biometric information has been successfully authenticated with respect to the second biometric information.

FIG. 18 is a diagram illustrating a case where authentication fails when different users combine biometric information and unique information according to a first combining ratio in different devices according to various embodiments of the present disclosure.

In an embodiment, the first combining ratio may be a ratio of 1: 1 combining first biometric information (or third biometric information) and unique information corresponding to a user.

Unlike FIG. 16 and FIG. 17, FIG. 18 illustrates a case where unique information corresponding to a user is different in the first electronic device 210 and the second electronic device 220. For example, the SIM card of the first electronic device 210 may correspond to user A, the SIM card of the second electronic device 220 may correspond to user B, and user A and user B may not be the same. have. For example, user A and user B may have twin relationships. That is, the unique information 123 corresponding to user A and the unique information 124 corresponding to user B may be similar but not identical.

According to an embodiment of the present disclosure, the first electronic device 210 may combine (ABC123) the first biometric information ABC and the unique information 123 corresponding to the user A. FIG. In addition, the second electronic device 220 may combine the third biometric information ABD and the unique information 123 corresponding to the user B (ABD124).

According to an embodiment of the present disclosure, the first electronic device 210 may generate the second biometric information az39 by unidirectionally converting the combined information ABC123, and the second electronic device 220 may combine the combined information ABD124. May be unidirectionally transformed to generate fourth biometric information bx71. Unlike FIGS. 16 and 17 in which the same information is additionally combined with the biometric information, in FIG. 18, as the different information is additionally combined with the biometric information, the second biometric information (az39) and the fourth biometric information (bx71) generated by the transformation are added. ) Can be greater than the difference in biometric information (the difference between the first biometric information (ABC) and the third biometric information (ABD)). The authentication server 230 may determine that the difference between the second biometric information and the fourth biometric information does not fall within a specified range, and transmit a message indicating that authentication failed to the second electronic device.

19 is a schematic diagram illustrating a user authentication system using biometric information according to various embodiments of the present disclosure.

Referring to FIG. 19, a user authentication system 1900 using biometric information may include a first electronic device 1910, a second electronic device 1920, and a verification server 1930.

In an embodiment, the first electronic device 1910 and the second electronic device 1920 may be the electronic device 101 shown in FIG. 1.

In an embodiment, the first electronic device 1910 and the second electronic device 1920 may be used by different users. For example, the first electronic device 1910 may register information (hereinafter, referred to as a “reference image”) to be used to verify biometric information received later according to the input of the first user, to the verification server 1930. have. The second electronic device 1920 may verify the biometric information with respect to the verification server 1930 according to an input of a second user different from the first user.

In another embodiment, the first electronic device 1910 and the second electronic device 1920 may be electronic devices used by the same user. For example, the first electronic device 1910 and the second electronic device 1920 may be electronic devices owned by the same user based on the same viewpoint. For example, the first electronic device may be a smart phone, and the second electronic device may be a tablet PC.

According to an embodiment, the first electronic device 1910 and the second electronic device 1920 may be the same electronic device. For example, the first electronic device 1910 and the second electronic device 1920 may be substantially the same electronic device, only distinguished in functions performed in connection with biometric authentication. For example, the first electronic device 1910 may be an electronic device that transmits the biometric information and the reference image to the verification server 1930 to register the reference image with the verification server 1930, and the second electronic device 1920. The electronic device may be an electronic device that transmits the biometric information to the verification server 1930 and receives the biometric information with respect to the verification server 1930. For example, the first electronic device 1910 may be the first electronic device 210 shown in FIG. 2. For another example, the second electronic device 1920 may be the second electronic device 220 shown in FIG. 2.

In an embodiment, the biometric information transmitted by the first electronic device 1910 to the verification server 1930 may correspond to the first biometric information described with reference to FIGS. 2 through 19, and the second electronic device 1920 verifies The biometric information verified by the server 1930 may correspond to the third biometric information described with reference to FIGS. 2 to 18. For example, the biometric information transmitted by the first electronic device 1910 to the verification server 1930 may be first biometric information or biometric information generated by modifying a part of the first biometric information.

In an embodiment, the verification server 1930 verifies the biometric information received from the plurality of client devices (eg, the first electronic device 1910 and the second electronic device 1920), and assigns a function according to the verification result. Can be performed. For example, the verification server 1930 may be the ID server 520 disclosed in FIG. 5.

In an embodiment, the verification server 1930 may verify the first biometric information received from the first electronic device 1910. When the first biometric information is successfully verified, the verification server 1930 maps the reference image received together with the first biometric information to account information or identification information of the electronic device in a memory (not shown) of the verification server 1930. By storing the data, the reference image can be registered. In addition, the verification server 1930 may transmit unique information (or feature information extracted from the unique information) corresponding to the first user so that the first electronic device 1910 may be combined with the first biometric information. ) Can be sent.

According to an embodiment of the present disclosure, the verification server 1930 may verify third biometric information received from the second electronic device 1920. When the third biometric information is successfully verified, the verification server 1930 may provide unique information corresponding to the second user to the second electronic device 1920 so that the second electronic device 1920 may be combined with the third biometric information. ) Can be sent.

According to an embodiment of the present disclosure, the first electronic device 1910 may transmit the reference image along with the biometric information (eg, the first biometric information) to the verification server 1930. In an embodiment, the first biometric information may be biometric information that can identify the first user, such as fingerprint information, an iris image, and a face image. In one embodiment, the reference image may be an image for verifying whether a first user corresponding to the first biometric information (or a second user corresponding to third biometric information to be received later) corresponds to a designated user. have. For example, the reference image may be an image of a physical object (eg, a passport, a Korean national ID card, a US driver's license, etc.) containing user identification information. The identification information of the user included in the reference image may include biometric information and non-biometric information. For example, the reference image may include non-biometric information consisting of numbers of a specified length, such as Korean social security number and US social security number. In another example, the reference image may include biometric identification information such as fingerprint information and face information.

According to an embodiment, when the biometric information is verified with respect to the verification server 1930, the second electronic device 1920 may transmit the third biometric information to the verification server 1930. In an embodiment, the third biometric information may be biometric information capable of identifying a user, such as fingerprint information, an iris image, a face image, and the like, as the first biometric information.

The user authentication system 1900 using biometric information disclosed in FIG. 19 may include two verification processes. The user authentication system 1900 using the biometric information disclosed in FIG. 19 may include a first verification process performed at the electronic device stage and a second verification process performed at the server stage (or service stage).

In an embodiment, the first electronic device 1910 that registers the reference image with the verification server 1930 by transmitting the first biometric information and the reference image to the verification server 1930 may verify the first biometric information and the reference image. Before transmitting to the server 1930, the first biometric information may be verified by itself (first verification process). The first electronic device 1910 may extract biometric information (eg, face information) included in the reference image, and compare the extracted biometric information with the first biometric information (eg, a selfie image). When the biometric information extracted from the reference image has a similarity with the first biometric information or a predetermined value or more, the first electronic device 1910 may transmit the first biometric information and the reference image to the verification server 1930. The verification server 1930 having received the first biometric information and the reference image from the first electronic device 1910 may verify the first biometric information (second verification process). The verification server 1930 may extract biometric information included in the received reference image and compare the extracted biometric information with the received first biometric information. When the extracted biometric information has a degree of similarity with the first biometric information or more than a predetermined value, the verification server 1930 stores the reference image in the memory, and registration of the reference image is successfully completed in the first electronic device 1910. You can send a message indicating that.

In another embodiment, the second electronic device 1920 that attempts to verify the biometric information with respect to the verification server 1930 automatically transmits the third biometric information before transmitting the third biometric information to the verification server 1930. Verification (first verification process). The second electronic device 1920 may compare the third biometric information with biometric information stored in a memory of the second electronic device 1920 (for example, the memory 130 shown in FIG. 1). The biometric information stored in the memory may be a reference image used in the registration process. For example, when the second electronic device 1920 and the first electronic device 1910 are the same electronic device, the biometric information stored in the memory may be a reference image used during the registration process. The biometric information stored in the memory may be independent of the reference image used in the registration process. For example, the biometric information stored in the memory may be biometric information for the second user and may be irrelevant to a reference image corresponding to the first user used in the registration process. The verification server 1930 may compare the received third biometric information with a reference image stored in the memory of the verification server 1930. The reference image stored in the memory of the verification server 1930 may correspond to the reference image transmitted from the first electronic device 1910. When the verification server 1930 has a similarity or higher than a predetermined value with the reference image stored in the memory of the verification server 1930, the verification server 1930 may transmit the biometric information to the second electronic device 1920. A message may be sent indicating that the verification of the information has been successfully completed. In addition, the verification server 1930 may transmit unique information (or feature information extracted from the unique information) corresponding to the second user so that the second electronic device 1920 may be combined with the third biometric information. Can be sent to.

19, a user (first user) corresponding to a reference image registered from the first electronic device 1910 is assigned to a user (second user) currently using the second electronic device 1920. May correspond to the verification server 1930. For example, when the user corresponding to the reference image registered from the first electronic device 1910 is the first user, and the user currently using the second electronic device 1920 is a second user different from the first user. The verification server 1930 may compare the third biometric information of the second user with a reference image corresponding to the first user. The verification server 1930 may confirm that the user who is currently using the second electronic device 1920 does not correspond to the user corresponding to the reference image registered from the first electronic device 1910, based on the comparison result.

20 is a diagram illustrating an operation of registering a reference image with respect to a verification server in a first electronic device according to various embodiments of the present disclosure.

20 may be performed by a first electronic device (eg, the first electronic device 1910 disclosed in FIG. 19) or a processor (eg, the processor 120 disclosed in FIG. 3) of the first electronic device. . Hereinafter, operations described in FIG. 20 are performed by the first electronic device 1910.

The operations disclosed in FIG. 20 may correspond to operation 620 of FIG. 6.

In operation 2010, the first electronic device 1910 may obtain first biometric information. According to an embodiment of the present disclosure, the first electronic device 1910 may obtain first biometric information in response to an input of a first user for setting biometric authentication for execution of a shopping application. For example, the first electronic device 1910 may acquire a selfie image using a camera module (eg, the camera module 180 of FIG. 1) as the first biometric information.

In operation 2020, the first electronic device 1910 may acquire a reference image. According to an embodiment of the present disclosure, the first electronic device 1910 may acquire a reference image in response to the acquisition of the first biometric information. In one embodiment, the reference image may be an image of a physical object containing the user's identification information. Identification information of the user included in the reference image may include biometric information (eg, fingerprint information, face information) and non-biometric information (eg, text information). One reference image may correspond to one user. For example, the first electronic device 1910 may include a reference image corresponding to the first user who is the owner of the first electronic device 1910 (or a user corresponding to the SIM card installed in the first electronic device 1910). Can be obtained. For example, the first electronic device 1910 may acquire a reference image corresponding to the first user by photographing an ID of the first user.

In operation 2030, the first electronic device 1910 may transmit first biometric information and a reference image. In an embodiment, the first electronic device 1910 may transmit first biometric information to a verification server (eg, the verification server 1930 illustrated in FIG. 19) through a communication interface (eg, the wireless communication circuit 310 of FIG. 3). And a reference image.

According to an embodiment of the present disclosure, the first electronic device 1910 may transmit the first biometric information and the reference image in response to the acquisition of the first biometric information and the reference image. The first biometric information and the reference image may be transmitted in response to confirming successful completion.

In an embodiment, instead of transmitting the reference image, the first electronic device 1910 may transmit information to the verification server 1930 that may perform the same role as the reference image in the verification server 1930. For example, the first electronic device 1910 transmits information on the subscriber identification module installed in the first electronic device 1910 to the verification server 1930, and the verification server 1930 is associated with the received subscriber identification module. Using the information, identification information (eg, text information, face information, fingerprint information) of the first user may be obtained. For example, the verification server 1930 may obtain identification information of the user from an external server (eg, a server included in the government network) by using the received information about the subscriber identification module.

According to an embodiment, the first electronic device 1910 may transmit the first biometric information to the verification server 1930 after transmitting the reference image, or transmit the first biometric information to the verification server 1930 together with the reference image. It may be. Although not shown, the first electronic device 1910 may transmit the reference image to the verification server 1930 after transmitting the first biometric information.

In operation 2040, the first electronic device 1910 may receive a message indicating whether the first biometric information corresponds to the reference image from the verification server 1930. In an embodiment, the verification server 1930 may compare the received first biometric information with biometric information extracted from the received reference image. For example, when the first biometric information is a selfie image of the first user, the verification server 1930 may compare the user image extracted from the received reference image. For another example, when the first biometric information is fingerprint information of the first user, the verification server 1930 may compare the fingerprint information extracted from the received reference image. When the first biometric information has a similarity or higher than a predetermined value to the extracted biometric information, the first electronic device may receive a message indicating that registration of the reference image has been successfully completed from the verification server 1930. In addition, the verification server 1930 may store the reference image in a memory of the verification server 1930. The verification server 1930 may map and store the reference image in the memory of the verification server 1930 with user account information or identification information of the first electronic device 1910.

Although not shown, when the registration of the reference image is successfully completed, the first electronic device 1910 may receive information to be combined with the first biometric information from the verification server 1930 or another server connected to the verification server 1930. have. For example, the first electronic device 1910 receives feature information extracted from unique information of the first user (for example, unique information of the first user corresponding to the SIM card), and receives the first biometric information and the feature information. Can be combined.

FIG. 21 is a diagram illustrating an operation of registering biometric information with a verification server in a second electronic device according to various embodiments of the present disclosure. Referring to FIG.

The operations disclosed in FIG. 21 may be performed by a second electronic device (eg, the second electronic device 1920 shown in FIG. 19) or a processor (eg, the processor 120 shown in FIG. 3) of the second electronic device. . Hereinafter, the operations disclosed in FIG. 21 will be described as being performed by the second electronic device 1920.

Operations disclosed in FIG. 21 may correspond to operation 1130 of FIG. 11.

In operation 2110, the second electronic device 1920 may transmit the third biometric information to the verification server (eg, the verification server 1930 of FIG. 19). According to an embodiment of the present disclosure, the second electronic device 1920 may transmit the third biometric information acquired using the biometric sensor (eg, the biometric sensor 320 of FIG. 3) to the verification server 1930. In another embodiment, the second electronic device 1920 may transmit the third biometric information obtained by using the camera module (eg, the camera module 180 of FIG. 1) to the verification server 1930. For example, the second electronic device 1920 may transmit the selfie image of the second user acquired using the camera module 180 to the verification server 1930.

In operation 2120, the second electronic device 1920 may receive a message indicating whether the third biometric information corresponds to the reference image stored in the verification server 1930.

According to an embodiment of the present disclosure, the second electronic device 1920 may receive a message indicating that the third biometric information corresponds to a reference image stored in the verification server 1930. For example, when the third biometric information is a selfie image of the second user, the verification server 1930 may compare the third biometric information with a user image extracted from the reference image. When the selfie image has a similarity or more than a predetermined value with a user image extracted from the reference image, the second electronic device 1920 may receive a message indicating that the third biometric information corresponds to the reference image. For another example, when the third biometric information is fingerprint information of the second user, the verification server 1930 may compare the third biometric information with fingerprint information extracted from the reference image. When the fingerprint information included in the third biometric information has a similarity or higher than a predetermined value with the fingerprint information extracted from the reference image, the second electronic device 1920 may receive a message indicating that the third biometric information corresponds to the reference image. Can be.

For another example, the second electronic device 1920 may receive a message (authentication failure message) indicating that the third biometric information does not correspond to the reference image stored in the verification server 1930. For example, when the reference image stored in the verification server 1930 corresponds to the first user, and the second electronic device 1920 transmits the third biometric information corresponding to the second user different from the first user, 2 The electronic device 1920 may receive an authentication failure message.

22 is a diagram illustrating a user interface of the first electronic device 1910 according to various embodiments of the present disclosure.

Referring to FIG. 22A, the first electronic device 1910 may display a user interface for obtaining first biometric information according to an input of a user (eg, a first user). According to an embodiment, the first electronic device 1910 may display a user interface for obtaining first biometric information in response to an input of a first user for setting biometric authentication for execution of a shopping application. For example, the first electronic device 1910 may display a guide message such as "Start face authentication. Put a face on the camera."

Referring to FIG. 22B, the first electronic device 1910 may obtain first biometric information. According to an embodiment of the present disclosure, the first electronic device 1910 may acquire a selfie image of the first user as first biometric information. The first electronic device 1910 may acquire a selfie image of the first user as device independent biometric information.

Referring to FIG. 22C, the first electronic device 1910 may display a user interface for obtaining a reference image. For example, the reference image may be an image for verifying whether the first user corresponding to the first biometric information (or a second user corresponding to the third biometric information to be received later) corresponds to the designated user, For example, the image may be an image of a physical object containing user identification information. For example, the first electronic device 1910 may display a guide message such as "register an ID card. Please apply an ID card to the camera."

Referring to FIG. 22D, the first electronic device 1910 may acquire a reference image. For example, the first electronic device 1910 may include a reference image including biometric identification information 2210 of the first user (eg, face information) and non-biometric information 2220 (eg, a registration number) of the first user. Can be obtained. In an embodiment, the obtained reference image may be transmitted to a verification server (eg, the verification server 1930 of FIG. 19).

In an embodiment, the display order of the drawings disclosed in FIG. 22 may be changed. For example, after the reference image is obtained, first biometric information (eg, a selfie image) may be obtained. For example, the first electronic device 1910 that acquires the reference image may display a guide message indicating that acquisition of the first biometric information is required to register the obtained reference image with the verification server 1930. .

FIG. 23 is a diagram illustrating a user interface of a second electronic device 1920 according to various embodiments of the present disclosure.

Referring to FIG. 23A, the second electronic device 1920 may display a user interface for obtaining third biometric information according to an input of a user (eg, a second user). According to an embodiment, the second electronic device 1920 may display a user interface for obtaining third biometric information in response to an input of a second user for executing a shopping application. For example, the second electronic device 1920 may display a guide message such as "face authentication is required to execute a shopping application".

Referring to FIG. 23B, the second electronic device 1920 may obtain third biometric information. According to an embodiment of the present disclosure, the second electronic device 1920 may acquire a selfie image of the second user as the third biometric information. The second electronic device 1920 may acquire a selfie image of the second user as device independent biometric information.

Referring to FIG. 23C, the second electronic device 1920 may display a result of face authentication. According to an embodiment, the second electronic device 1920 transmits the third biometric information to the verification server (eg, the verification server 1930 of FIG. 19), and then displays the result of the face authentication received from the verification server 1930. I can display it. For example, when the second user and the first user are the same user, the verification server 1930 comparing the third biometric information with the reference image stored in the verification server 1930 may display a message indicating that the face authentication is completed successfully. May be transmitted to the second electronic device 1920. For another example, when the second user and the first user are different, the verification server 1930 comparing the third biometric information with the reference image stored in the verification server 1930 generates a message indicating that face authentication failed. 2 may be transmitted to the electronic device 1920.

An electronic device according to various embodiments of the present disclosure may include a communication circuit, a biometric sensor, a processor operatively connected to the communication circuit and the biometric sensor, and the processor may include a first biometric user's first biometric device. Acquires information and generates second biometric information for authenticating the user based on a combination of the first biometric information and the unique information corresponding to the user, and the authentication server generates the third biometric information of the user. And transmit the second biometric information to the authentication server by using the communication circuit to authenticate the fourth biometric information generated based on the combination of and the unique information with respect to the second biometric information.

According to various embodiments of the present disclosure, the third biometric information may be obtained from another electronic device.

According to various embodiments of the present disclosure, the third biometric information may be at least partially different from the first biometric information.

According to various embodiments of the present disclosure, the processor may receive biometric information from a user through the biometric sensor as at least part of the operation of acquiring the first biometric information, and apply correction information corresponding to the biometric sensor to the biometric information. It may be set to obtain the first biometric information.

According to various embodiments of the present disclosure, the memory device may further include a memory, wherein the processor is configured to receive correction information corresponding to the biometric sensor from an external electronic device or to obtain the correction information corresponding to the biometric sensor based on at least information about the biometric sensor or the electronic device. It can be set to.

According to various embodiments of the present disclosure, the processor may be configured to acquire the unique information by using information associated with a subscriber identity module installed in the electronic device.

According to various embodiments of the present disclosure, the processor may be configured to acquire the unique information based on information obtained by using at least one sensor of the first electronic device.

According to various embodiments of the present disclosure, the processor may be configured to acquire the unique information by using image information related to the user.

According to various embodiments of the present disclosure, the image information associated with the user is information about an image generated by photographing a physical object including the biometric information of the user, and the processor may be configured to obtain the first biometric information and the image information associated with the user. Send to a verification server and receive unique information corresponding to the user from the verification server.

According to various embodiments of the present disclosure, the processor may be configured to receive unique information corresponding to the user from the verification server along with a message indicating that the first biometric information corresponds to image information associated with the user.

According to various embodiments of the present disclosure, the processor may be configured to generate the second biometric information by combining the first biometric information and the unique information at a specified combining ratio and performing unidirectional transformation on the combined information. have.

According to various embodiments of the present disclosure, the processor may be configured to determine the designated coupling ratio based on a user input for setting characteristics of biometric authentication.

According to various embodiments of the present disclosure, the processor may be configured to determine the designated combining ratio based on at least one of a category, content, or a preset security level of a function related to biometric authentication.

An electronic device according to various embodiments of the present disclosure includes a communication circuit, a biometric sensor, a processor operatively connected to the communication circuit and the biometric sensor, and the processor requests execution of a function requiring biometric authentication of a user. Receiving, using the biometric sensor, obtaining first biometric information of the user, and generating second biometric information for authenticating the user based on a combination of the first biometric information and the unique information corresponding to the user. The second biometric information is transmitted to an authentication server, and the second biometric information indicates a signal indicating that the second biometric information is authenticated with respect to the fourth biometric information generated based on the combination of the third biometric information of the user and the unique information. Received from the authentication server, and in response to receiving the signal may be set to execute the function.

According to various embodiments of the present disclosure, the third biometric information may be obtained from another electronic device.

According to various embodiments of the present disclosure, in response to receiving a request for execution of the function, the processor is configured to transmit a signal for requesting a service required for the execution of the function to the authentication server, and is required to execute the function. The signal for requesting a service may include account information of the user.

According to various embodiments of the present disclosure, after the processor transmits a signal for requesting a service required for executing the function, the processor receives a signal indicating that biometric authentication needs to be performed prior to providing the service from the authentication server. It can be set to.

According to various embodiments of the present disclosure, the processor may receive biometric information from a user through the biometric sensor as at least part of the operation of acquiring the first biometric information, and apply correction information corresponding to the biometric sensor to the biometric information. It may be set to obtain the first biometric information.

According to various embodiments of the present disclosure, the processor may be configured to acquire the unique information by using information associated with a subscriber identification module installed in the electronic device.

According to various embodiments of the present disclosure, the processor is configured to acquire the unique information by using image information related to the user, and the image information related to the user is generated by photographing a physical object including the biometric information of the user. Information about an image, wherein the processor is further configured to transmit the first biometric information and the image information associated with the user to a verification server, and obtain the unique information corresponding to the user from the verification server. Can be set to receive.

According to various embodiments of the present disclosure, the processor may be configured to receive unique information corresponding to the user from the verification server along with a message indicating that the first biometric information corresponds to image information associated with the user.

According to various embodiments of the present disclosure, the processor may be configured to acquire the unique information by using information associated with an IP address of the electronic device.

According to various embodiments of the present disclosure, the processor may be configured to generate the second biometric information by combining the first biometric information and the unique information at a specified combining ratio and performing unidirectional transformation on the combined information. Can be.

According to various embodiments of the present disclosure, the processor may receive information about a combining ratio corresponding to the function from the authentication server, and transmit the first biometric information and the unique information to the function based on the received information. After combining at a corresponding combining ratio, the second biometric information may be generated by performing a unidirectional transformation on the combined information.

According to various embodiments of the present disclosure, the processor may determine the specified combining ratio based on the attributes of a communication network currently connected to the electronic device, combine the first biometric information and the unique information at the specified combining ratio, and then By performing unidirectional transformation on the combined information, the second biometric information may be configured to be generated.

Computer-readable recording media include hard disks, floppy disks, magnetic media (e.g. magnetic tape), optical recording media (e.g. CD-ROM, DVD, magnetic-optical media (e.g. floppy disks), internal memory, etc. Instructions may include code generated by a compiler or code executable by an interpreter Modules or program modules according to various embodiments may include at least one or more of the above-described components. In some embodiments, operations performed by a module, a program module, or another component may be executed sequentially, in parallel, repeatedly, or heuristically, or at least, or may include other components. Some operations may be executed in a different order, omitted, or other operations may be added.

In addition, the embodiments disclosed in the specification and the drawings merely present specific examples to easily explain and easily understand the contents of the present invention, and are not intended to limit the scope of the present invention. Therefore, the scope of the present invention should be construed that all changes or modifications derived based on the technical spirit of the present invention are included in the scope of the present invention in addition to the embodiments disclosed herein.

First Electronic Device (210)
Second electronic device (220)

Claims (25)

In an electronic device,
Communication circuits;
Biometric sensors;
A processor operatively connected with the communication circuit and a biometric sensor, the processor comprising:
Obtaining first biometric information of a user using the biometric sensor,
Generate second biometric information for authenticating the user based on the combination of the first biometric information and the unique information corresponding to the user, and
The second biometric information using the communication circuit to cause the authentication server to authenticate the second biometric information with respect to the second biometric information generated based on the combination of the third biometric information of the user and the unique information. Electronic device set to transmit to an authentication server.
The method of claim 1,
The third biometric information is obtained from another electronic device.
The method of claim 1,
And the third biometric information is at least partially different from the first biometric information.
The method of claim 1,
The processor may include at least a part of obtaining the first biometric information.
Receiving biometric information from the user through the biometric sensor,
The electronic device configured to obtain the first biometric information by applying correction information corresponding to the biometric sensor to the biometric information.
The method of claim 4, wherein
More memory,
The processor,
An electronic device configured to receive correction information corresponding to the biometric sensor from an external electronic device or to obtain from the memory based at least on the biometric sensor or information about the electronic device.
The method of claim 1,
The processor,
And acquire the unique information by using information associated with a subscriber identity module installed in the electronic device.
The method of claim 1,
The processor,
The electronic device configured to obtain the unique information based on the information obtained by using at least one sensor of the first electronic device.
The method of claim 7, wherein
The processor,
The electronic device is configured to obtain the unique information by using the image information associated with the user.
The method of claim 1,
The processor,
And generate the second biometric information by combining the first biometric information and the unique information at a specified combining ratio and then performing unidirectional transformation on the combined information.
The method of claim 9,
The processor,
And determine the specified coupling ratio based on user input for setting characteristics of biometric authentication.
The method of claim 9,
The processor,
And determine the specified coupling ratio based on at least one of a category, content, or a preset security level of a function related to biometric authentication.
In an electronic device,
Communication circuits;
Biometric sensors;
A processor operatively connected with the communication circuit and a biometric sensor, the processor comprising:
You are asked to run a function that requires your biometrics,
Obtaining first biometric information of a user using the biometric sensor,
Generate second biometric information for authenticating the user based on the combination of the first biometric information and the unique information corresponding to the user,
Transmit the second biometric information to an authentication server;
Receiving a signal from the authentication server indicating that the second biometric information is authenticated with respect to the fourth biometric information generated based on the combination of the third biometric information of the user and the unique information,
And in response to receiving the signal, execute the function.
The method of claim 12,
The third biometric information is obtained from another electronic device.
The method of claim 13,
The processor,
In response to being requested to execute the function, send a signal to the authentication server to request a service required for the execution of the function,
And a signal for requesting a service required for executing the function includes account information of the user.
The method of claim 14,
The processor,
An electronic device configured to receive a signal indicating that biometric authentication needs to be performed prior to providing the service after transmitting a signal requesting a service necessary for executing the function.
The method of claim 12,
The processor may include at least a part of obtaining the first biometric information.
Receiving biometric information from the user through the biometric sensor,
The electronic device configured to obtain the first biometric information by applying correction information corresponding to the biometric sensor to the biometric information.
The method of claim 12,
The processor,
And acquire the unique information by using information associated with a subscriber identification module installed in the electronic device.
The method of claim 12,
The processor,
And the second biometric information is generated by combining the first biometric information and the unique information at a specified combining ratio and performing unidirectional transformation on the combined information.
The method of claim 18,
The processor,
Receiving information about the combining ratio corresponding to the function from the authentication server,
Based on the received information, the second biometric information is generated by combining the first biometric information and the unique information at a combining ratio corresponding to the function, and then performing unidirectional transformation on the combined information. Set electronic devices.
The method of claim 18,
The processor,
Determine the specified coupling ratio based on an attribute of a communication network currently connected with the electronic device,
A second electronic device configured to generate the second biometric information by combining the first biometric information and the unique information at the specified combining ratio and then performing unidirectional transformation on the combined information.
The method of claim 8,
The image information related to the user is information about an image generated by photographing a physical object including the biometric information of the user.
The processor,
And transmit the first biometric information and the image information related to the user to a verification server, and receive, from the verification server, unique information corresponding to the user.
The method of claim 21,
And the processor is configured to receive a message indicating that the first biometric information corresponds to image information associated with the user as at least part of receiving the unique information.
The method of claim 12,
The processor is configured to obtain the unique information by using image information associated with the user, the image information associated with the user is information about an image generated by photographing a physical object including the biometric information of the user,
The processor, in obtaining the unique information,
Transmitting the first biometric information and the image information related to the user to a verification server,
And receive the unique information corresponding to the user from the verification server.
The method of claim 23, wherein
And the processor is configured to receive a message indicating that the first biometric information corresponds to image information associated with the user as at least part of receiving unique information corresponding to the user.
The method of claim 1,
The processor is configured to obtain the unique information by using information associated with an IP address of the electronic device.

Images