KR20210157831A - Biometric authentication smart card - Google Patents

Abstract

A biometric authentication smart card is provided. The smart card includes only one chip. The chip includes the peripheral circuit of a biometric sensor, an authentication information processing module, and a security module. The security module can be overlapped with an active shield. An object of the present invention is to provide a biometric authentication smart card implemented as one chip comprising a biometric sensor, an authentication processing module and a security module.

Description

Biometric authentication-based smart card {BIOMETRIC AUTHENTICATION SMART CARD}

The present invention relates to a smart card based on biometric authentication and a smart payment system thereof.

When a user purchases an item from a store, using a credit card, the user inserts the credit card into a Point Of Sale (POS) terminal of the offline store, and the POS terminal reads user payment information from the credit card to perform payment for the item. However, even when an unregistered person uses a credit card, payment for goods is often performed, and a credit card equipped with an authentication means is being developed.

Biometrics is attracting attention as a promising user authentication technology due to its strong security level and convenient usability. Recently, for user authentication in commercial products such as smart phones and notebook computers, biometric recognition technology using single biometric information such as fingerprint, iris, and face recognition or a combination of multiple biometric information has been used. In addition, biometric technology is combined with e-passport systems and used in border control systems in many countries.

As the movement of using biometric information as an authentication method is active, the number of systems that perform access control or payment authentication using a method such as a fingerprint or iris is increasing. In particular, a system using a fingerprint is relatively widely used since it is easy to use and there is no objection even from the user's point of view.

The technical problem to be solved by the present invention is to provide a biometric authentication-based smart card in which a biometric sensor, an authentication processing module, and a security module are implemented in one chip.

The technical problem of the present invention is not limited to the technical problem mentioned above, and another technical problem not mentioned will be clearly understood by those skilled in the art from the following description.

A peripheral circuit for driving a fingerprint sensing array according to some embodiments of the present invention for solving the above problems, an authentication information processing module for processing a raw image received from the peripheral circuit as fingerprint information for verification, and the fingerprint information for verification; and a security module for determining whether to approve use according to a payment request by matching registered fingerprint information, wherein the peripheral circuit, the authentication information processing module, and the security module are integrated into one chip, and the security module is an active shield may overlap.

A smart card according to some embodiments of the present invention for solving the above problems is an analog front end that outputs a raw image sensed by a biometric sensor, and an authentication information processing module that pre-processes the raw image and then processes the raw image as fingerprint information for verification a security module that compares the verification fingerprint information with the registered fingerprint information, and outputs whether the payment request is approved or not to the terminal, wherein the analog front end, the authentication information processing module, and the security module are one It may be integrated into a chip.

A smart card according to some embodiments of the present invention for solving the above problems includes only one chip, the chip includes a peripheral circuit of a biometric sensor, an authentication information processing module and a security module, and the security module is active It may be overlapped with a shield.

1 is a diagram illustrating a biometric authentication-based smart card payment system according to some embodiments.
2 is a diagram illustrating a biometric authentication-based smart card according to some embodiments.
3 illustrates an integrated biometric authentication chip according to some embodiments.
4 illustrates a biometric sensor module according to some embodiments.
5 and 6 illustrate a security module in accordance with some embodiments.
7 illustrates an authentication information processing module according to some embodiments.
8 illustrates an interface between a security module and an authentication information processing module in more detail according to some embodiments.
9 is a flowchart illustrating a method of operating a smart card according to some embodiments.

Hereinafter, smart cards according to some embodiments of the present invention will be described with reference to FIGS. 1 to 9 .

1 is a diagram illustrating a biometric authentication-based smart card payment system according to some embodiments.

1 is a diagram illustrating a biometric authentication-based smart card payment system according to some embodiments.

Referring to FIG. 1 , a payment system may include a biometric authentication-based smart card 1000 , a payment terminal 2000 , and a payment server 3000 according to some embodiments.

The smart card 1000 refers to a form in which a semiconductor chip having various functions is inserted into a credit card-shaped plastic card. According to some embodiments, the smart card 1000 may be implemented in a contact type that operates when the integrated chip 100 in the smart card 1000 and the payment terminal 2000 come into contact, or the integrated chip 100 and It can also be implemented in a non-contact method that can send and receive data at a short distance.

In the biometric authentication-based smart card 1000, when payment request information including deposit information is output from the on/offline payment terminal 2000 according to some embodiments, the biometric authentication-based smart card 1000 corresponds to the payment request information. Prints the payment method information. The biometric authentication-based smart card 1000 will be described in detail later with reference to FIGS. 2 to 6 .

The payment terminal 2000 is a means for storing deposit information on types, quantities, prices, etc. of products sold on/offline according to some embodiments, and managing sales information for each product, according to an embodiment. In the case of offline, it may be a point of sales (POS) terminal of a store, and in the case of online, according to another embodiment, it may be an online shopping mall system, and according to another embodiment, by accessing a smart card to read payment-related information, , it may be a terminal device capable of communicating with the payment server.

The payment terminal 2000 may be a means that is installed in an offline sales store and can read product information from a barcode or the like attached to each product for sale using a reader or the like. According to some embodiments, the product information may include information about a product type, a product code, a selling price, and the like.

The payment terminal 2000 may transmit sales related information to the payment server 3000 . According to some embodiments, the sales-related information includes selling price information, an ID of the payment terminal 2000, a time at which the payment terminal 2000 reads the selling price information of the product, the type of work the payment terminal 2000 intends to process, It may include at least one of domain information on the management server of the payment terminal 2000 and the like, and deposit account information of the holder of the payment terminal 2000 .

Also, the payment terminal 2000 may transmit payment information read from the smart card 1000 to the payment server 3000 . The payment information includes payment grade information and payment method information of a user registered in the smart card 1000 .

According to some embodiments, the payment method information may include payment account information or payment card information. According to some embodiments, the payment account information is information related to a user's bank account, and may include at least one of a bank account number, an account password, and a security-related authentication number. According to some embodiments, the payment card information may include at least one of a card company to pay a fee, a card number, and a card password.

In addition, the payment terminal 2000 checks whether the user is a registered user of the read smart card 1000 based on biometric authentication information among the payment information read from the smart card 1000 , and if the user is a registered user, the user of the corresponding user Payment grade information corresponding to the index may be transmitted to the payment server 3000 .

The payment server 3000 determines whether to approve the payment based on the sale-related information and the payment information received from the payment terminal 2000 , and transmits the approval determination result to the payment terminal 2000 .

According to some embodiments, the payment server 3000 determines whether to approve the payment of the amount according to the sale-related information based on the received payment method information and payment grade information, based on the payment information.

For example, when the payment information is payment account information, the payment server 3000 may be a payment server of a financial institution (bank, etc.) in which the user's financial account is opened. For example, when the payment information is payment card information, the payment server 3000 may be a payment server of a financial institution that opened a user's payment card.

In this specification, a normal user is a registered user stored in the payment server 3000, and may refer to a user who has an amount greater than the requested amount in a payment account or a user who has a payment card in which the requested amount is within the usable limit. have.

When it is determined that the payment server 3000 is a normal user, the payment server 3000 checks the selling price information and the ID of the payment terminal 2000 from the sale related information, and compares it with the payment information to determine whether to approve the payment. A more detailed description thereof will be given later.

2 is a diagram illustrating a biometric authentication-based smart card according to some embodiments, and FIG. 3 is a diagram illustrating an integrated biometric authentication chip according to some embodiments.

2 and 3 , the biometric authentication-based smart card 1000 may include an antenna 10 and an integrated chip 100 . The integrated chip 100 may include a biometric recognition module 200 , an authentication processing module 300 , and a security module 400 in one chip.

The biometric module 200 may be a means for strengthening the security of the smart card 1000 . The biometric recognition module 200 determines whether the fingerprint information of the effective owner of the smart card 1000 (ie, a person registered in advance) and the fingerprint information of the card user match, and if the fingerprint matches the determination result, it is the actual owner of the card. By authenticating, the lock of the security module 400 built into the smart card 1000 may be released for a predetermined period of time. The biometric recognition module 200 may automatically turn off the lock after a predetermined time to prevent illegal use of the smart card 1000 in advance.

The biometric recognition module 200 according to some embodiments is a sensor for sensing a fingerprint, etc., and may be a sensor for sensing a fingerprint using an electrostatic method, a piezoelectric method, or the like. The biometric recognition module 200 may be a swipe method for sensing a fingerprint by scratching a finger, or an area method for sensing a fingerprint by touching a finger for a predetermined time.

The security module 400 according to some embodiments may be an integrated circuit that records and stores card identification information of the smart card 1000 . The security module 400 performs electronic payment by transmitting the recorded card identification information to the payment terminal 2000 using a contact or non-contact method.

The security module 400 according to some embodiments may temporarily record card identification information and correct or delete the recorded card identification information. The security module 400 records card identification information for one payment method information among a plurality of payment method information. Here, the card identification information is information corresponding to the payment method information, and includes information necessary for electronic payment, such as card number information, card expiration date information, and card security information.

The security module 400 requires a high security requirement of EAL5+ level or higher. All internal components in the security module 400 and data processed in the security module 400 are encrypted based on a random key in order to satisfy the security requirements. For example, the security module 400 may encrypt and store fingerprint information of a card beneficial owner (a person registered in advance), and may prevent external exposure.

Thereafter, the security module 400 receives the registered fingerprint information from the authentication processing module 300 when verification is required for the fingerprint information extracted from the biometric recognition module 200 by using the smart card 1000 according to the matching result. Whether to approve the use of the smart card 1000 may be determined.

The authentication processing module 300 according to some embodiments may process a raw image of a fingerprint received from the biometric recognition module 200 to generate a fingerprint template. The raw image may include a minutiae, which is a feature point of a fingerprint, that is, a detailed feature point such as a ridge end or a bifurcation found in a fingerprint image. The authentication processing module 300 may acquire template information of the corresponding fingerprint image, that is, fingerprint information for verification through detection of Minusha.

Among the biometric recognition modules 200 , the peripheral circuit 220 , the authentication information processing module 300 , and the security module 400 may be implemented as a single integrated chip. That is, each of the components 200 , 300 , and 400 may be integrated into one chip. A detailed description of each of the components 200 , 300 , and 400 in the integrated chip 100 will be described in detail with reference to FIGS. 4 to 8 .

4 illustrates a biometric recognition module in accordance with some embodiments.

According to some embodiments, the biometric recognition module 200 may include a sensing array 210 for sensing a fingerprint, a peripheral circuit 220 for driving the sensing array, and receiving and outputting a sensed raw image.

The sensing array 210 is a part that detects a touch of a finger and acquires a fingerprint image by scanning the fingerprint of the touched finger. The sensing array 210 may scan a finger print in various known methods, such as a capacitive method, an optical method, a pressure method, and a thermal sensing method. According to an embodiment, the sensing array 210 may perform fingerprint sensing by mixing a swipe method and a touch method. For example, when registering a fingerprint, after acquiring a fingerprint image through a swipe method, feature points of the fingerprint are extracted, and during fingerprint authentication, after obtaining a fingerprint image through a touch method, the feature points of the fingerprint can be extracted. , and vice versa.

The peripheral circuit 220 signal-processes the fingerprint image frame scanned at a preset period (speed) by the sensing array 210 . For example, it may include an analog circuit for converting a fingerprint image into an electrical signal, a noise removal circuit, a signal sensitivity amplifier circuit, an analog-to-digital signal conversion circuit, a digital circuit, and the like. The peripheral circuit 220 may be implemented separately or integrated with the sensing array 210 in the form of an ASIC. The peripheral circuit 220 outputs the signal-processed raw image to the authentication information processing module 300 .

5 and 6 illustrate a security module in accordance with some embodiments.

Referring to FIG. 5 , the security module 400 includes a security CPU 410 , a crypto engine 420 , a PKRAM 425 , a non-volatile memory 430 and a memory controller 435 , an external interface 440 , and a system control 450 , a modem 460 , a memory 470 , a mailbox 480 , and an energy harvesting unit 490 may be included.

Each of the components 410 to 490 may communicate through the bus 401 . The bus 401 may be configured as, for example, an Advanced high-performance bus (AHB) interface.

According to some embodiments, the security module 400 may include an active shield 520 and side logic 511 and 512 overlapping each of the components 410 to 490 in the upper layer. According to some embodiments, the active shield 520 uses a top metal on a plan view of the layout of the security module 400 to parallelize signal lines extending in any one direction at regular intervals. it will be arranged For example, the active shield 520 may be a plurality of parallel uppermost metal lines spaced apart by 1 μm intervals. The side logics 511 and 512 are disposed at both ends of the active shield 520 , extend in a second direction perpendicular to the first direction, and are electrically connected to a signal line of the active shield 520 . The side logics 511 and 512 may prevent detection of reverse engineering or external probing by applying a predetermined signal to the active shield 520 .

The security CPU 410 may control overall security-related operations of the security module 300 . For example, the security CPU 410 may match the registered fingerprint information with the fingerprint information for verification, and determine whether to approve the use of the payment request according to the matching result.

The crypto engine 420 may encrypt or decrypt data to be transmitted or received outside the security module 400 . For example, the crypto engine 420 may perform a private key encryption/decryption operation based on Advanced Encryption Standard (AES), Data Encryption Standard (DES), or Secure Hash Algorithm (SHA). The crypto engine 420 may include a big number multiplier (eg, Tornado) necessary for error detection of encrypted data or decrypted data, for example, RSA/ECC operation.

The PKRAM 425 is a memory connected to the crypto engine 420, and may store a public key, and the crypto engine 420 may perform encryption/decryption of data using the public key and the private key. .

The nonvolatile memory 430 may be driven through the memory controller 435 . The non-volatile memory 430 may store a code for operating the security CPU 410 , initial data, and fingerprint information of a registered real user. The non-volatile memory 430 may further include an ECC bit corresponding to the stored data. The memory controller 435 may check the ECC bit of the read data to detect whether there is an error, and correct the detected error.

The external interface 440 may receive a command from the host device (eg, the payment terminal 2000 ) or transmit data according to command processing to the host device. The external interface 440 may include a plurality of pins, for example, a clock signal pin CLK, a reset signal pin RST, and a data pin SIO. The external interface may contact and communicate with the host device in accordance with the ISO7816 standard, for example.

The modem 460 may receive a command from the host device (eg, payment terminal 2000 ) or transmit data according to command processing to the host device. Unlike the external interface 440 , it can communicate with a host device in a non-contact manner according to the ISO14443 standard. The modem 460 may be connected to the energy harvesting unit 490 . The energy harvesting unit 490 may be connected to an RF pin connected to the antenna 10 . The energy harvesting unit 490 may receive an RF signal through the antenna 10 and generate power based on the received RF signal. The modem 460 may supply the generated power to the security module 400 to drive the smart card 1000 .

The system control 450 may perform system control operations such as clock control of the smart card 1000 , drive reset control of the smart card 1000 , and power supply control.

The memory 470 may be a working memory that stores data generated during the operation of the security module 400 . The memory 470 may be, for example, a volatile memory such as random access memory (RAM).

The mailbox 480 communicates with the authentication information processing module 300 . Details will be described with reference to FIG. 8 .

7 illustrates an authentication information processing module according to some embodiments.

When receiving a command from the security module 400 , the authentication information processing module 300 enables the biometric module 200 and receives a raw image of the sensed fingerprint from the biometric module 200 . The authentication information processing module 300 may extract key points from the raw image to generate fingerprint information for verification and transmit it to the security module 400 .

According to some embodiments, the authentication information processing module 300 has a security requirement of about EAL2, operates at a high frequency, and has to process fingerprint information extraction from a raw image within a few msec, so a signal line and a power supply line up to the uppermost metal line use it as That is, unlike FIG. 6 , the authentication information processing module 300 may not include an active shield and side logic.

Referring to FIG. 7 , the authentication information processing module 300 according to some embodiments includes a nonvolatile memory 310 and a memory controller 315 , a CPU 320 , an accelerator 330 , a first memory 340 , and a second 2 may include a memory 350 and an APB bridge 360 .

Each of the components 310 to 370 may communicate through the bus 301 . The bus 301 may be configured as, for example, an Advanced high-performance bus (AHB) interface.

The nonvolatile memory 310 may be driven through the memory controller 315 . The non-volatile memory 310 may store codes for operating the CPU 320 , initial data, and the like. Data read and output from the nonvolatile memory 310 may further include an ECC bit corresponding to the stored data. The memory controller 315 may check the ECC bit of the read data to detect whether there is an error, and correct the detected error.

The CPU 320 controls the overall operation of the authentication information processing module 300 . Also, the CPU 320 may process the raw image into fingerprint information, encrypt the processed fingerprint information, and transmit it to the security module 400 through the bus 301 . For example, the CPU 320 may encrypt the processed fingerprint information using the AES method.

The accelerator 330 may perform a complex operation during image processing on a raw image. For example, the accelerator 330 may input the raw image to a Convolutional Neural Network (CNN) and perform an anti-spoofing operation on the image. It may include an adder, a multiplier, and the like for CNN operation.

The first memory 340 is an operation memory, and may store, for example, an intermediate value or a result value of the accelerator 330 , or may store data required by the CPU 320 as another example.

The authentication information processing module 300 may further include a sensor controller 355 and SFR units 365 and 367 .

The sensor controller 355 may enable the biometric module 200 and control the peripheral circuit 220 to receive the raw image.

The SFR units 365 , 367 may be connected to the APB bridge 360 via a bus 302 . The bus 302 may be implemented with an Advanced Peripheral Bus (APB) interface, for example. The APB bridge 360 may convert APB data into AHB data or convert AHB data into APB data.

The sensor controller 355 may control the SFR unit 367 through the SFR control unit 365 . The SFR unit 367 may pre-process the raw image so that the CPU 320 or the accelerator 330 can process it. The SFR unit 367 may adjust sharpness of the received raw image based on, for example, a Spatial Frequency Response (SFR) algorithm.

The sensor controller 355 may store data processed by the SFR 367 , the accelerator 330 , or the CPU 320 on the raw image received from the biometric module 200 in the second memory 350 . The second memory 350 may store data in units that can be processed by the CPU 320 or the accelerator 330 .

The first memory 340 and the second memory 350 may be, for example, volatile memory devices such as dynamic random access memory (DRAM), static RAM (SRAM), or the like.

The authentication information processing module 300 may further include a Serial Peripheral Interface (SPI) interface 370 . The SPI interface 370 is an interface for connecting to an external device, and may transmit/receive SPI signals (eg, SCLK, CS, MOSI, MISO, etc.) to and from the external device. For example, the SPI interface 370 may be connected to an extended external fingerprint sensor.

8 illustrates an interface between a security module and an authentication information processing module in more detail according to some embodiments.

Referring to FIG. 8 , the security module 400 may satisfy a security requirement of an Evaluation Assurance Level (EAL) 5+ level or higher. Data in all buses 401 and memories 430 and 470 in the security module 400 are encrypted by the security CPU 410 based on a random key. The registered real user's fingerprint information is encrypted and stored in the non-volatile memory 430 to prevent external exposure.

Afterwards, when authentication for verification fingerprint information is required, the security module 400 stores the verification fingerprint information received through the mailbox 480 in the non-volatile memory 430 and registered fingerprint information. It is matched with the final approval or not.

The mailbox 480 may include a protocol changer 481 , a mailbox controller 482 , a memory 483 , and a plurality of multiplexers MUX1 , MUX2 , and MUX3 .

The authentication information processing module 300 may further include a protocol changer 380 as an interface.

The protocol changer 380 transmits an AHB signal for the authentication information processing module 300 to communicate with the mailbox 480 to the protocol changer 481 . The protocol changer 481 may wake up the plurality of MUXs (MUX1, MUX2, MUX3) and the security CPU 410 so that the security module 400 performs an authentication operation based on the received AHB signal.

The mailbox controller 482 stores usage state information and data size information. The mailbox controller 482 includes, for example, a status register and a size register, so that usage status information is stored in a status register and data size information is stored in a size register. The usage state information is information indicating whether the mailbox 480 of the authentication information processing module 300 is used, that is, a communication state with the authentication information processing module 300 , and the data size information is transmitted and received with the authentication information processing module 300 . It may be information on the size of data to be used.

The memory 483 may temporarily store data transmitted and received with the authentication information processing module 300 . The memory 483 is a volatile memory and may be, for example, DRAM, SRAM, or the like.

In operation, the security module 400 checks the communication state with the authentication information processing module 300 through the mailbox controller 482 . If the mailbox 480 is not in use, that is, if the authentication information processing module 300 is not using the mailbox 480 (that is, if the mailbox is empty), the size of the data to be transmitted is checked and the mailbox controller After writing to the size register of 482 and storing the data in the memory 483, the use state information is switched from empty to ready for transmission.

When the mail box 480 confirms the transmission preparation completion state, the authentication information processing module 300 wakes up (Wakeup), and the mailbox 480 itself enters the ready state (Stand by). The authentication information processing module 300 reads the fingerprint information stored in the second memory 350 and transmits it to the mailbox 480 .

The mailbox 480 stores the read fingerprint information into the memory 483 . The security CPU 410 may transmit the fingerprint information stored in the memory 483 to the crypto engine 420 .

9 is a flowchart illustrating a method of operating a smart card according to some embodiments.

Referring to FIG. 9 , when communication with the payment terminal 2000 is started ( S10 ), the smart card 1000 first receives payment request information from the payment terminal 2000 ( S11 ). The security module 400 wakes up the authentication information processing module 300 according to the payment request information and commands to sense the biometric information (S12). The authentication information processing module 300 enables the biometric recognition module 200 and senses a fingerprint (S13, S14). The biometric recognition module 200 checks whether the card user's finger has touched, and if so, senses a fingerprint (S15) and transmits a raw image (S16). After pre-processing the raw image, the authentication information processing module 300 generates fingerprint information for verification including a template through the CPU and accelerator (S17). The fingerprint information for verification is transmitted to the security module 400 (S18), and the security module 400 matches the registered fingerprint information with the fingerprint information for verification to confirm whether the user is the same (S19). If it is determined that the user is the same, a notification of use approval for the payment request information is transmitted to the payment terminal if it is not the same as a notification of usage approval (S23). Such use approval notification can also be displayed by lighting of LEDs through the indicator controller (S20 ~ S22).

Although the embodiments of the present invention have been described above with reference to the accompanying drawings, those of ordinary skill in the art to which the present invention pertains can realize that the present invention can be embodied in other specific forms without changing the technical spirit or essential features. you will be able to understand Therefore, it should be understood that the embodiments described above are illustrative in all respects and not restrictive.

1000: smart card
2000: payment terminal
3000 : payment server
100: integrated chip
200: biometric module
300: authentication information processing module
400: security module

Claims (20)

Peripheral circuitry for driving the fingerprint sensing array;
an authentication information processing module for processing the raw image received from the peripheral circuit as fingerprint information for verification; and
and a security module that matches the verification fingerprint information with the registered fingerprint information to determine whether to approve the use according to the payment request,
The peripheral circuit, the authentication information processing module, and the security module are integrated into one chip,
The security module will be overlapped with an active shield, smart card. The method of claim 1, wherein the security module
the active shield including a plurality of signal lines extending in a first direction in a plan view and spaced apart from each other and parallel to each other; and
1 . A smart card comprising a first side logic and a second side logic extending in a second direction perpendicular to the first direction in the plan view and electrically connected to ends of the plurality of signal lines intersecting each other. According to claim 2, wherein the security module is disposed under the active shield,
a first non-volatile memory for storing registered fingerprint information; and
and a security CPU that compares the verification fingerprint information with the registered fingerprint information and determines whether to approve the use according to a matching result. According to claim 2, wherein the security module is disposed under the active shield,
a crypto engine for encrypting or decrypting data transmitted or received outside the security module; and
The smart card further comprising a first memory for storing the encrypted data or the decrypted data. 5. The method of claim 4, wherein the security module is disposed under the active shield,
The smart card further comprising a mailbox in communication with the authentication information processing module. The method of claim 5, wherein the mailbox is
When it is not in use, it checks the size of the data to be transmitted and enters the transmission ready state.
Wake up the authentication information processing module and the security module enters a ready state,
A smart card for receiving the verification fingerprint information from the authentication information processing module. According to claim 1, wherein the authentication information processing module
a second memory for receiving and storing the raw image;
an accelerator for performing a Convolutional Neural Network (CNN) operation on the raw image;
a third memory for storing an intermediate value or a result value of the CNN operation; and
A smart card comprising a CPU for processing based on the raw image and the result value and processing the registered fingerprint information. The method of claim 7, wherein the authentication information processing module
The smart card further comprising a Spatial Frequency Response (SFR) unit for pre-processing the raw image and storing the raw image in the second memory. The method of claim 7, wherein the authentication information processing module
A smart card, further comprising a Serial Peripheral Interface (SPI) interface for connecting with an external device. In the biometric authentication-based smart card including only one chip,
the chip is
Including a peripheral circuit of the biometric sensor, an authentication information processing module and a security module,
The security module will be overlapped with an active shield, smart card. The method of claim 10, wherein the security module
the active shield including a plurality of signal lines extending in a first direction from an uppermost metal line and spaced apart from each other and parallel to each other; and
A smart card comprising a first side logic and a second side logic extending in a second direction perpendicular to the first direction and electrically connected to ends of the plurality of signal lines intersecting each other. The method of claim 10, wherein the peripheral circuit outputs a raw image sensed by the biometric sensor,
The authentication information processing module processes the raw image into fingerprint information for verification,
The security module matches the registered fingerprint information with the fingerprint information for verification, and outputs whether or not use is approved according to the matching result to the terminal, a smart card. The method of claim 12, wherein the security module
a mailbox communicating with the authentication information processing module;
a crypto engine for encrypting or decrypting data transmitted by the security module or received by the security module; and
The smart card further comprising a first memory for storing the encrypted data or the decrypted data. 14. The method of claim 13, wherein the mailbox is
When it is not in use, it checks the size of the data to be transmitted and enters the transmission ready state.
Wake up the authentication information processing module and the security module enters a ready state,
A smart card for receiving the verification fingerprint information from the authentication information processing module. 15. The method of claim 14, wherein the crypto engine encrypts the fingerprint information for verification,
The security module is a smart card that matches the encrypted fingerprint information for verification and the registered fingerprint information. The method of claim 10, wherein the authentication information processing module
A smart card, further comprising a Serial Peripheral Interface (SPI) interface for connecting with an external device. According to claim 1, wherein the authentication information processing module
a second memory for receiving and storing the raw image;
an accelerator for performing a Convolutional Neural Network (CNN) operation on the raw image;
a third memory for storing an intermediate value or a result value of the CNN operation; and
A smart card comprising a CPU for processing based on the raw image and the result value and processing the registered fingerprint information. an analog front end that outputs the raw image sensed by the biometric sensor;
an authentication information processing module that pre-processes the raw image and then processes it as fingerprint information for verification; and
Comprising a security module that compares the fingerprint information for verification with the registered fingerprint information, and outputs whether to approve the use of the payment request to the terminal,
A smart card in which the analog front end, the authentication information processing module and the security module are integrated into one chip. The method of claim 18, wherein the security module
an active shield extending in a first direction in a plan view of the chip and including a plurality of signal lines spaced apart from each other parallel to each other and overlapping the security module; and
A smart card comprising a first side logic and a second side logic extending in a second direction perpendicular to the first direction in the plan view and electrically connected to both ends of the plurality of signal lines to cross each other. The method of claim 18, wherein the authentication information processing module and the security module each include a protocol changer for transmitting and receiving AHB (Advanced high-performance bus) signals to each other,
The security module
a mailbox activated according to the AHB signal;
a crypto engine for encrypting the fingerprint information for verification received to the mailbox; and
and a security CPU that compares the encrypted fingerprint information for verification with the registered fingerprint information and outputs whether or not the use is approved.

Images