KR20230067458A - Authentication method and authentication system using biometric information and functional encryption - Google Patents

Abstract

In the authentication method between the device and the authentication server, the device generates a master private key and a master public key, uses the private information to be registered, the master private key and the master public key to generate a private key and a public key, and the individual to be registered First information is generated using the information, and the private key and the first information are transmitted to the authentication server. The private key and first information are stored in the security area of the authentication server. The device generates encrypted ciphertext using the personal information to be authenticated and the public key, generates second information using the personal information to be authenticated, and transmits the ciphertext and the second information to the authentication server. The authentication server performs authentication on the personal information to be authenticated using the private key, the first information, the ciphertext, and the second information, calculates a Euclidean distance to calculate a similarity between the personal information to be registered and the personal information to be authenticated, Authentication is performed based on similarity.

Description

Authentication method and authentication system using biometric information and function password {AUTHENTICATION METHOD AND AUTHENTICATION SYSTEM USING BIOMETRIC INFORMATION AND FUNCTIONAL ENCRYPTION}

The present invention relates to personal authentication technology, and more particularly, to an authentication method and an authentication system using biometric information and a function password.

With the development of biometric technology, biometric information authentication technologies for personal authentication using unique biometric information such as iris, fingerprint, DNA, retina, vein, gait, face, voice, etc. are being studied. However, since such biometric information cannot be changed voluntarily by each individual or is difficult to change, it is directly related to invasion of privacy when it is leaked during the authentication process. Therefore, for authentication using biometric information, a technique for preventing leakage of biometric information in the authentication process is essential.

Recently, various methods for enabling authentication without leakage of biometric information have been studied in a system requiring personal authentication for an unspecified number of people as well as a device possessed by an individual.

One object of the present invention is to provide an authentication method capable of effectively performing personal authentication without leakage of biometric information by utilizing biometric information and function encryption.

One object of the present invention is to provide an authentication system that performs the above authentication method.

In order to achieve the above object, in an authentication system including a device and an authentication server according to embodiments of the present invention, in an authentication method using functional encryption, in the device, a master private key and a master disclosure generate a key In the device, a private key and a public key are generated using the personal information to be registered, the master private key, and the master public key. In the device, first information is generated using the personal information to be registered. The device transmits the private key and the first information to the authentication server. The private key and the first information are stored in a secure area of the authentication server. In the device, encrypted ciphertext is generated using the personal information to be authenticated and the public key. In the device, second information is generated using the personal information to be authenticated. In the device, the encrypted text and the second information are transmitted to the authentication server. The authentication server performs authentication on the personal information to be authenticated using the private key, the first information, the encrypted text, and the second information. In performing the authentication of the personal information to be authenticated, a similarity between the personal information to be registered and the personal information to be authenticated is calculated by calculating a Euclidean distance between the personal information to be registered and the personal information to be authenticated. calculate The authentication is performed based on the degree of similarity.

In order to achieve the above object, in an authentication method using functional encryption in an apparatus according to embodiments of the present invention, a master private key and a master public key are generated. A private key and a public key are generated using the personal information to be registered, the master private key, and the master public key. First information is generated using the personal information to be registered. Store the private key and the first information in a secure area of the device. An encrypted ciphertext is generated using the personal information to be authenticated and the public key. Second information is generated using the personal information to be authenticated. Authentication of the personal information to be authenticated is performed using the private key, the first information, the ciphertext, and the second information. In performing the authentication of the personal information to be authenticated, a similarity between the personal information to be registered and the personal information to be authenticated is calculated by calculating a Euclidean distance between the personal information to be registered and the personal information to be authenticated. calculate The authentication is performed based on the degree of similarity.

In order to achieve the above object, an authentication system according to embodiments of the present invention includes a device and an authentication server. The authentication server communicates with the device, performs authentication utilizing functional encryption, and includes a secure realm. The device generates a master private key and a master public key, generates a private key and a public key using personal information to be registered, the master private key and the master public key, and uses the personal information to be registered to generate a master private key and a master public key. 1 information is generated, the private key and the first information are transmitted to the authentication server, an encrypted ciphertext is generated using the authentication target personal information and the public key, and the authentication target personal information is used to generate second authentication target information. information is generated, and the ciphertext and the second information are transmitted to the authentication server. The authentication server stores the private key and the first information in the secure area, and uses the private key, the first information, the cipher text, and the second information to obtain the registration target personal information and the authentication target. Calculate a similarity between the personal information to be registered and the personal information to be authenticated by calculating a Euclidean distance between the personal information to be registered and the personal information to be authenticated without exposing the personal information, and based on the similarity to perform authentication on the personal information to be authenticated. After transmitting the private key and the first information to the authentication server, the device physically erases the private key and the first information, and transmits the cipher text and the second information to the authentication server. Thereafter, the ciphertext and the second information are physically erased. The authentication server physically erases the ciphertext and the second information after performing the authentication of the personal information to be authenticated.

In the authentication method and authentication system according to the embodiments of the present invention as described above, authentication may be performed using a function password. Unlike public key cryptography, in which plaintext is obtained by encrypting plaintext using a public key and plaintext is obtained by decrypting the ciphertext using a private key, function cryptography obtains ciphertext by encrypting plaintext using a public key and obtains ciphertext using a function cipher. Authentication may be performed using a function value by obtaining only a function value without decrypting the ciphertext into plain text using a related secret key. In other words, authentication can be performed without decrypting the encrypted biometric information. Accordingly, personal authentication can be effectively performed without exposing personal information.

Also, similarity measurement may be performed by calculating the Euclidean distance in the authentication process, and in particular, the Euclidean distance may be calculated without directly using biometric information. Additionally, among information generated in the authentication process, some information that does not need to be stored may be deleted/erased. Therefore, personal authentication can be performed more safely and effectively.

1 is a flowchart illustrating an authentication method according to embodiments of the present invention.
2 is a block diagram illustrating an authentication system according to embodiments of the present invention.
3 and 4 are block diagrams illustrating devices included in an authentication system according to embodiments of the present invention.
5A and 5B are diagrams for explaining the operation of a device included in an authentication system according to embodiments of the present invention.
6 is a flowchart illustrating an example of a step of performing the personal information registration procedure of FIG. 1 .
7a, 7b, 7c, 7d, and 7e are diagrams for explaining the operation of FIG. 6 .
8 is a flowchart illustrating another example of performing the personal information registration procedure of FIG. 1 .
FIG. 9 is a diagram for explaining the operation of FIG. 8 .
10 is a flowchart illustrating another example of performing the personal information registration procedure of FIG. 1 .
FIG. 11 is a diagram for explaining the operation of FIG. 10 .
12 is a flowchart illustrating an example of performing the personal information authentication procedure of FIG. 1 .
13a, 13b, 13c, 13d and 13e are diagrams for explaining the operation of FIG. 12 .
14 is a flowchart illustrating an example of a step of performing authentication on personal information to be authenticated in FIG. 12 .
15 is a flowchart illustrating another example of performing the personal information authentication procedure of FIG. 1 .
FIG. 16 is a diagram for explaining the operation of FIG. 15 .
17 is a flowchart illustrating another example of performing the personal information authentication procedure of FIG. 1 .
FIG. 18 is a diagram for explaining the operation of FIG. 17 .
19 is a flowchart illustrating another example of performing the personal information authentication procedure of FIG. 1 .
FIG. 20 is a diagram for explaining the operation of FIG. 19 .
21 is a block diagram illustrating an authentication system according to embodiments of the present invention.
22 is a flowchart illustrating an example of performing the personal information registration procedure of FIG. 1 .
23a, 23b, 23c, 23d, and 23e are diagrams for explaining the operation of FIG. 22 .
24 is a flowchart illustrating another example of performing the personal information registration procedure of FIG. 1 .
25 is a flowchart illustrating an example of performing the personal information authentication procedure of FIG. 1 .
26a, 26b, 26c, 26d and 26e are diagrams for explaining the operation of FIG. 25 .
27 is a flowchart illustrating another example of performing the personal information authentication procedure of FIG. 1 .

Hereinafter, with reference to the accompanying drawings, preferred embodiments of the present invention will be described in more detail. The same reference numerals are used for the same components in the drawings, and redundant descriptions of the same components are omitted.

1 is a flowchart illustrating an authentication method according to embodiments of the present invention.

Referring to FIG. 1 , an authentication method according to embodiments of the present invention is performed by an authentication system. For example, the authentication system may include a device and an authentication server. In another example, the authentication system may include only a device. The configuration of the authentication system will be described later with reference to FIGS. 2 to 4 and 21 .

In the authentication method according to embodiments of the present invention, a personal information registration procedure is performed using functional encryption (step S100). The function encryption is utilized and a Euclidean distance is calculated to perform a personal information authentication procedure (step S200). For example, when the authentication system includes the authentication server, the personal information registration procedure and the personal information authentication procedure may be performed in the device and the authentication server. In another example, when the authentication system includes only the device without including the authentication server, the personal information registration procedure and the personal information authentication procedure may be performed in the device.

In one embodiment, personal information (eg, personal information to be registered and personal information to be authenticated) used in the personal information registration procedure and the personal information authentication procedure may be biometric information. For example, unique biometric information possessed by an individual such as iris, fingerprint, DNA, retina, vein, gait, face, voice, etc. may be used as the personal information.

Authentication technology using biometric information is being researched. This refers to confirming identity by extracting physical or behavioral characteristics of individuals such as retina, fingerprint, voice, and face for personal authentication.

In the authentication technology using biometric information as described above, it is important to safely store biometric information. For example, biometric information must be encrypted and stored in a hardware-safe storage space within a personal device. When biometric information is stored in an external server, there is a possibility of leakage of biometric information, and the range of utilization in an external device or external system requiring authentication may be narrow. In addition, in the actual verification process, the original biometric information must be confirmed, and there may be a possibility of biometric information leakage in terms of using the decrypted biometric information.

In the authentication method according to the embodiments of the present invention, authentication may be performed using function encryption. Unlike public key cryptography, which uses a public key to encrypt plaintext to obtain ciphertext and uses a private key to decrypt the ciphertext to obtain plaintext, function cryptography uses a public key to obtain plaintext. The ciphertext may be obtained by encryption, and only the function value may be obtained without decrypting the ciphertext into plaintext using a secret key related to the function, and authentication may be performed using the function value. In other words, authentication can be performed without decrypting the encrypted biometric information. Accordingly, personal authentication can be effectively performed without exposing personal information.

In addition, in the authentication method according to embodiments of the present invention, similarity measurement (measure similarity) may be performed by calculating the Euclidean distance in the authentication process, and in particular, the Euclidean distance may be calculated without directly using biometric information. . Additionally, among information generated in the authentication process, some information that does not need to be stored may be deleted/erased. Therefore, personal authentication can be performed more safely and effectively.

2 is a block diagram illustrating an authentication system according to embodiments of the present invention.

Referring to FIG. 2 , the authentication system 10 includes a device 20 and an authentication server 50 .

The device 20 is a personal device owned by a user, and can receive personal information to be registered, perform a personal information registration procedure, receive personal information to be authenticated, and generate information for performing a personal information authentication procedure.

The authentication server 50 is physically separated from the device 20, stores a key generated as a result of performing the personal information registration procedure, receives information corresponding to the personal information to be authenticated from the device 20, and The personal information authentication procedure may be performed using the received information and the stored key.

3 and 4 are block diagrams illustrating devices included in an authentication system according to embodiments of the present invention.

Referring to FIG. 3 , the device 100 may include a system-on-chip (SOC) 110 and an input/output device 120 .

In one embodiment, when the device 100 is a mobile device, the system on chip 110 may be a component such as an application processor (AP) included in the device 100 .

The system on chip 110 may include a bus 111 , a processor 113 , a memory 115 , a communication interface unit 117 , and an input/output interface unit 119 . For convenience of illustration, the system-on-a-chip 110 and other components of a device including the same will be described later in detail with reference to FIG. 4 .

The processor 113 may control overall operations of the system on chip 110 . For example, when the device 100 is a mobile device, the processor 113 may execute an operating system (OS) for driving the mobile device, and may operate an Internet browser, games, videos, and a camera. You can run various applications provided. For example, the processor 113 may include a central processing unit (CPU), a microprocessor, and the like.

In one embodiment, as described below with reference to FIG. 4, processor 113 may be driven by a secure operating system and a non-secure operating system. The system on chip 110 and the device 100 may operate in a secure mode (trusted execution mode or secure mode) based on the secure operating system, and may operate in a non-secure mode (non-trusted execution mode) based on the non-secure operating system. , non-secure mode or normal mode).

According to embodiments, the processor 113 may be implemented as a single core or as a multi-core processor. For example, the processor 113 may be implemented in a multi-core form, such as dual-core, quad-core, or hexa-core. Also, according to embodiments, the processor 113 may further include an internal or external cache memory.

The memory 115 may store data processed by the processor 113 . For example, when the device 100 is a mobile device, the memory 115 stores a boot image for booting the mobile device and a file system related to an operating system for driving the mobile device. ), a device driver related to an external device connected to the mobile device, and an application running on the mobile device. For example, the memory 115 may include at least one of volatile memory and non-volatile memory.

The communication interface unit 117 may communicate with the outside of the device 100 (eg, the authentication server 50 of FIG. 2 ). For example, the communication interface unit 117 may perform wireless communication such as WIFI communication with the outside, 3G communication, Long Term Evolution (LTE) communication, and 5G communication.

The input/output interface unit 119 may communicate with the input/output device 120 located inside the device 100 . For example, the input/output interface unit 119 may perform communication with the input/output device 120 of a predetermined standard such as MIPI (Mobile Industry Processor Interface).

The input/output device 120 may include a biometric information extractor 121 . Personal information to be registered and personal information to be authenticated necessary to perform the authentication method according to the embodiments of the present invention may be input through the biometric information extractor 121 . For example, the personal information to be registered and the personal information to be authenticated may be biometric information such as iris, fingerprint, DNA, retina, vein, gait, face, voice, etc., but the present invention is not limited thereto, and each individual It may include various types of information that can be used to prove the identity of . For example, the biometric information extractor 121 may include various types of input means such as sensors and cameras for receiving the personal information to be registered and the personal information to be authenticated.

For convenience, the input/output device 120 is illustrated as including only the biometric information extractor 121, but the present invention is not limited thereto, and input means such as a keyboard, keypad, touchpad, touchscreen, mouse, remote controller, and display , It may further include an output means such as a speaker, a printer, and the like.

In one embodiment, the device 100 may be a mobile phone, laptop, or automotive, but the present invention is not limited thereto. According to an embodiment, the device 100 may be used in a personal computer (PC), a server computer, a data center, a workstation, a digital television, a set-top box, and the like. top box), or smart phone, tablet PC (Personal Computer), PDA (Personal Digital Assistant), PMP (Portable Multimedia Player), digital camera, camcorder (camcorder), portable game console, music player, video player, navigation device, wearable device, IoT (Internet of Things) device, e-book It may be any mobile device such as an e-book, a Virtual Reality (VR) device, an Augmented Reality (AR) device, or a drone.

Referring to FIG. 4 , the device 200 includes a system on chip 201, a biometric information extractor (BIE) 242, a communication processor (CP) 244, a volatile memory, VM) 260, a nonvolatile memory (NVM) 270, and an embedded secure element (eSE) 280. 4 shows an example in which the device 200 is implemented as a mobile device.

The system on chip 201 may control overall operations of the device 200 . The system-on-chip 201 includes a processor 210, a generic interrupt controller (GIC) 212, a trust zone protection controller (TZPC) 250, and a first internal read-only memory (IROM). ) 222, a second internal random access memory (IRAM) 224, a memory adapter (TrustZone memory adapter, TZMA) 226, a first interface unit (biometric interface, BIF) 232, a second An interface unit (CP interface, CIF) 234, a first firewall (contents firewall, CFW) 236, a second firewall 238, a first memory controller (VM controller) 262, an address space protector A protector (ASP) 264 , a second memory controller (NVM controller) 272 , a third interface unit (eSE interface) 282 and a bus 203 may be included.

The processor 210 may correspond to the processor 113 of FIG. 3 . For convenience, only one processor 210 is shown, but according to embodiments, the system on chip 201 may include two or more processors. The processor 210 may be connected to other hardware through the bus 203 . For example, processor 210 may include an ARM processor core, and bus 203 may be an Advanced Microcontroller Bus Architecture (AMBA) bus.

The interrupt controller 212 may set security attributes of all interrupt resources in the system on chip 201 . For example, the interrupt controller 212 may classify interrupts into a secure interrupt (Fast Interrupt request; FIQ) and a non-secure interrupt (Interrupt Request; IRQ). Setting of the security attributes as described above may be possible only in the security mode. The secure interrupt may be processed in the secure mode, and the non-secure interrupt may be processed in the non-secure mode.

The protection controller 250 may set security attributes of all hardware resources in the system on chip 201 . For example, the protection controller 250 may classify hardware into a secure mode and a non-secure mode. Setting of the security attributes as described above may be possible only in the security mode, and not in the non-security mode. The secure mode hardware can operate in the secure mode, and the non-secure mode hardware can operate in the non-secure mode. Depending on embodiments, a piece of hardware may operate in both the secure mode and the non-secure mode.

The first internal memory 222 and the second internal memory 224 may correspond to the memory 115 of FIG. 3 . For example, the first internal memory 222 may include at least one non-volatile memory, and the second internal memory 224 may include at least one volatile memory.

The memory adapter 226 may divide the storage area of the second internal memory 224 into a secure area and a non-secure area in association with the protection controller 250 . The division of the storage area as described above may be possible only in the security mode.

The first interface unit 232 and the second interface unit 234 may correspond to the input/output interface unit 119 and the communication interface unit 117 of FIG. 3 , respectively. For example, the first interface unit 232 may connect the external biometric information extractor 242 and the system on chip 201 so that the system on chip 201 receives the biometric information, and the second interface unit 234 may connect the external communication processor 244 and the system on chip 201 so that the system on chip 201 performs wireless communication.

Firewalls 236 and 238 can control the accessible address space of hardware and can prevent information in the secure mode from leaking into the non-secure mode. For example, the first firewall 236 may control an accessible address space of the first interface unit 232, and security is provided when the system on chip 201 exchanges data with the biometric information extractor 242. Access to at least some of the area and non-security area may be restricted. The second firewall 238 may control an accessible address space of the second interface unit 234, and in the case where the system on chip 201 exchanges data with the communication processor 244, a security area and a non-security area are selected. You can restrict access to at least some of them.

The first memory controller 262 may control the operation of the external volatile memory 260 . For example, the volatile memory 260 may include at least one volatile memory such as dynamic random access memory (DRAM) or static random access memory (SRAM).

The address space protector 264 can divide the storage area of the volatile memory 260 into a secure area and a non-secure area, and can control access of hardware to the volatile memory 260 .

The second memory controller 272 may control the operation of the external non-volatile memory 270 . For example, the nonvolatile memory 270 includes electrically erasable programmable read-only memory (EEPROM), flash memory, phase change random access memory (PRAM), resistance random access memory (RRAM), nano floating memory (NFGM), and the like. gate memory), polymer random access memory (PoRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), and the like, and an embedded multimedia card (eMMC). ), universal flash storage (UFS), and the like.

The third interface unit 282 may connect the external embedded security device 280 and the system on chip 201 so that the system on chip 201 exchanges security data with the embedded security device 280 . The system on chip 201 may execute various security applications such as financial transactions and product purchases using the embedded security device 280 in the security mode.

System on chip 201 and device 200 may operate in the secure mode according to embodiments of the present invention.

In one embodiment, the operation in the secure mode described above with reference to FIGS. 3 and 4 may be executed and implemented based on TrustZone technology.

Meanwhile, with reference to FIG. 4 , MIPI, wireless communication, and eSE interfaces have been described as examples of interfaces of the system-on-chip 201, but the interface of the system-on-chip 201 may not be limited thereto. For example, the system on chip 201 may include universal serial bus communication, Ethernet communication, near field communication (NFC), radio frequency identification (RFID) communication, GSM , GPRS, WCDMA, may further include an interface capable of supporting communication such as HSxPA.

Meanwhile, although not shown in detail, the authentication server included in the authentication system according to the embodiments of the present invention may also be implemented similarly to the device described above with reference to FIGS. 3 and 4 . For example, the authentication server may include a processor, a memory, an interface unit, and the like, and may operate in a secure mode based on a secure operating system or in a non-secure mode based on a non-secure operating system.

5A and 5B are diagrams for explaining the operation of a device included in an authentication system according to embodiments of the present invention.

Referring to FIGS. 3, 5A and 5B , an operation of acquiring personal information to be registered (X) and personal information to be authenticated (Y) using the biometric information extractor 121 included in the device 100 is illustrated. For example, the personal information to be registered (X) and the personal information to be authenticated (Y) may include user's fingerprint information.

As shown in FIG. 5A , in the case of performing the personal information registration procedure, the biometric information extractor 121 may acquire the personal information (X) to be registered from the user's finger 125 through the fingerprint recognition window 123. there is. For example, a first video signal or a first fingerprint image of a fingerprint included in the user's finger 125 may be obtained as the personal information (X) to be registered.

As shown in FIG. 5B , in the case of performing the personal information authentication procedure, the biometric information extractor 121 may obtain authentication target personal information Y from the user's finger 127 through the fingerprint recognition window 123. there is. For example, a second video signal or a second fingerprint image of a fingerprint included in the user's finger 127 may be obtained as the personal information Y to be authenticated.

In one embodiment, the personal information to be registered (X) and the personal information to be authenticated (Y) extracted as biometric information may be expressed as values divided into specific sizes for each corresponding area. For example, personal information (X) to be registered includes a plurality of values (x ₁ , x ₂ , ..., x _k , x _k+1 , ..., x _l ) (k is a natural number greater than 2, l is a natural number greater than k+1), and the personal information (Y) to be authenticated includes a plurality of values (y ₁ , y ₂ , ..., y _k , y _k+1 , ..., y _l ) can include For example, the plurality of values (x ₁ to x _l and y ₁ to y _l ) may include information corresponding to ridges and valleys of a fingerprint included in a fingerprint image.

In an embodiment, personal information (X) to be registered and personal information (Y) to be authenticated may be expressed as [Equation 1] and [Equation 2], respectively.

[Equation 1]

[Equation 2]

In another embodiment, personal information (X) to be registered and personal information (Y) to be authenticated may be expressed as [Equation 3] and [Equation 4], respectively.

[Equation 3]

[Equation 4]

6 is a flowchart illustrating an example of a step of performing the personal information registration procedure of FIG. 1 . 7a, 7b, 7c, 7d, and 7e are diagrams for explaining the operation of FIG. 6 .

In FIGS. 7a , 7b , 7c , 7d and 7e and subsequent drawings, device 20 and authentication server 50 may correspond to device 20 and authentication server 50 of FIG. 2 , respectively. The biometric information extractor 21 and processor 23 included in the device 20 may correspond to the biometric information extractor 121 and processor 113 of FIG. 3 , respectively. As described above with reference to Figures 3 and 4, the processor 23 can operate in a secure mode or a non-secure mode. The secure memory 51 and the secure processor 53 included in the authentication server 50 may each represent a memory and a processor operating in a secure mode.

1, 6, 7a, 7b, 7c, 7d and 7e, in performing the personal information registration procedure (step S100), in the device 20 (ie, the processor 23 included in the device 20) ) may generate a master private key (MSK) and a master public key (MPK) (step S110). For example, the master private key (MSK) and the master public key (MPK) may be obtained based on [Equation 5], [Equation 6], and [Equation 7] below.

[Equation 5]

[Equation 6]

[Equation 7]

Thereafter, in the device 20 (ie, the processor 23 included in the device 20), the personal information X to be registered may be obtained from the biometric information extractor 21. Then, in the device 20 (ie, the processor 23 included in the device 20), the personal information to be registered (X), the master private key (MSK) and the master public key (MPK) are used to A key (SK _<X> ) and a public key (PK _X ) may be generated (step S120). For example, the private key (SK _<X> ) and the public key (PK _X ) may be obtained based on [Equation 8], [Equation 9], and [Equation 10] below.

[Equation 8]

[Equation 9]

[Equation 10]

In [Equation 8] and [Equation 9], the symbol <> represents an inner product. In other words, the private key SK _<X> can be obtained by computing a dot product.

Subsequently, in the device 20 (ie, the processor 23 included in the device 20), first information X _A may be generated using the personal information X to be registered (step S130). ). For example, the first information (X _A ) may be obtained based on [Equation 11] below.

[Equation 11]

In one embodiment, the first information (X _A ) may be obtained by calculating a dot product. According to embodiments of the present invention, in addition to the public key (PK _X ), first information (X _A ) used to perform the personal information authentication procedure of step S200 may be additionally generated.

After that, the device 20 (that is, the processor 23 included in the device 20) may transmit the private key (SK _<X> ) and the first information (X _A ) to the authentication server 50. Yes (step S140). The private key (SK _<X> ) and the first information (X _A ) may be stored in a secure area (ie, secure memory 51) of the authentication server 50 (step S150).

Depending on embodiments, some or all of steps S110, S120 and S130 may be performed in the secure mode of the device 20 or in the non-secure mode. _In addition _{, part} or All may be stored in a storage area (eg, secure area or secure memory) of device 20 .

8 is a flowchart illustrating another example of performing the personal information registration procedure of FIG. 1 . FIG. 9 is a diagram for explaining the operation of FIG. 8 . Descriptions overlapping those of FIGS. 6, 7a, 7b, 7c, 7d, and 7e will be omitted.

1, 8 and 9, in performing the personal information registration procedure (step S100), steps S110, S120, S130, S140 and S150 are respectively steps S110, S120, S130, S140 and S150 of FIG. may be substantially the same.

After the device 20 transmits the private key (SK _<X> ) and the first information (X _A ) to the authentication server 50, that is, after step S140, the device 20 transmits the private key (SK _{<X >} ) and the first information (X _A ) may be deleted (step S145). The personal information authentication process of step S200 (for example, the authentication operation of step S240 of FIG. 12) is performed in the authentication server 50, and the private key (SK _<X> ) and the first information (X _A ) are the authentication server Since they are safely stored in the secure area (ie, the secure memory 51) of (50), unnecessary private keys (SK _<X> ) and first information (X _A ) can be deleted from the device 20. In FIG. 9 , the deleted private key (SK _<X> ) and the first information (X _A ) are indicated by dotted lines.

In one embodiment, the private key (SK _<X> ) and the first information (X _A ) in the device 20 may be physically erased. As described above, the private key SK _<X> and the first information X _A may be stored in the storage area of the device 20, and the private key SK _<X> and the first information X _A By not only deleting from the processor 23 but also physically erasing it from the storage area, it is possible to make it impossible to restore the private key (SK _<X> ) and the first information (X _A ) in the device 20 . For example, when the storage area is included in a nonvolatile memory such as a flash memory, an erase operation of applying an erase voltage is performed to physically store the private key (SK _<X> ) and the first information (X _A ). can be erased

10 is a flowchart illustrating another example of performing the personal information registration procedure of FIG. 1 . FIG. 11 is a diagram for explaining the operation of FIG. 10 . Descriptions overlapping those of FIGS. 6, 7a, 7b, 7c, 7d, 7e, 8, and 9 will be omitted.

1, 10 and 11, in performing the personal information registration procedure (step S100), steps S110, S120, S130, S140 and S150 are respectively steps S110, S120, S130, S140 and S150 of FIG. may be substantially the same.

After the device 20 generates the private key (SK _<X> ), the public key (PK _X ) and the first information (X _A ), that is, after steps S120 and S130, the device 20 uses the master private key (MSK), master public key (MPK), and personal information (X) to be registered can be deleted (step S135). Since the master private key (MSK), master public key (MPK), and personal information (X) to be registered are not used in the personal information authentication procedure of step S200 (for example, the authentication operation of step S240 of FIG. 12), unnecessary The master private key (MSK), master public key (MPK), and personal information (X) to be registered may be deleted from the device 20 .

In one embodiment, the master private key (MSK), master public key (MPK), and personal information (X) subject to registration may be physically erased from the device 20 .

Depending on the embodiment, both step S145 of FIG. 8 and step S135 of FIG. 10 may be performed.

12 is a flowchart illustrating an example of performing the personal information authentication procedure of FIG. 1 . 13a, 13b, 13c, 13d and 13e are diagrams for explaining the operation of FIG. 12 .

1, 12, 13a, 13b, 13c, 13d and 13e, in performing the personal information authentication procedure (step S200), in the device 20 (ie, the processor 23 included in the device 20) )), it is possible to obtain the personal information (Y) to be authenticated from the biometric information extractor 21 . In addition, the device 20 (ie, the processor 23 included in the device 20) may obtain the public key (PK _X ) stored in the storage area.

Then, in the device 20 (ie, the processor 23 included in the device 20), the encrypted ciphertext (CT _Y ) is generated using the personal information (Y) to be authenticated and the public key (PK _X ). It can be created (step S210). For example, the cipher text (CT _Y ) may be obtained based on [Equation 12] and [Equation 13] below.

[Equation 12]

[Equation 13]

Subsequently, in the device 20 (ie, the processor 23 included in the device 20), second information Y _A may be generated using the personal information Y to be authenticated (step S220). ). For example, the second information (Y _A ) may be obtained based on the following [Equation 14].

[Equation 14]

In one embodiment, similar to the first information (X _A ), the second information (Y _A ) may be obtained by computing a dot product. According to embodiments of the present invention, second information (Y _A ) used to perform the personal information authentication procedure may be additionally generated in addition to the encrypted text (CT _Y ).

After that, the device 20 (ie, the processor 23 included in the device 20) may transmit the cipher text (CT _Y ) and the second information (Y _A ) to the authentication server 50 (step S230). The encrypted text (CT _Y ) and the second information (Y _A ) may be provided to the security processor 53 of the authentication server 50 . In addition, in the authentication server 50 (ie, the security processor 53 included in the authentication server 50), the private key (SK _<X> ) stored in the secure area (ie, the secure memory 51) and The first information (X _A ) may be obtained.

After that, in the authentication server 50 (ie, the security processor 53 included in the authentication server 50), the private key (SK _<X> ), the first information (X _A ), the ciphertext (CT _Y ) And it is possible to perform authentication (AOP) on the personal information (Y) to be authenticated using the second information (Y _A ) (step S240). The authentication server 50 (ie, the security processor 53 included in the authentication server 50) may transmit an authentication result signal (ARS) indicating success or failure of authentication (AOP) to the device 20. .

Depending on the embodiment, some or all of steps S210 and S220 may be performed in the secure mode of the device 20 or in the non-secure mode. In addition, some or all of the personal information to be authenticated (Y), the password text (CT _Y ), and the second information (Y _A ) may be stored in a storage area (eg, a secure area or a secure memory) of the device 20. there is. Step S240 may be performed in the security mode of the authentication server 50 . Some or all of the encrypted text (CT _Y ) and the second information (Y _A ) may be stored in the secure memory 51 of the authentication server 50 .

14 is a flowchart illustrating an example of a step of performing authentication on personal information to be authenticated in FIG. 12 .

12 and 14, in performing the authentication of the personal information to be authenticated (step S240), the Euclidean distance between the personal information to be registered (X) and the personal information to be authenticated (Y) is calculated to determine the individual to be registered. A similarity between the information (X) and the personal information to be authenticated (Y) may be calculated (step S241), and the authentication may be performed based on the similarity (step S243).

Specifically, the Euclidean distance may be obtained based on the following [Equation 15]. At this time, the authentication may be obtained based on the following [Equation 16].

[Equation 15]

[Equation 16]

When the Euclidean distance is greater than or equal to 0 and less than a threshold value (thr), it is determined that the authentication is successful, and when the Euclidean distance is greater than or equal to the threshold value (thr), it is determined that the authentication has failed. . However, when steps S241 and S243 are performed based on [Equation 15] and [Equation 16], the personal information (X) to be registered and the personal information (Y) to be authenticated must be directly used.

According to embodiments of the present invention, the Euclidean distance of personal information to be registered (X) and personal information to be authenticated (Y) can be calculated without exposing personal information to be registered (X) and personal information to be authenticated (Y). can

In one embodiment, the Euclidean distance between the personal information to be registered (X) and the personal information to be authenticated (Y) is determined by the private key (SK _<X> ), the first information (X _A ), the cipher text (CT _Y ), and the second information (Y _A ). For example, steps S241 and S243 may be performed based on [Equation 17], [Equation 18], [Equation 19], and [Equation 20] below.

[Equation 17]

[Equation 18]

[Equation 19]

[Equation 20]

In other words, instead of directly comparing the Euclidean distance (ED(X,Y)) obtained by directly using the personal information to be registered (X) and the personal information to be authenticated (Y) and the threshold value (thr), the private key ( SK _<X> ), g ^<XY,XY> obtained using the first information (X _A ), the cipher text (CT _Y ), and the second information (Y _A ) is g ⁰ , g ¹ , g ² , .. ., g ^thr-1, it is possible to perform the authentication by determining whether. For example, the threshold value thr may be determined in various ways according to embodiments.

According to the embodiments of the present invention, the private key (SK _<X> ), the first information (X A ), and the cipher text (CT _Y ) without directly using the personal information (X) to be registered and the personal information (Y ₎ to be certified. ) and the second information (Y _A ), personal authentication can be performed more safely and effectively without exposing personal information (X) to be registered and personal information (Y) to be authenticated.

15 is a flowchart illustrating another example of performing the personal information authentication procedure of FIG. 1 . FIG. 16 is a diagram for explaining the operation of FIG. 15 . Descriptions overlapping those of FIGS. 8, 9, 12, 13a, 13b, 13c, 13d, and 13e will be omitted.

1, 15 and 16, in performing the personal information authentication procedure (step S200), steps S210, S220, S230 and S240 may be substantially the same as steps S210, S220, S230 and S240 of FIG. 12, respectively. can

After the device 20 transmits the cipher text (CT _Y ) and the second information (Y _A ) to the authentication server 50, that is, after step S230, the device 20 transmits the cipher text (CT _Y ) and the second information (Y _A ) can be deleted (step S235). Since the authentication operation of step S240 is performed in the authentication server 50, the device 20 may delete unnecessary cipher text (CT _Y ) and second information (Y _A ).

In one embodiment, the ciphertext (CT _Y ) and the second information (Y _A ) may be physically erased in the device 20 .

17 is a flowchart illustrating another example of performing the personal information authentication procedure of FIG. 1 . FIG. 18 is a diagram for explaining the operation of FIG. 17 . Descriptions overlapping those of FIGS. 8, 9, 12, 13a, 13b, 13c, 13d, and 13e will be omitted.

1, 17 and 18, in performing the personal information authentication procedure (step S200), steps S210, S220, S230 and S240 may be substantially the same as steps S210, S220, S230 and S240 of FIG. 12, respectively. can

After the authentication server 50 performs the authentication of the personal information (Y) to be authenticated, that is, after step S240, the authentication server 50 deletes the ciphertext (CT _Y ) and the second information (Y _A ). It can (step S245). Since the cipher text (CT _Y ) and the second information (Y _A ) are no longer needed after the authentication operation of step S240 is performed, the unnecessary cipher text (CT _Y ) and the second information (Y _A ) are transferred to the authentication server 50 ) can be deleted.

In one embodiment, the cipher text (CT _Y ) and the second information (Y _A ) may be physically erased in the authentication server 50 .

19 is a flowchart illustrating another example of performing the personal information authentication procedure of FIG. 1 . FIG. 20 is a diagram for explaining the operation of FIG. 19 . Descriptions overlapping those of FIGS. 8, 9, 12, 13a, 13b, 13c, 13d, and 13e will be omitted.

1, 19 and 20, in performing the personal information authentication procedure (step S200), steps S210, S220, S230 and S240 may be substantially the same as steps S210, S220, S230 and S240 of FIG. 12, respectively. can

After generating the encryption text (CT _Y ) and the second information (Y _A ) in the device 20, that is, after steps S210 and S220, the device 20 may delete the personal information (Y) to be authenticated (step S225). Since the personal information (Y) to be authenticated is not used in the authentication operation of step S240, unnecessary personal information (Y) to be authenticated may be deleted from the device 20.

In one embodiment, the personal information Y to be authenticated in the device 20 may be physically erased.

Depending on the embodiment, two or three of steps S235 of FIG. 15 , step S245 of FIG. 17 , and step S225 of FIG. 19 may be performed.

21 is a block diagram illustrating an authentication system according to embodiments of the present invention.

Referring to FIG. 21 , authentication system 12 includes device 30 . Authentication system 12 may include only device 30 without an authentication server.

The device 30 is a personal device owned by a user, receives personal information to be registered, performs a personal information registration procedure, stores a key generated as a result of performing the personal information registration procedure, and receives personal information to be authenticated. Information for performing a personal information authentication procedure may be generated, and the personal information authentication procedure may be performed using the information and the key.

Device 30 is similar to device 20 of FIG. 2 and may be implemented similarly to that described above with reference to FIGS. 3 and 4 .

22 is a flowchart illustrating an example of performing the personal information registration procedure of FIG. 1 . 23a, 23b, 23c, 23d, and 23e are diagrams for explaining the operation of FIG. 22 . Descriptions overlapping those of FIGS. 6, 7a, 7b, 7c, 7d, and 7e will be omitted.

In FIGS. 23A, 23B, 23C, 23D and 23E and subsequent figures, device 30 may correspond to device 30 of FIG. 21 . The biometric information extractor 31, processor 33, and secure memory 35 included in the device 30 may correspond to the biometric information extractor 121, processor 113, and memory 115 of FIG. 3, respectively. The processor 33 may operate in a secure mode or a non-secure mode. Secure memory 35 may represent memory operating in a secure mode.

1, 22, 23a, 23b, 23c, 23d and 23e, in performing the personal information registration procedure (step S100), in the device 30 (ie, the processor 33 included in the device 30) ) may generate a master private key (MSK) and a master public key (MPK) (step S110).

Thereafter, in the device 30 (ie, the processor 33 included in the device 30), the personal information X to be registered may be obtained from the biometric information extractor 31. After that, in the device 30 (ie, the processor 33 included in the device 30), the personal information (X) to be registered, the master private key (MSK) and the master public key (MPK) are used to A key (SK _<X> ) and a public key (PK _X ) may be generated (step S120).

Subsequently, in the device 30 (ie, the processor 33 included in the device 30), first information X _A may be generated using the personal information X to be registered (step S130). ).

Thereafter, the private key (SK _<X> ) and the first information (X _A ) may be stored in a secure area (ie, secure memory 35) of the device 30 (step S150a).

Steps S110, S120 and S130 are substantially the same as steps S110, S120 and S130 of FIG. 6, respectively, and step S150a may be similar to step S150 of FIG.

24 is a flowchart illustrating another example of performing the personal information registration procedure of FIG. 1 . Descriptions overlapping those of FIGS. 10, 22, 23a, 23b, 23c, 23d and 23e will be omitted.

1 and 24, in performing the personal information registration procedure (step S100), steps S110, S120, S130 and S150a may be substantially the same as steps S110, S120, S130 and S150a of FIG. 22, respectively. .

After the device 20 generates the private key (SK _<X> ), the public key (PK _X ) and the first information (X _A ), that is, after steps S120 and S130, the device 20 uses the master private key (MSK), master public key (MPK), and personal information (X) to be registered can be deleted (step S135). Step S135 may be substantially the same as step S135 of FIG. 10 .

25 is a flowchart illustrating an example of performing the personal information authentication procedure of FIG. 1 . 26a, 26b, 26c, 26d and 26e are diagrams for explaining the operation of FIG. 25 . Descriptions overlapping those of FIGS. 12, 13a, 13b, 13c, 13d, and 13e will be omitted.

1, 25, 26a, 26b, 26c, 26d and 26e, in performing the personal information authentication procedure (step S200), in the device 30 (ie, the processor 33 included in the device 30) )), it is possible to obtain the personal information (Y) to be authenticated from the biometric information extractor 31 . In addition, the device 30 (ie, the processor 33 included in the device 30) may obtain the public key PK _X stored in the storage area.

Then, in the device 30 (ie, the processor 33 included in the device 30), the encrypted cipher text (CT _Y ) is generated using the personal information (Y) to be authenticated and the public key (PK _X ). It can be created (step S210).

Subsequently, in the device 30 (ie, the processor 33 included in the device 30), second information Y _A may be generated using the personal information Y to be authenticated (step S220). ).

Then, in the device 30 (ie, the processor 33 included in the device 30), the private key SK _<X> stored in the secure area (ie, the secure memory 35) and the first Information (X _A ) can be obtained. Then, in the device 30 (ie, the processor 33 included in the device 30), the private key (SK _<X> ), the first information (X _A ), the ciphertext (CT _Y ) and the second Authentication ( _AOP ) on the personal information (Y) to be authenticated may be performed using the information (Y A ) (step S240a).

Steps S210 and S220 are substantially the same as steps S210 and S220 of FIG. 12 , respectively, and step S240a may be similar to step S240 of FIG. 12 .

27 is a flowchart illustrating another example of performing the personal information authentication procedure of FIG. 1 . Descriptions overlapping those of FIGS. 17, 25, 26a, 26b, 26c, 26d, and 26e will be omitted.

1 and 27, in performing the personal information authentication procedure (step S200), steps S210, S220 and S240a may be substantially the same as steps S210, S220 and S240a of FIG. 25, respectively.

After the device 30 performs the authentication of the personal information Y to be authenticated, that is, after step S240a, the device 30 may delete the passphrase (CT _Y ) and the second information (Y _A ). (Step S245). Step S245 may be substantially the same as step S245 of FIG. 17 .

Meanwhile, embodiments of the present invention may be implemented in the form of a product including a computer readable program code stored in a computer readable medium. The computer readable program code may be provided to processors of various computers or other data processing devices. The computer-readable medium may be a computer-readable signal medium or a computer-readable recording medium. The computer-readable recording medium may be any tangible medium capable of storing or including a program in or connected to an instruction execution system, equipment, or device. For example, the computer-readable medium may be provided in the form of a non-transitory storage medium. Here, non-temporary means that the storage medium does not contain a signal and is tangible, but does not distinguish whether data is stored semi-permanently or temporarily in the storage medium.

Embodiments of the present invention can be usefully used in the design of any electronic device and system requiring personal authentication. For example, embodiments of the present invention may be used in personal computers (PCs), server computers, data centers, workstations, laptops, cellular phones, and smart phones. phone), MP3 player, PDA (Personal Digital Assistant), PMP (Portable Multimedia Player), digital TV, digital camera, portable game console, navigation device, wearable device, IoT (Internet Electronic systems such as Things of Things (IoT) devices, IoE (Internet of Everything) devices, e-books, VR (Virtual Reality) devices, AR (Augmented Reality) devices, drones, automotive, etc. may be more useful.

Although the above has been described with reference to preferred embodiments of the present invention, those skilled in the art can variously modify and change the present invention without departing from the spirit and scope of the present invention described in the claims below. you will understand that you can

Claims (10)

In an authentication system including a device and an authentication server, an authentication method utilizing functional encryption, comprising:
generating, in the device, a master private key and a master public key;
generating, in the device, a private key and a public key using the personal information to be registered, the master private key, and the master public key;
In the device, generating first information using the personal information to be registered;
In the device, transmitting the private key and the first information to the authentication server;
storing the private key and the first information in a secure area of the authentication server;
Generating, in the device, encrypted cipher text using personal information to be authenticated and the public key;
In the device, generating second information using the personal information to be authenticated;
In the device, transmitting the encrypted text and the second information to the authentication server; and
In the authentication server, performing authentication on the personal information to be authenticated using the private key, the first information, the cipher text, and the second information,
The step of performing the authentication on the authentication target personal information,
calculating a similarity between the personal information to be registered and the personal information to be authenticated by calculating a Euclidean distance between the personal information to be registered and the personal information to be authenticated; and
and performing the authentication based on the degree of similarity. According to claim 1,
wherein the Euclidean distance between the personal information to be registered and the personal information to be authenticated is calculated without exposing the personal information to be registered and the personal information to be authenticated. According to claim 1,
In the device, after transmitting the private key and the first information to the authentication server, the authentication method further comprising the step of deleting the private key and the first information. According to claim 3,
In the device, the private key and the first information are physically erased. According to claim 1,
In the device, after transmitting the cipher text and the second information to the authentication server, the authentication method further comprising the step of deleting the cipher text and the second information. According to claim 5,
In the device, the ciphertext and the second information are physically erased. According to claim 1,
and deleting, in the authentication server, the ciphertext and the second information after performing the authentication of the personal information to be authenticated. According to claim 1,
The authentication method, characterized in that the personal information to be registered and the personal information to be authenticated are biometric information. According to claim 1,
Wherein the first information and the second information are generated by calculating an inner product. In a device, as an authentication method using functional encryption,
generating a master private key and a master public key;
generating a private key and a public key using the personal information to be registered, the master private key, and the master public key;
generating first information by using the personal information to be registered;
storing the private key and the first information in a secure area of the device;
generating an encrypted ciphertext using personal information to be authenticated and the public key;
generating second information using the personal information to be authenticated; and
Performing authentication on the personal information to be authenticated using the private key, the first information, the ciphertext, and the second information;
The step of performing the authentication on the authentication target personal information,
calculating a similarity between the personal information to be registered and the personal information to be authenticated by calculating a Euclidean distance between the personal information to be registered and the personal information to be authenticated; and
and performing the authentication based on the degree of similarity.

Images