TWM642599U - identity verification system - Google Patents

Abstract

A system and device for multiple confirmation of the user's identity, which is applied to the account authentication of a financial institution, and its signal is connected to a user device belonging to at least one user, and the first check is performed by logging in to the webpage of the online mobile bank through an account number and password. Then, combined with the biometric information of the user device for a second check, and then through the Fast IDentity Online technology, the external verification server is compared with the telecommunications server to compare the user data, and the biometric information generated by the user device After verification of the public key and identity information generated by the private key and telecommunications information of the mobile device, a digital signature is generated to bind the user's device, which can effectively prevent the possibility of the user's user identity module being stolen, and its verification operation The method is the same as the current authentication and will not impose more burden on users.

Description

identity verification system

An identity verification system, the user uses the mobile device to enter the account password, further through Fast IDentity Online technology, the bank and the telecommunications end will compare the user information, and then use the external verification server and the user's mobile device Biometric pairing further completes user identity authentication.

The current online application for bank accounts is only done through text messages to bind services with personal mobile devices such as mobile phones. Misappropriation or use of Subscriber Identity Module (SIM) for other telecommunications companies to apply for illegal use.

However, the telecommunications company confirms that personal information is not like the bank's professional regulations. It needs to check the seal and confirm the authenticity of the identity certificate before applying for the business. Therefore, the bank confirms the customer's retained information but cannot confirm the customer's authenticity, resulting in the customer's account. Be defrauded or have your credit damaged.

Furthermore, simply by contacting customers through SMS or applying for business online, the risk of verifying the identity of the user identity module of the mobile phone is controlled by the third-party telecommunications company, which will cause the risk of the bank's online application verification mechanism to increase. .

In order to solve the above problems, according to an embodiment of the present invention, a system and device for multiple confirmation of the user's identity are provided, which is applied to account authentication of a financial institution, and its signal is connected to a user device belonging to at least one user, through an account number and Log in to the online mobile banking website with a password for the first check, and then combine the biometric information of the user device for the second check, and then use the Fast IDentity Online technology to compare the external verification server with the telecommunications server User data comparison, after checking the private key generated by the biometric information of the user device and the public key generated by the telecommunications information of the mobile device plus identity information, a digital signature is generated to bind the user device of the user, which can effectively prevent the user from using The possibility of the identity module being stolen, and its verification operation mode is the same as the current authentication will not cause more burden to the user.

100: Identity Verification System

120: The first verification module

121: The first certification information

122: The first verification code

140: The second verification module

141: The second verification code

142:Biometric information

160: The third verification module

161: private key

162:Public key plus identity information

164: Digital signature

200: user device

300: E-mail

400: External authentication server

500: Telecom server

FIG. 1 is a schematic diagram of an identity verification system according to an embodiment of the present invention; FIG. 2 is a flowchart of an identity verification system according to an embodiment of the present invention.

In order to make those with ordinary knowledge in the technical field further understand the technical features, content and advantages of this new creation and the effects it can achieve, the content of this new model will be described in detail below in the form of appropriate embodiments in conjunction with drawings. Embodiments It is only for the purpose of illustration and auxiliary explanation of this new creation, and does not limit the scope of rights of this new creation on actual embodiments.

As shown in the schematic diagram of the system in FIG. 1 , the present invention is an identity verification system 100 , especially applied to the account identity verification of a financial institution, such as a savings account of a bank. Wherein, the identity verification system 100 is signally connected to a user device 200 belonging to at least one user and an external verification server 400, wherein the user device 200 can be a mobile phone with a telephone number for binding a savings account of a bank, The external verification server 400 will be further described in the third verification module 160 .

The identity verification system 100 includes: a first verification module 120, which is signally connected to the user device 200, wherein a plurality of registered user information is stored for receiving a first authentication information 121, the first authentication information 121 is the user device 200 in the entity Or when applying for an account in an online bank, the account number and password given by the bank are used to allow the login information of the user device 200 to log in to the webpage of the financial institution. Continue referring to steps S11 to S13 of FIG. 2 to illustrate the operation of the first verification module 120. When the login information matches the registered user information (referring to the mobile phone number and electronic mailbox stored in the bank by the user device 200), a message will be generated. The first verification code 122 is transmitted to the user device 200 through the electronic mailbox 300 to complete the verification of the first verification module 120 .

Referring to FIG. 1 and S21 to S22 of FIG. 2, the operation mode of the second verification module 140 is described. After receiving the first verification code 122, the user device 200 starts the second verification module 140. According to the first verification code 122, the second verification The module 140 obtains the biometric information stored therein from the user device 200, that is, the second verification code 141, and when the first verification code 122 and the second verification code 141 match, a biometric identification of the user is generated. The information 142 is transmitted to the external verification server 400 to complete the verification of the second verification module 140 .

From S31 to S33 of the flow chart in Fig. 1 and Fig. 2, continue to illustrate the operation mode of the third verification module 160 of this invention. The third verification module 160 mainly completes the external verification mechanism by connecting the telecommunications server 500, wherein the third verification module 160 has been done with FIDO authentication, FIDO is a simplified authentication Its open standard, its full name is "Fast Identity Online" (Quick Identity Online Verification) provides users and service providers with a more secure and convenient identity verification method by using public key encryption technology.

The FIDO Alliance is an alliance of companies promoting and developing the FIDO standard. The standard consists of two main components: Universal Authentication Framework (Universal Authentication Framework) and Universal 2nd Factor (Universal Second Factor). The former aims to provide a common framework for various authentication methods, including passwords, biometrics, smart cards, etc., while the latter uses hardware security keys to provide users with a more secure secondary verification method. FIDO technology is widely used in various devices and applications, including smartphones, computers, network services, etc. It is a set of network identification standards established by the FIDO Alliance to ensure the security of servers and terminal device protocols during the login process sex. And this set of identification standards uses the framework of public key encryption (Public Key Cryptography) to perform multi-factor authentication (MFA) and biometric login to strongly and strictly protect the personal data of cloud accounts.

Since the establishment of the FIDO Alliance in 2007, PayPal, a world-renowned third-party payment platform, is committed to implementing one-time passwords (OTP) to its users for software information security. In 2009, Validity Sensors, which developed fingerprint identification, discussed with PayPal the idea and possibility of using fingerprint identification technology to log in to the service and set a set of stricter identification standards for information security awareness. Therefore, the FIDO Alliance was established in 2012. Member companies such as PayPal, Lenovo, Validity Sensors and other technology giants joined hands to lead the innovative thinking of password-free login, and then attracted well-known technology companies such as Google, Microsoft, and NTT to join. In 2016, there were more than 260 companies, and they continued to uphold three principles: ease of use, privacy and security, and standardization.

All of IDO's protocols are based on Public Key Cryptography (Public Key Cryptography). Such a structure makes "the server will no longer keep secrets." in traditional cipher In the verification framework, the user's terminal device and the server both know the account number and password, or use the hash function generated by the password to verify. On the other hand, FIDO adopts the verification mode of the public key infrastructure. Only the corresponding public key is stored on the FIDO Authentication Server (FIDO Authentication Server), while the private key is only stored on the user's device side. Therefore, When logging in, the user only needs to provide personal information to the terminal device to unlock the private key, and then unlock the public key through this step to log in. Therefore, the external authentication server 400 of this creation is the FIDO authentication server. The confidential personal information of account users is no longer managed on the server of the bank's cloud service, but the personal information is stored separately in a decentralized manner. On the user's terminal device, log in to the cloud service through the structure of public key and private key, so that the user's personal information does not need to be uploaded to the cloud. In addition to effectively protecting the data, it also allows the user to log in during the login process. more at ease.

The public key architecture is applied to the three major authentication protocols of FIDO, namely FIDO UAF, FIDO U2F and FIDO2. This creation uses FIDO UAF (Universal Authentication Framework) as the specific implementation method, and the description is as follows: UAF refers to providing users with a smooth password-free login experience by combining authentication methods such as biometrics. Through the FIDO UAF stack installed on the device, users can choose to log in online through fingerprint recognition, voice recognition, and personal identification code PIN input on the terminal device, getting rid of the traditional process of entering lengthy passwords.

Referring to Figures 1 and 2, when the biometric information 142 is transmitted to the external verification server 400, that is, the FIDO authentication server, FIDO UAF will be activated, and the external verification server 400 will register according to the FIDO standard to generate a private key 161 and send back the third verification The module 160 simultaneously connects the telecommunications server 500 with the telecommunications information of the user device 200, generates a public key plus identity information 162 according to the FIDO standard, and registers it in the external verification server 400. At this time, as described in S33, the external verification server 400 Private key 161 for external authentication The random number (Challenge) provided by the server 400 is used for random number calculation, and then sent to the external verification server 400 for comparison with the corresponding public key plus identity information 162 for confirmation and combined with the electronic certificate (ID) to generate a digital signature 164 and complete The user device 200 binds.

The present invention is only disclosed in preferred embodiments, but anyone skilled in the art should understand that the above embodiments are only used to describe the present invention, and are not intended to limit the scope of patent rights claimed by the present invention. All changes or substitutions that are equal or equivalent to the above-mentioned embodiments should be interpreted as falling within the spirit or scope of the present invention. Therefore, the scope of protection of the present invention should be defined by the scope of the following patent application.

100: Identity Verification System

120: The first verification module

121: The first certification information

122: The first verification code

140: The second verification module

141: The second verification code

142:Biometric information

160: The third verification module

161: private key

162:Public key plus identity information

164: Digital signature

200: user device

300: E-mail

400: External authentication server

500: Telecom server

Claims (7)

An identity verification system, applied to account verification of a financial institution, signally connected to at least one user device and an external verification server, wherein the user device has a telecommunication information, and the external verification server is signally connected to a telecommunication server, the The identity verification system includes: a first verification module, which is signal-connected to the user device for receiving a first authentication information sent by the user device, and generates the first verification code when the first authentication information matches; A second verification module, signally connected to the user device to accept the first verification code, generating a biometric information transmission to the external verification server according to a second verification code of the user device, and a third verification module , the signal is connected to the second verification module and the external verification server, and the external verification server converts the biometric information into a private key and sends it back to the third verification module, wherein the external verification server passes the telecommunications The information is connected to the telecommunications server to generate a public key plus identity information, and the private key and the public key plus identity information are compared, and when they match, a digital signature is returned to complete the identity verification of the user device. The identity verification system as claimed in claim 1, wherein the first authentication information is an account number and password generated by account authentication of the financial institution. The identity verification system as claimed in claim 1, wherein the first verification module judges whether the telecommunication information stored in the user device and an electronic mailbox are consistent. The identity verification system as claimed in claim 1, wherein the first verification code is sent to the electronic mailbox preset by the user device. The identity verification system as claimed in claim 1, wherein the second verification code is the biometric information of the user device. The identity verification system as claimed in claim 1, wherein the external verification server is a Fast IDentity Online server. The identity verification system as claimed in claim 6, wherein the external verification server completes the verification of the third verification module through the FIDO UAF standard.

Images