WO2017065576A1

WO2017065576A1 - User authentication method and system, which use variable keypad

Info

Publication number: WO2017065576A1
Application number: PCT/KR2016/011593
Authority: WO
Inventors: 박경양
Original assignee: 주식회사 하렉스인포텍
Priority date: 2015-10-14
Filing date: 2016-10-14
Publication date: 2017-04-20
Also published as: KR101722028B1

Abstract

The present invention relates to an authentication system for financial transactions, and a password and fingerprint information mixed user authentication server according to one embodiment of the present invention comprises: a variable keypad generation unit for generating a variable keypad including password keys and a fingerprint input unit for receiving a fingerprint of a user, such that the position of each of the password keys varies at each generation; an authentication information storage unit for storing authentication information of a portable terminal user; and an authentication unit for providing information of the generated variable keypad to a remote portable terminal, and receiving, from the portable terminal, position information of the password keys according to a sequence inputted by the user and fingerprint information inputted into the fingerprint input unit by the user, so as to perform user authentication by using the same.

Description

Authentication method and system using variable keypad

The present invention relates to a method and system for authenticating a user, and more particularly, to a method and a system for authenticating a user to receive a password and fingerprint information through a variable keypad in a mobile terminal and to transmit the same to a server. will be.

Recently, as financial transactions such as electronic payments using mobile terminals such as smartphones and tablets have increased, interest in security-related issues such as passwords is increasing.

This is because, unlike existing mobile phones, anyone can develop an application and know about its structure, so it is vulnerable to hacking like a widely used PC.

In particular, if you enter a password or social security number using a fixed keypad, you only need to be careful when you enter the password because you can easily find out the password or social security number based on the location.

A method for supplementing the problem of using a fixed keypad is an authentication method using a variable keypad. In the variable keypad method, since the input button arrangement of the keypad is changed every time the user connects, even if a third party finds out a location such as a password that the user inputs on the keypad, it is difficult to find out the password using this.

However, even if you use the variable keypad, if you witness the password input scene from the surroundings, or if you hack the password transmitted from the mobile terminal to the server in the middle of authentication request, you can find out the password itself. .

In addition, there is a problem that cannot be prevented when a user authenticates by impersonating a third party with the password itself.

The present invention has been made in view of the above-described technical background, and a system and method for preventing unauthorized use of a third party by transmitting location information and fingerprint information of a variable keypad together when a password is transmitted from a portable terminal to a user authentication server. To provide that purpose.

The object of the present invention is not limited to the above-mentioned object, and other objects that are not mentioned will be clearly understood by those skilled in the art from the following description.

In accordance with an aspect of the present invention, a password and fingerprint information mixed authentication server according to an aspect of the present invention generates a variable keypad including an encryption key and a fingerprint input unit for receiving a user's fingerprint, wherein each position of the encryption key is A variable keypad generation unit for generating a variable at every generation; An authentication information storage unit for storing authentication information of the mobile terminal user; And providing the generated information of the variable keypad to a remote portable terminal, receiving location information of the encryption key and fingerprint information input by the user in the fingerprint input unit according to the order input by the user from the portable terminal. It characterized in that it comprises an authentication performing unit that performs the authentication.

According to another aspect of the present invention, there is provided a personal authentication mobile terminal including a cryptographic key and a fingerprint input unit, and a display unit for displaying a variable keypad which is generated such that each position of the cryptographic key is changed at every generation; And a controller configured to receive the information of the variable keypad from the identity authentication server, and transmit the position information of the encryption key, the input order of the encryption key, and the fingerprint information to the identity authentication server.

According to another aspect of the present invention, there is provided a password and fingerprint information mixed identity authentication method, comprising: generating a variable keypad including an encryption key and a fingerprint input unit, and generating a variable key at each location of the encryption key; Transmitting the generated variable keypad to a mobile terminal; Receiving location information of the encryption key and fingerprint information input by the user to the fingerprint input unit according to the order input by the user from the portable terminal; And performing authentication based on the received location information of the encryption key and the fingerprint information.

According to the present invention, since the location information of the keypad is transmitted instead of the password itself, the password cannot be found by hacking, and the fingerprint information is sent out together, so even if the password is leaked, the user can be further authenticated by the fingerprint information to improve security. It has an effect.

1 is a view showing an authentication system consisting of a mobile terminal and an authentication server according to an embodiment of the present invention.

2 is a flow chart of a user authentication method according to an embodiment of the present invention.

3 is a view of the generation of a variable keypad that changes every time the creation according to an embodiment of the present invention.

Figure 4 is a view showing the coordinates on the X-Y plane of the variable keypad according to an embodiment of the present invention.

5 is a flowchart illustrating a procedure for extracting a password from an encryption key and performing authentication according to an embodiment of the present invention.

6 is a view showing a display unit of a mobile terminal displaying a variable keypad and a fingerprint input unit according to an embodiment of the present invention.

7 is a view showing a display unit of a mobile terminal in which the fingerprint input unit is displayed as a pop-up window according to an embodiment of the present invention.

8 is a view showing a face recognition portion is added with a variable keypad according to another embodiment of the present invention.

FIG. 9 illustrates authentication using an identifier of a variable pad according to another embodiment of the present invention. FIG.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various forms. It is provided to fully convey the scope of the invention to those skilled in the art, and the present invention is defined only by the scope of the claims. Meanwhile, the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. In this specification, the singular also includes the plural unless specifically stated otherwise in the phrase. As used herein, “comprises” and / or “comprising” refers to a component, step, operation and / or device that is present in one or more other components, steps, operations and / or elements. Or does not exclude additions.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram showing a password and fingerprint information mixed identity authentication system according to an embodiment of the present invention.

As shown in FIG. 1, the password and fingerprint information mixed identity authentication system includes a mobile terminal 100 and an identity verification server 200.

The identity authentication server 200 includes a variable keypad generator 210, an authentication performer 220, and an authentication information storage 230.

The variable keypad generation unit 210 generates a variable keypad including an encryption key and a fingerprint input unit. The variable keypad generation unit 210 generates a variable keypad so that the positions of the numeric keys and the character keys constituting the encryption key are variable at every variable keypad generation. In addition, the position of the fingerprint input unit may be generated to be changed every time the variable keypad is generated.

When the authentication unit 220 transmits the configuration information of each encryption key, which is the information of the generated variable keypad, to the remote mobile terminal 100, the mobile terminal 100 uses the authentication information such as password and fingerprint information from the user. Get input.

The authentication performing unit 220 generates a plurality of variable keypads in advance in addition to a method of generating a variable keypad whenever necessary, and assigns an identifier to each variable keypad in advance so that the authentication keypad 220 is shared with the mobile terminal 100. A method of transmitting only an identifier to the mobile terminal 100 may be used.

The authentication performing unit 220 receives the location information and the fingerprint information of the encryption key in the order input by the user from the mobile terminal 100 and performs identity authentication based on this. In some cases, when the location of the fingerprint input unit is also variable, the location information of the fingerprint input unit may also be received and used for identity verification.

For example, the authentication performing unit 220, the position information of the encryption key according to the order input by the user from the mobile terminal 100, such as a smart phone, that is, as shown in Figure 4 (a) 4, 3, 1, If 2 is input, the identification coordinates of the corresponding encryption key (0.5, 2.5), (3.5, 3.5), (1.5, 3.5), (2.5, 3.5) and fingerprint information are received and authenticated based on this.

The authentication performing unit 220 stores the location information and the input order of each encryption key corresponding to the password and the location information of the fingerprint input unit every time the variable keypad is generated, and the encryption key according to the order input by the user from the mobile terminal 100. When receiving location information, location information and fingerprint information of the fingerprint input unit, authentication is performed by comparing the location information of the previously stored encryption key, location information and fingerprint information of the fingerprint input unit.

As in the above example, if the password is 4, 3, 1, 2, the location information of the corresponding encryption key is (0.5, 2.5), (3.5, 3.5), (1.5, 3.5) according to FIG. , (2.5, 3.5) and the input order is same as above. In addition, when the position of the fingerprint input unit varies, the positional information of the fingerprint input unit becomes (1.5, 2.5).

When the user touches the fingerprint portion of the finger where the fingerprint input unit is located, the fingerprint input scan sensor operates to acquire the fingerprint image of the user, and acquires the location information (1.5, 2.5) of the fingerprint input unit.

Since both fingerprint input and encryption key input use a finger touch, it is also possible to enhance security by mixing the encryption key input sequence and the fingerprint input sequence.

For example, if the password to be input is 4,3,1,2, the fingerprint is not input in order, but the fingerprint is input in an arbitrary order so that the password cannot be known only by the location information.

In other words, the user enters

passwords

4 and 3 in order, then enters a fingerprint, and then enters the

remaining passwords

1 and 2. Then, the location information of the encryption key and the fingerprint input unit becomes (0.5, 2.5), (3.5, 3.5), (1.5, 2.5), (1.5, 3.5), (2.5, 3.5) according to FIG. 4 (a). Even if you hack the 4 digit password can not be found.

However, since the authentication performing unit 220 knows the location of the fingerprint input unit (1.5, 2.5), it is possible to restore the

password

4, 3, 1, 2 from the location information of the encryption key except this.

The fingerprint input unit may not appear on a portion of the variable keypad but may appear separately in the form of a pop-up window. In this case, it is possible to adjust the size of the pop-up window that the fingerprint input unit appears, it is also possible to use any finger, such as the thumb in addition to the index finger.

7 shows a fingerprint input unit in the form of a pop-up window. When a user inputs a password and touches the fingerprint part of FIG. 7 (a), the fingerprint input unit appears as a pop-up window as shown in FIG. It is possible to input to the fingerprint input unit.

The fingerprint input unit is a touch screen input form, and when a user touches a fingerprint of a finger and a predetermined time (for example, 1 second or more) elapses, a fingerprint input scan sensor is automatically operated to obtain a fingerprint image of the user.

When the fingerprint input unit is configured as a capacitive touch screen, when the user touches the screen for fingerprint input, the fingerprint input unit may determine whether electricity flows to the finger to be touched, thereby determining whether the finger is a real human finger. By doing so, the user's fingerprint can be copied to rubber or silicone, thereby preventing the user from entering the fingerprint input unit, thereby increasing security.

The authentication performing unit 220 receives the location information and the input order of the encryption key for the password from the mobile terminal 100 according to the order input by the user, the location information and the fingerprint information of the fingerprint input unit, and the authentication information storage unit ( Authentication is performed by comparing the authentication information including the location information, the input order, the location information of the encryption key, and the fingerprint information previously stored in 230.

The authentication performing unit 220 compares the position of the feature point of the fingerprint image received from the terminal device 100 with the position of the feature point of the fingerprint stored in the authentication information storage unit 230, generates statistics and calculates a score through the calculation. If a score is equal to or greater than a predetermined threshold (eg, 80%), the same fingerprint is determined.

Fingerprint recognition technology is a technology that recognizes and reads the curvature of the fingerprint reflected by shooting light on the fingerprint. This technology is used in a number of places because it allows for quick scans by simply placing a finger on the scanner's surface.

Fingerprint recognition technology recognizes various fingerprint types for each person, scans the split points, connected points, and end points of the fingerprint, converts the characteristics of each fingerprint into coordinates, and checks the identity by comparing with existing data.

As an input device for fingerprint recognition, there are an optical method using a prism or a hologram, and a non-optical method that detects heat, pressure, electric field or ultrasonic waves of a finger.

Fingerprint recognition technology is cheaper than other biometric technologies for sensors and semiconductor chips that store and identify fingerprints, and its technology is relatively fast and has a wide range of applications.

Advantages of fingerprint recognition include relatively high recognition rates within 0.5% of error rate and fast verification speed within 1 second. The advantages of fingerprint recognition are water solubility, convenience and reliability.

In addition, users use less fingerprints when compared to other biometric technologies, and fingerprint recognition equipment also takes advantage of very little space.

The authentication information storage unit 230 stores passwords, fingerprint information, etc. of users who use the mobile terminal.

In addition, the variable keypad generation unit 210 stores the authentication keys including the encryption keys of the variable keypad, the location information of the encryption key, the location information and the fingerprint information of the fingerprint input unit.

The mobile terminal 100 may include a display unit 120 including a variable keypad 110 and a control unit 130, and further include a camera unit 140.

The mobile terminal 100 includes not only a mobile phone but also a smartphone, a mobile phone, a tablet PC, a laptop, a mobile credit card payment terminal, a bank ATM, a pharmacy, a kiosk installed in a government office, and the like.

The variable keypad 110 changes the position of each encryption key and the position of the fingerprint input unit at every generation. The variable keypad 110 is generated by the variable keypad generation unit 210 of the identity authentication server 200, and the variable keypad 110 of the mobile terminal 100 is the variable keypad 110 received from the identity authentication server 200. ) Is to display.

The display unit 120 displays the variable keypad 110. The encryption key included in the variable keypad has a different position every time it is generated, and the position of the fingerprint input unit may be fixed.

6 illustrates a state in which the variable keypad 110 and the fingerprint input unit are displayed on the display unit 120. 6 (a) shows a state before a user inputs a password and a fingerprint, and FIG. 6 (b) shows a state after the user inputs a password and a fingerprint. The password entered is asterisk (*) for security.

The control unit 130 is provided with the information of the variable keypad from the identity authentication server 200, the authentication key position information received from the user, the encryption key input order, the location information and fingerprint information of the fingerprint input unit identity authentication server 200 To send.

The mobile terminal 100 may further include a camera unit 140, which captures a direction toward the user. This is to use a face of a user who inputs authentication information in addition to the input of the variable keypad 110 as the authentication information.

The camera unit 140 receives a command of the controller 130 while the user inputs the variable keypad 110 to photograph the face of the user. The user terminal 100 follows the guidelines of the contour of the face displayed on the display unit 120. ), You can take a picture of the face according to the guidelines.

FIG. 8 is a view showing recognition of a user's face for face recognition together with the variable keypad 110 and a fingerprint input unit. When the face outline is presented as shown in FIG. 8 (a) and the user fits the face, the image of the face for face recognition is completed as shown in FIG. 8 (b).

The controller 130 transmits the photographed face image to the identity verification server 200, and the identity verification server 200 may perform additional authentication using the facial image along with other authentication information.

2 is a flowchart illustrating a procedure of a password and fingerprint information mixed authentication method according to an embodiment of the present invention.

First, a variable keypad including an encryption key and a fingerprint input unit is generated. Each position of the encryption key and a position of the fingerprint input unit may be changed at every generation (S110).

The generated variable keypad is transmitted to the mobile terminal 100 together with the generated information (S120), and the user inputs a password and a fingerprint to the variable keypad.

The user authentication server 200 receives the location information of the encryption key, the location information of the fingerprint input unit and the fingerprint information according to the order input by the user from the mobile terminal 100 (S130) and performs identity authentication based on this (S140). .

According to another embodiment of the present invention, it is also possible to perform authentication by using only the location information of a part of the encryption key when performing authentication.

For example, if the password is 4312, the user does not enter all four-digit passwords, but only a portion of the password, such as 43 in the front two, 12 in the second 12, 41 in the first and third.

In the case of entering the first two digits 43, the position of the password becomes (0.5, 2.5), (3.5, 3.5) in FIG. 4 (a), and based on the position and input order of the password, fingerprint information, etc. Perform identity verification.

When the camera is included in the mobile terminal 100, the face recognition information of the user may be additionally used for authentication as described above.

In the case of performing authentication based on the location information of a part of the encryption key, the amount of data to be authenticated is relatively small compared to the location information of the entire encryption key, thereby improving the operation speed, and the total number of encryption keys to be input. It is relatively small compared to the above, and thus user convenience can be improved.

Figure 3 shows that the position of each of the encryption key and the fingerprint input unit in the variable keypad including the encryption key and the fingerprint input unit is variable according to the embodiment of the present invention, Figure 3 (a) is the first variable keypad 3 (b) shows that the position of the encryption key and the fingerprint input unit is changed when it is generated.

5 is a flowchart illustrating a method of extracting a password from a location of an encryption key and performing a user authentication according to an embodiment of the present invention.

The password is stored in the authentication server in advance, and when the location information of the password is received from the mobile terminal, the password is extracted from the location information and the input order of the received password, and the extracted password is compared with the password stored in the authentication storage. It is to perform authentication.

First, the authentication performing unit receives the position of the encryption key according to the order input by the member from the mobile terminal and extracts the password input by the member (S510).

Next, the authentication performing unit compares the extracted password and the received fingerprint information with the password and fingerprint information stored in the authentication information storage unit to perform authentication (S520).

FIG. 8 is a diagram illustrating photographing a user's face and transmitting the photographed face image to the user authentication server 200 according to another embodiment of the present invention.

The controller 130 of the mobile terminal 100 controls the camera unit 140 to photograph the front user's face, and the camera unit 140 captures the user's face according to the instruction of the controller 130.

When the user aligns the face according to the indicator of the face outline displayed on the screen as shown in FIG. 8 (a), the user can recognize the password and the face of the variable keypad as shown in FIG. The authentication will be performed by sending.

When the camera unit 140 adjusts the illuminance using the flash of the mobile terminal 100 before photographing the face, the eyes of the person respond to the widening or narrowing of the pupils, so if checked, the user's face photographed in advance It is possible to prevent the manipulation of the authentication information using the can improve the security.

9 is a diagram illustrating performing primary authentication through an identifier corresponding to a variable keypad according to an embodiment of the present invention. FIG. 9 (a) is a view showing an identifier assigned to each variable keypad stored in an authentication server. 9 (b) shows an identifier assigned to a variable keypad stored in a portable terminal.

As shown in FIG. 9, the authentication execution unit generates a plurality of variable keypads and generates an index corresponding thereto. That is, when the variable keypad is generated in the authentication server,

index

1, 2 and 3, which are identifiers corresponding to the

variable keypads

1, 2 and 3, are generated, and the generated variable keypad and the identifier are previously provided to the mobile terminal.

When the authentication server receives the authentication request, the authentication server selects one of the stored identifiers and provides the same to the portable terminal. The portable terminal receives the identifier and selects a variable keypad corresponding to the identifier to display on the screen.

The authentication server performs the second authentication by comparing the location information, the input order and the fingerprint information of the encryption key received from the mobile terminal with the location information, the input order and the fingerprint information of the encryption key previously stored.

According to this embodiment, since the variable keypad layout structure is not transmitted from the authentication server to the mobile terminal, the variable keypad layout structure cannot be found by hacking of the transmission packet, thereby improving security.

Through the user authentication method and device using the variable keypad, fingerprint information, and face recognition as described above, the user has the advantage of proceeding financial transactions in a more secure environment. You can proceed with the transaction.

As mentioned above, the configuration of the present invention has been described in detail with reference to the accompanying drawings, which are merely examples, and those skilled in the art to which the present invention pertains various modifications and changes within the scope of the technical idea of the present invention. Of course this is possible. Therefore, the protection scope of the present invention should not be limited to the above-described embodiment but should be defined by the following claims.

Claims

A variable keypad generation unit including a cryptographic key and a fingerprint input unit configured to receive a user's fingerprint, wherein the variable keypad generation unit generates a variable keypad to be changed at each generation;

An authentication information storage unit for storing authentication information of the mobile terminal user; And

Providing the generated information of the variable keypad to the remote portable terminal, and receives the location information of the encryption key and the fingerprint information input by the user to the fingerprint input unit in accordance with the order input by the user from the portable terminal Certification department that performs identity verification

Password and fingerprint information mixed authentication server comprising a.
The method of claim 1, wherein the variable keypad generation unit

Generating the fingerprint input unit so that the position of the fingerprint input unit is variable every time the variable keypad is generated;

Password and fingerprint information mixed authentication server.
The method of claim 1, wherein the authentication performing unit

Extracting the password input by the user from the received location information of the encryption key, and performing authentication by comparing the extracted password and the received fingerprint information with the authentication information previously stored in the authentication information storage unit;

Password and fingerprint information mixed authentication server.
The method of claim 1, wherein the authentication performing unit

Whenever the variable keypad is generated, location information and input order of each encryption key corresponding to the password are stored.

When receiving the location information and the fingerprint information of the encryption key in the order input by the user from the portable terminal,

Performing authentication by comparing this with the location information, input order and fingerprint information of the encryption key previously stored in the authentication information storage unit.

Password and fingerprint information mixed authentication server.
The method of claim 1, wherein the authentication performing unit

Storing an identifier corresponding to the variable keypad generated each time the variable keypad is generated, and providing the stored identifier to the mobile terminal;

When receiving an identifier from the mobile terminal, the first authentication is performed by comparing the identifier with a previously stored identifier,

If the first authentication is successful, the location information, the input order, and the fingerprint information of the encryption key received from the mobile terminal are compared with the location information, the input order, and the fingerprint information of the encryption key previously stored in the authentication information storage unit. Performing authentication

Password and fingerprint information mixed authentication server.
A display unit for displaying a variable keypad including an encryption key and a fingerprint input unit, wherein the positions of the encryption keys are varied in every generation; And

A control unit which receives the information of the variable keypad from the identity authentication server, and transmits the position information of the encryption key, the input order of the encryption key, and the fingerprint information to the identity authentication server;

Self-contained mobile terminal comprising a.
The method of claim 6,

Further comprising a camera unit for taking a picture of the user,

The controller controls the camera unit to photograph the face of the front user, and transmits the photographed face image to the identity verification server.

In person authentication mobile terminal.
Generating a variable keypad including an encryption key and a fingerprint input unit, wherein the positions of each of the encryption keys are varied at each generation;

Transmitting the generated variable keypad to a mobile terminal;

Receiving location information of the encryption key and fingerprint information input by the user to the fingerprint input unit according to the order input by the user from the portable terminal; And

Performing identity authentication based on the received location information of the encryption key and the fingerprint information;

Password and fingerprint information mixed identity authentication method comprising a.
The method of claim 8,

The generating may be performed such that the position of the fingerprint input unit is changed every time the variable keypad is generated.

Password and fingerprint information mixed authentication method.
The method of claim 8, wherein performing the identity verification

Performing identity authentication based on the location information of a part of the encryption key

Password and fingerprint information mixed authentication method.
The method of claim 8,

The step of performing the identity verification

After extracting the password input by the user from the location information of the encryption key according to the order input by the user from the portable terminal, the extracted password and the received fingerprint information and the password and fingerprint information previously stored in the authentication information storage unit; Performing identity verification by comparison

Password and fingerprint information mixed authentication method.