WO2021045323A1

WO2021045323A1 - Multi-factor authentication device and operation method for same

Info

Publication number: WO2021045323A1
Application number: PCT/KR2019/017791
Authority: WO
Inventors: 김동수; 여현웅; 박영경; 조호성
Original assignee: 주식회사 엘핀
Priority date: 2019-09-06
Filing date: 2019-12-16
Publication date: 2021-03-11
Also published as: KR102259764B1; KR20210029622A

Abstract

The present disclosure relates to a multi-factor authentication device and an operation method for same. An operation method for a server performing multi-factor authentication according to an embodiment may include the steps of: receiving an authentication request from a user terminal, the authentication request including first biometric information about the user of the user terminal, first location information about the user terminal, and identification information about the user terminal; combining the first biometric information and the first position information to generate first authentication information; acquiring second location information about the user terminal through a server of a mobile network operator on the basis of the identification information about the user terminal; detecting second authentication information including at least one among second biometric information about the user corresponding to the identification information about the user terminal and the second location information about the user terminal; and comparing the first authentication information with the second authentication information to perform multi-factor authentication.

Description

Device for performing multi-factor authentication and its operation method

The present disclosure relates to an apparatus for performing multi-factor authentication and an operating method thereof, and more particularly, to an apparatus for performing authentication through user authentication and location authentication of a user terminal, and an operating method thereof.

As personalized user terminals such as smart phones and tablet PCs become popular, it has become possible to provide various services using user terminals. Among the various services, there are services in which personal information, trade secrets, confidential information, internal system information, and other information that should not be leaked to the outside are exchanged. These services always pose a risk of hacking and information leakage.

Accordingly, the services have security procedures to prevent hacking and information leakage. As one of the security procedures, methods of performing authentication of a user of a user terminal and/or authentication of a user terminal itself are used. In particular, in the case of an authentication method for a user of a user terminal, user authentication is performed through biometric information of the user.

Meanwhile, in order to further strengthen security, a multi-factor authentication method in which a plurality of authentications are merged and performed has been recently introduced. For example, a method of combining authentication using biometric information and authentication using a password method, or a method combining authentication using biometric information and authentication based on location information may be used.

In this multi-factor authentication method, as shown in FIG. 1, a plurality of authentication information to be authenticated is input into a matching algorithm to determine the degree of similarity individually, and finally, the result of each determination is collected to perform authentication. As a method of performing, although the security is improved because each authentication method is simply combined in parallel, it has limitations in terms of efficiency such as an increase in the size of a chip and an authentication processing time.

In the present disclosure, a multi-factor authentication method and apparatus capable of improving the efficiency of authentication processing while simultaneously performing authentication of a user of a user terminal and authentication of a user terminal itself are performed in order to improve the security level.

The present disclosure provides an authentication performing apparatus and an operating method thereof capable of performing authentication using a plurality of authentication means, but increasing the efficiency of authentication processing while enhancing security.

According to an embodiment, a method of operating a server performing multi-factor authentication includes receiving an authentication request from a user terminal-The authentication request includes first biometric information of a user of the user terminal, first location information of the user terminal, and -Including identification information on the user terminal; Generating first authentication information by merging the first biometric information and the first location information; Acquiring second location information of the user terminal based on the identification information of the user terminal; Detecting second authentication information including at least one of second biometric information of a user corresponding to the identification information of the user terminal and second location information of the user terminal; And performing multi-factor authentication by comparing the first authentication information and the second authentication information.

According to an embodiment, a server for performing multi-factor authentication, comprising: a communication unit; A memory storing a program for performing multi-factor authentication; And receiving an authentication request including first biometric information of the user of the user terminal, first location information of the user terminal, and identification information of the user terminal from the user terminal, and the first biometric information and the first location The first authentication information is generated by merging the information, obtaining second location information of the user terminal based on the identification information of the user terminal, and second biometric information of the user corresponding to the identification information of the user terminal and the It may include a processor that detects second authentication information including at least one of the second location information of the user terminal, and controls to perform multi-factor authentication by comparing the first authentication information with the second authentication information.

A computer program product including a recording medium in which a program is stored according to an embodiment may execute a method of performing multi-factor authentication of a server.

1 is a diagram for explaining a multi-factor authentication method according to the prior art.

2 is a diagram illustrating a system for performing multi-factor authentication according to an exemplary embodiment.

3 is a flowchart illustrating a method of performing multi-factor authentication according to an embodiment.

4 is a flowchart illustrating a method of operating a server performing multi-factor authentication according to an exemplary embodiment.

5 is a flowchart illustrating a method of operating a user terminal performing multi-factor authentication according to an embodiment.

6A to 6C are views exemplarily illustrating a process of generating first authentication information in a server performing multi-factor authentication according to an exemplary embodiment.

7 is a block diagram showing the configuration of a server that performs multi-factor authentication according to an embodiment.

8 is a block diagram showing the configuration of a user terminal that performs multi-factor authentication according to an embodiment.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In this case, it should be noted that the same components in the accompanying drawings are indicated by the same reference numerals as possible. In addition, detailed descriptions of known functions and configurations that may obscure the subject matter of the present invention will be omitted.

Some embodiments of the present disclosure may be represented by functional block configurations and various processing steps. Some or all of these functional blocks may be implemented with various numbers of hardware and/or software components that perform specific functions. For example, the functional blocks of the present disclosure may be implemented by one or more microprocessors, or may be implemented by circuit configurations for a predetermined function. In addition, for example, the functional blocks of the present disclosure may be implemented in various programming or scripting languages. Functional blocks may be implemented as an algorithm executed on one or more processors. In addition, the present disclosure may employ conventional techniques for electronic environment setting, signal processing, and/or data processing.

In addition, terms such as "... unit" and "module" described in this specification mean a unit that processes at least one function or operation, which may be implemented as hardware or software or a combination of hardware and software. have. The "unit" and "module" are stored in an addressable storage medium and may be implemented by a program that can be executed by a processor.

For example, "sub" and "module" refer to components such as software components, object-oriented software components, class components, and task components, processes, functions, properties, and programs. It can be implemented by procedures, subroutines, segments of program code, drivers, firmware, microcode, circuits, data, databases, data structures, tables, arrays and variables.

Throughout the specification, when a part is said to be "connected" with another part, this includes not only the case of being "directly connected", but also the case of being "indirectly connected" with a device interposed therebetween. Throughout the specification, when a part "includes" a certain component, it means that other components may be further included rather than excluding other components unless specifically stated to the contrary.

Further, the connecting lines or connecting members between the components shown in the drawings are merely illustrative of functional connections and/or physical or circuit connections. In an actual device, connections between components may be represented by various functional connections, physical connections, or circuit connections that can be replaced or added.

The terms used in the present invention are used only to describe specific embodiments, and are not intended to limit the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In the present invention, terms such as "comprise" or "have" are intended to designate the presence of features, numbers, steps, actions, components, parts, or combinations thereof described in the specification, but one or more other features. It is to be understood that the presence or addition of elements or numbers, steps, actions, components, parts, or combinations thereof does not preclude in advance. That is, in the present invention, the description of “including” a specific configuration does not exclude configurations other than the corresponding configuration, and means that additional configurations may be included in the scope of the implementation of the present invention or the technical idea of the present invention.

Some of the components of the present invention are not essential components that perform essential functions in the present invention, but may be optional components only for improving performance. The present invention can be implemented by including only components essential to implement the essence of the present invention excluding components used for performance improvement, and a structure including only essential components excluding optional components used for performance improvement Also included in the scope of the present invention.

Referring to FIG. 2, a system for performing multi-factor authentication according to an embodiment includes a user terminal 10, a server 20, and a network 30.

The user terminal 10 may include all devices capable of accessing the network 30. For example, the user terminal 10 may include a smartphone, a tablet, a PC, a notebook computer, a home appliance device, a medical device, a camera, a wearable device, and the like. In one embodiment, the user terminal 10 may receive a service from the server 20 and may perform multi-factor authentication. More specifically, the user terminal 10 may perform authentication of the user of the user terminal 10 and authentication of the user terminal 10 itself.

In one embodiment, the user terminal 10 may perform biometric authentication for authenticating a user of the user terminal 10 and location authentication for authenticating the user terminal 10 itself.

The server 20 provides computing resources, storage resources, and the like in order to provide services to clients through the network 30. For example, the server 20 may provide various services to a user terminal by executing various applications. In one embodiment, the service may include services that must send and receive information that should not be leaked to the outside, such as personal information, trade secret, confidential information, and internal system information. For example, the service may include services such as membership registration, login, financial transaction, certificate issuance, and administrative processing. Here, the client may include the user terminal 10. In one embodiment, the server 20 may include various types of servers such as an application server, a control server, a data storage server, and a server for providing a specific function. In addition, the server 20 may process the process alone, or a plurality of servers may process the process. In one embodiment, the server 20 may provide a service to the user terminal 10 and may perform multi-factor authentication. More specifically, the server 20 may perform authentication for a user of the user terminal 10 and authentication for the user terminal 10 itself.

In one embodiment, the server 20 may perform biometric authentication for authenticating a user of the user terminal 10 and location authentication for authenticating the user terminal 10 itself through a single matching algorithm.

The network 30 includes user terminals 10 and servers such as Internet, intranet, extranet, LAN (Local Area Network), MAN (Metropolitan Area Network), WAN (Wide Area Network), etc. 20) can include all networks that can be accessed. Further, in the present invention, the terminal device 110 may include all terminal devices capable of accessing the network 30 such as a computer, a PC, a notebook computer, and a mobile phone.

3, first, in step 310, the user terminal 10 is the user's first biometric information, the first location information of the user terminal 10, and the identification information of the user terminal 10 through the network 30. An authentication request including a may be transmitted to the server 20.

In one embodiment, the user's first biometric information represents at least one biometric characteristic of the user acquired by the user terminal 10, for example, the user's fingerprint, iris, voice, Feature information on at least one of the faces may be included. In addition, the first location information of the user terminal 10 represents the location characteristics (or location information) of the user terminal 10, and is generated based on the unique location information assigned by the server 20, or In the 10) side, for example, it may be generated based on various methods known in the art, such as a global positioning system (GPS), an RF fingerprint, and pedestrian dead reckoning (PDR). Further, the identification information of the user terminal 10 is terminal-specific identification information, and may include an International Mobile Equipment Identity (IMEI).

In one embodiment, the user terminal 10 may acquire and/or generate the user's first biometric information, the first location information of the user terminal 10, and the identification information of the user terminal 10 before step 210 .

The server 20 receives the user's biometric authentication information, the location authentication information of the user terminal 10, and the identification information 210 of the user terminal 10 to authenticate the user of the user terminal 10 and the user terminal 10. ) Can be authenticated.

In step 320, the server 20 may generate first authentication information by merging the first biometric information and the first location information received in step 310.

In step 330, the server 20 checks and/or acquires user information and second location information of the user terminal 10 based on the identification information of the user terminal 10 received in step 310. In one embodiment, the server 20 transmits the received identification information of the user terminal 10 to the mobile communication service provider server, and in response thereto, checks the user information and the second location information from the mobile communication service provider server and/or Can be obtained.

In step 340, the server 20 may detect second authentication information including second biometric information of the user corresponding to the identification information of the user terminal 10 and second location information of the user terminal 10.

In step 350, the server 20 performs multi-factor authentication by comparing the first authentication information and the second authentication information. According to an embodiment, by simultaneously performing the user's biometric authentication and the location authentication of the user terminal 10 through one matching algorithm, the security level is improved and hardware (e.g., a chip design for multi-factor authentication) is performed at the same time. Etc.) It can improve design and software authentication processing speed.

If multi-factor authentication is successful, in step 270, the server 20 provides a service to the user terminal 10.

In FIG. 3, one server 20 communicates with the user terminal 10 and performs multi-factor authentication. However, the present invention is not limited thereto, and the server 20 may be a plurality of servers. It communicates between servers and can also perform multi-factor authentication.

In the following, the operation of the user terminal 10 and the server 20 will be described in more detail.

Referring to FIG. 4, first, in step 410, the server 20 may receive an authentication request from the user terminal 10. Here, the authentication request is to request the server 20 to simultaneously perform authentication of the user of the user terminal 10 and authentication of the user terminal 10 itself, and the first biometric information of the user of the user terminal 10 , First location information of the user terminal 10 and identification information of the user terminal 10 may be included.

In one embodiment, the first biometric information of the user represents at least one biometric characteristic of the user acquired by the user terminal 10, and at least one of a user's fingerprint, iris, voice, and face of the user terminal 10 It may include feature information about. For example, when the first biometric information relates to a face, the first biometric information may include an image of a user's face or feature information extracted from the image. In addition, the first location information of the user terminal 10 may indicate location characteristics (or location information) of the user terminal 10. In an embodiment, the first location information of the user terminal 10 may be generated based on the unique location information allocated by the server 20. Here, the unique location information includes a unique code allocated by the server 20 for each base station of the mobile communication service provider, and may be broadcast through the base station. For example, when the user terminal 10 is connected to a specific base station, the unique code of the corresponding base station is received by the user terminal 10, and the user terminal 10 may generate first location information based on this. In addition, in one embodiment, the first location information of the user terminal 10 is various known in the art, such as a global positioning system (GPS), an RF fingerprint, and pedestrian dead reckoning (PDR). It may be generated directly on the user terminal 10 side based on the method. Further, the identification information of the user terminal 10 is terminal-specific identification information, and may include an International Mobile Equipment Identity (IMEI).

In one embodiment, the first biometric information and the first location information may be a vector or a matrix that numerically represents the biometric characteristics of the user and the location characteristics of the user terminal 10, respectively, and at least one row It may be composed of (row) and at least one column. In addition, the first biometric information and the first location information may be generated in the form of a vector or matrix in the user terminal 10 and transmitted to the server 20, but is not limited thereto, and according to an embodiment, the server 20 ) Can be configured to be transformed into a vector or matrix form after being received.

In step 420, the server 20 may generate first authentication information by merging the received first biometric information and the first location information of the user terminal 10. In one embodiment, the first authentication information is a vector or matrix in which the first biometric information of the user of the user terminal 10 and the first location information of the user terminal 10 are merged in a predetermined manner. I can. A method of generating the first location information will be described in detail below with reference to FIGS. 6A to 6C.

In step 430, the server 20 may acquire user information (or subscriber information) and/or second location information of the user terminal through the mobile communication service provider server based on the identification information of the user terminal 10. For example, when the server 20 transmits the identification information of the user terminal 10 to the mobile communication service provider server, the mobile communication service provider server searches the mobile communication subscriber database to search for a subscriber corresponding to the received identification information. Can be detected. In addition, the mobile communication service provider server may detect a base station to which the user terminal 10 is currently connected based on the received identification information. Subsequently, the mobile communication service provider server transmits the detected subscriber information and identification information and/or unique code of the access base station to the server 20, and the server 20 transmits the received subscriber information, identification information of the access base station, and/or unique User information and/or second location information may be obtained based on the code. In an embodiment, the server 20 may store identification information of a base station and mapping information of a unique code in advance.

In one embodiment, the subscriber information of the user terminal 10 may include subscriber information on a Universal Integrated Circuit Card (UICC) mounted on the user terminal 10. UICC (Universal Integrated Circuit Card) is a smart card inserted and used in a mobile communication terminal. Personal information such as network access authentication information, phonebook, SMS, etc. of mobile communication subscribers are stored. It refers to a chip that enables secure mobile communication by performing subscriber authentication and traffic security key generation when accessing a mobile communication network. A UICC including a USIM (Universal SIM) is generally referred to as a USIM card, and similarly, a UICC including a SIM (Subscriber Identification Module) module is commonly referred to as a SIM card. Furthermore, a chip type embedded in the terminal that is not removable and that can be inserted and removed in the terminal may be referred to as an eUICC (embedded UICC). The mobile communication service provider can manage subscribers based on the UICC mounted on the user terminal 10.

In step 440, the server 20 may detect second authentication information including at least one of second biometric information and second location information of the user corresponding to the identification information of the user terminal 10. For example, the server 20 merges biometric information for each pre-registered user (for example, a mobile communication service subscriber) and location information for each base station of a mobile communication service provider, and combines the biometric information and the location information in a predetermined manner. An authentication database can be constructed by generating a plurality of reference authentication information and storing them directly or in an external server. The server 20 searches the authentication database based on the user information and/or second location information identified in step 430, and detects second authentication information including second biometric information and second location information of the user. I can. In an embodiment, the second authentication information may be a vector or matrix composed of the same row and column as the first location information.

On the other hand, the biometric information of the user constituting the reference authentication information is not fixed information, but information that may change. For example, the appearance of the user's face may change according to temporal and environmental factors, and when the appearance of the user's face changes, the accuracy of authentication based on face recognition may be degraded due to the changed face. More specifically, when wrinkles or scars occur on the user's face as the user ages, there is a possibility that the features extracted from the changed face may not match the data of the database stored in the past. Accordingly, in one embodiment, the server 20 may update the authentication database to reflect the changed user biometric information. This update may be performed periodically or intermittently by the user. Furthermore, when authentication is successfully completed, the server 20 may update the database based on the received biometric information.

In step 450, the server 20 may perform multi-factor authentication by comparing the first authentication information and the second authentication information. That is, authentication of the user of the user terminal 10 based on biometric information and authentication of the user terminal 10 itself based on location information may be simultaneously performed.

In an embodiment, step 450 may be performed by comparing the similarity between the first authentication information and the second authentication information through a matching algorithm. That is, the server 20 may determine that authentication has passed if the matching result value is greater than or equal to the threshold value through similarity comparison, and that authentication has failed if it is less than the threshold value. Here, the matching algorithm may be, for example, a k-nearest neighbors (KNN) algorithm, but is not limited thereto, and various machine learning algorithms such as k-means and support vector machine (SVM), or deep learning algorithms designed for the same purpose. Can be replaced by and applied.

In step 460, when the authentication is successful, the server 20 may provide a service to the user terminal 10. In one embodiment, the service may include services that must exchange information that should not be leaked to the outside, such as personal information, trade secret, confidential information, and internal system information. For example, the service may include services such as membership registration, login, financial transaction, certificate issuance, and administrative processing.

According to the operating method of the server 20 performing multi-factor authentication according to an embodiment, it is possible to improve the security level.

So far, a method of operating the server 20 performing multi-factor authentication according to an embodiment has been described. Hereinafter, a method of operating the user terminal 10 will be described.

Referring to FIG. 5, first, in step 510, the user terminal 10 may acquire the user's first biometric information. In an embodiment, the first biometric information may include feature information on at least one of a user's fingerprint, iris, voice, and face. The user terminal 10 may obtain fingerprint information through a fingerprint sensor according to the type of biometric information, obtain iris information and face information through a camera module, and obtain voice information through a microphone. . In an embodiment, the first biometric information obtained primarily may be transformed into a vector or matrix representing biometric characteristics extracted therefrom.

In step 520, the user terminal 10 may generate first location information of the user terminal 10. In an embodiment, the first location information of the user terminal 10 may be generated based on the unique location information allocated by the server 20. Here, the unique location information may include a unique code allocated by the server 20 for each base station of the mobile communication service provider, and may be broadcast through the base station. The user terminal 10 may receive the unique code broadcast through the base station and generate first location information based on the received unique code. In addition, in one embodiment, the first location information of the user terminal 10 is various known in the art, such as a global positioning system (GPS), an RF fingerprint, and pedestrian dead reckoning (PDR). It may be generated directly on the user terminal 10 side based on the method. Here, the location information may be in the form of a vector or a matrix indicating location characteristics of the user terminal 10.

In step 530, the user terminal 10 may transmit an authentication request to the server 20. The authentication request may include the user's first biometric information obtained and/or generated in steps 420 and 430, first location information of the user terminal 10, and identification information of the user terminal 10. Here, the identification information of the user terminal 10 is terminal-specific identification information, and may include an International Mobile Equipment Identity (IMEI). The identification information of the user terminal 10 is information already known to the user terminal 10.

In step 540, the user terminal 10 may receive a service from the server 20. In one embodiment, the service may include services that must send and receive information that should not be leaked to the outside, such as personal information, trade secret, confidential information, and internal system information. For example, the service may include services such as membership registration, login, financial transaction, certificate issuance, and administrative processing.

According to the operating method of the user terminal 10 performing multi-factor authentication according to an embodiment, it is possible to improve the security level.

First, referring to FIG. 6A, in an embodiment, the server 20 may generate first authentication information by simply combining the first biometric information of the user and the first location information of the user terminal 10 in parallel. That is, the first biometric information and the first location information may be a vector or matrix having the same number of columns or the same number of rows, and the rows or columns of the first location information are successively or alternated with the rows or columns of the first biometric information. By arranging the first authentication information can be generated.

For example, when the first biometric information and the first location information are composed of a matrix having the same number of columns, the server 20 is a component constituting the first location information above the first row of the first biometric information ( entry), or by arranging an entry constituting the first location information below the last row of the first biometric information, the first authentication information in which the biometric information and the location information are merged may be generated.

6B, the server 20 compresses at least one of the first biometric information of the user and the first location information of the user terminal 10 to combine compressed information or compressed information and uncompressed information. By doing so, it is possible to generate the first authentication information.

For example, the server 20 selects some of the components constituting the row and column of the first location information of the user terminal 10, or calculates them according to a predetermined method. You can compress rows or columns of information. Subsequently, the server 20 arranges an entry constituting the compressed first position information to the upper side of the first row of uncompressed first biometric information, or arranges it to the lower side of the last row of the first biometric information to First authentication information in which information and location information are merged may be generated.

6C, the server 20 converts at least some of the first biometric information or the components constituting the first location information by mutually calculating the first biometric information of the user and the first location information of the user terminal 10 By doing so, it is possible to generate the first authentication information. In this case, the generated first authentication information may be configured to have the same format as the first biometric information or the first location information, that is, the same number of rows and columns.

For example, the server 20 calculates at least some of the components constituting the first location information with at least some of the components constituting the first biometric information. By converting, first authentication information in which biometric information and location information are merged can be generated.

6A to 6C, a row or column is added to the first biometric information by combining first location information (or compressed first location information), or a component of the first biometric information is calculated by calculating a component of the first location information. Although a method of converting is shown, this is an example, and according to an embodiment, a method of combining the first biometric information with the first location information or a method of calculating a component of the first biometric information to convert the component of the first location information Of course, it can be replaced in a way.

Meanwhile, in order to verify the first authentication information, the second authentication information detected by the server 20 may be configured in the form of a vector or matrix having the same number of rows and columns as the first authentication information.

As shown in FIG. 7, the server 700 performing multi-factor authentication according to an embodiment may include a communication unit 710, a memory 720, and a processor 730. However, the constituent elements of the server 700 performing multi-factor authentication are not limited to the above-described example. For example, the server 700 performing multi-factor authentication may include more or fewer components than the above-described components. In addition, the communication unit 710, the memory 720, and the processor 730 may be implemented in the form of a single chip. In addition, as described above, the server 700 performing multi-factor authentication may be a plurality of servers, and at this time, communication between a plurality of servers and multi-factor authentication may be performed, and each server is a communication unit 710 ), a memory 720, and a processor 730 may be included.

The communication unit 710 may transmit and receive signals with an external device. Signals transmitted and received with an external device may include control information and data. In this case, the external device may include a user terminal that performs multi-factor authentication. The communication unit 710 may include all wired and wireless communication units. In addition, the communication unit 710 may receive a signal through a wired/wireless channel, output it to the processor 730, and transmit a signal output from the processor 730 through a wired/wireless channel.

The memory 720 may store programs and data required for the operation of the server 700 that performs multi-factor authentication. In an embodiment, the memory 720 may store control information or data included in signals transmitted and received by the server 700 performing multi-factor authentication. The memory 720 may be composed of a storage medium such as a ROM, a RAM, a hard disk, a CD-ROM, and a DVD, or a combination of storage media. In addition, there may be a plurality of memories 720. According to an embodiment, the memory 720 may store a program for performing an operation for recommending a service, which is the embodiments of the present disclosure described above.

The processor 730 may control a series of processes in which the server 700 performing multi-factor authentication operates according to the above-described embodiment of the present disclosure. For example, components of the server 700 performing multi-factor authentication may be controlled to perform the operation of the server 700 performing multi-factor authentication according to an embodiment. There may be a plurality of processors 730, and the processor 730 may perform an operation of the server 700 that performs multi-factor authentication by executing a program stored in the memory 720.

In one embodiment, the processor 730 receives the first biometric information of the user of the user terminal 10, the first location information of the user terminal 10, and identification information of the user terminal 10 from the user terminal 10. Receiving the included authentication request, generating first authentication information by merging the first biometric information and the first location information, and based on the identification information of the user terminal 10, the user terminal 10 through the server of the mobile communication service provider. ), and detects second authentication information including at least one of the user's second biometric information corresponding to the identification information of the user terminal 10 and the second location information of the user terminal 10 And, by comparing the first authentication information and the second authentication information, it is possible to control to perform multi-factor authentication.

Here, the first biometric information may include feature information on at least one of a user's fingerprint, iris, voice, and face of the user terminal 10. In addition, the first biometric information is a vector or matrix representing at least one biometric characteristic of the user of the user terminal 10 obtained by the user terminal 10, and the first location information represents the location characteristic of the user terminal. It is a vector or matrix, and the first biometric information and the first location information may be composed of at least one row and at least one column.

In an embodiment, the processor 730 may generate the first authentication information by arranging the rows or columns of the first location information in succession or alternating with the rows or columns of the first biometric information. In addition, in one embodiment, the processor 730 compresses a row or column of the first location information by mutually calculating an entity constituting the first location information, and compresses the first biometric information continuously or alternately. First authentication information can be generated by arranging rows or columns of the first location information. In addition, in an embodiment, the processor 730 may generate the first authentication information by mutually calculating the first biometric information and the first location information to convert at least some of the components constituting the first biometric information.

In one embodiment, the processor 730 may pre-generate and store the second authentication information in the authentication database based on the second biometric information of the pre-registered user and the second location information corresponding to one of the base stations of the mobile communication service provider. have. In this case, the first authentication information and the second authentication information may be a vector or matrix composed of the same number of rows and columns.

In an embodiment, the processor 730 may obtain the second location information of the user terminal 10 based on at least one of identification information and a unique code of a base station to which the user terminal is accessed.

In an embodiment, the processor 730 may perform multi-factor authentication by comparing the similarity between the first authentication information and the second authentication information through a k-nearest neighbors (KNN) algorithm.

As shown in FIG. 8, the user terminal 800 performing multi-factor authentication according to an embodiment includes a communication unit 810, a memory 820, a biometric information acquisition unit 830, and a processor 840. I can. However, the constituent elements of the user terminal 800 performing multi-factor authentication are not limited to the above-described example. For example, the user terminal 800 performing multi-factor authentication may include more or fewer components than the above-described components. In addition, the communication unit 810, the memory 820, and the processor 840 may be implemented in the form of a single chip.

The communication unit 810 may transmit and receive signals with an external device. Signals transmitted and received with an external device may include control information and data. In this case, the external device may include a server that performs multi-factor authentication. The communication unit 810 may include all wired and wireless communication units. In addition, the communication unit 810 may receive a signal through a wired or wireless channel, output it to the processor 840, and transmit a signal output from the processor 840 through a wired or wireless channel.

The memory 820 may store programs and data necessary for the operation of the user terminal 800 that performs multi-factor authentication. In an embodiment, the memory 820 may store control information or data included in a signal transmitted and received by the user terminal 800 performing multi-factor authentication. The memory 820 may be composed of a storage medium such as a ROM, a RAM, a hard disk, a CD-ROM, and a DVD, or a combination of storage media. Further, there may be a plurality of memories 820. According to an embodiment, the memory 820 may store a program for performing an operation for recommending a service, which is the embodiments of the present disclosure described above.

The biometric information acquisition unit 830 may obtain the user's first biometric information. In an embodiment, the user's first biometric information may include feature information about at least one of a user's fingerprint, iris, voice, and face. In an embodiment, the biometric information acquisition unit 830 may include a fingerprint sensor, a camera module, a microphone, or the like according to the type of biometric authentication information.

The processor 840 may control a series of processes in which the user terminal 800 performing multi-factor authentication is operated according to the above-described embodiment of the present disclosure. For example, components of the user terminal 800 performing multi-factor authentication may be controlled to perform an operation of the user terminal 800 performing multi-factor authentication according to an embodiment. There may be a plurality of processors 840, and the processor 840 may perform an operation of the user terminal 800 that performs multi-factor authentication by executing a program stored in the memory 820.

In one embodiment, the processor 840 obtains the user's first biometric information, receives the unique location information assigned by the server from the base station, generates first location information of the user terminal, and generates the user's first biometric information, the user's first biometric information, and the user's first biometric information. The authentication request including the first location information of the terminal 800 and the identification information of the user terminal 800 may be transmitted to the server, and control may be performed to receive a service provision from the server.

Meanwhile, the above-described embodiment can be written as a program that can be executed on a computer, and can be implemented in a general-purpose digital computer that operates the program using a medium readable by a computer. In addition, the structure of the data used in the above-described embodiment may be recorded on a computer-readable medium through various means. In addition, the above-described embodiment may be implemented in the form of a recording medium including instructions executable by a computer, such as a program module executed by a computer. For example, methods implemented as software modules or algorithms may be stored in a computer-readable recording medium as codes or program instructions that can be read and executed by a computer.

The computer-readable medium may be any recording medium that can be accessed by a computer, and may include volatile and nonvolatile media, and removable and non-removable media. The computer-readable medium includes a magnetic storage medium such as a ROM, a floppy disk, a hard disk, and the like, and may include an optical reading medium such as a CD-ROM, a DVD, etc., but is not limited thereto. . In addition, computer-readable media may include computer storage media and communication media.

In addition, a plurality of computer-readable recording media may be distributed over network-connected computer systems, and data stored in the distributed recording media, for example, program instructions and codes, may be executed by at least one computer. have.

The specific implementations described in the present disclosure are merely exemplary, and do not limit the scope of the present disclosure in any way. For brevity of the specification, descriptions of conventional electronic components, control systems, software, and other functional aspects of the systems may be omitted.

Claims

In the operating method of the server performing multi-factor authentication,

Receiving an authentication request from a user terminal, the authentication request including first biometric information of the user of the user terminal, first location information of the user terminal, and identification information of the user terminal;

Generating first authentication information by merging the first biometric information and the first location information;

Acquiring second location information of the user terminal based on the identification information of the user terminal;

Detecting second authentication information including at least one of second biometric information of a user corresponding to the identification information of the user terminal and second location information of the user terminal; And

And performing multi-factor authentication by comparing the first authentication information and the second authentication information.
The method of claim 1,

The first biometric information includes feature information on at least one of a user's fingerprint, iris, voice, and face of the user terminal.
The method of claim 1,

The first biometric information is a vector or matrix representing at least one biometric characteristic of a user of the user terminal obtained by the user terminal,

The first location information is a vector or matrix representing the location characteristics of the user terminal generated based on the unique location information allocated by the server or generated by the user terminal,

The first biometric information and the first location information are composed of at least one row and at least one column.
The method of claim 3,

Generating the first authentication information,

A method of performing multi-factor authentication of a server, wherein the first authentication information is generated by arranging rows or columns of the first location information in succession or alternating with the row or column of the first biometric information.
The method of claim 3,

Generating the first authentication information,

Compressing a row or column of the first location information by mutually calculating an entity constituting the first location information; And

And generating the first authentication information by arranging rows or columns of the compressed first location information in succession or alternating with the row or column of the first biometric information.
The method of claim 3,

Generating the first authentication information,

A method of performing multi-factor authentication of a server, wherein the first authentication information is generated by mutually calculating the first biometric information and the first location information to convert at least some of components constituting the first biometric information.
The method of claim 3,

The first authentication information and the second authentication information are a vector or matrix composed of the same number of rows and columns,

The second authentication information is pre-generated based on the second biometric information of a pre-registered user and the second location information corresponding to one of the base station of the mobile communication service provider and stored in an authentication database, multi-factor authentication of the server How to do it.
The method of claim 3,

The unique location information includes a unique code allocated by the server for each base station of the mobile communication service provider, and is broadcast through the base station,

Obtaining the second location information,

A method of performing multi-factor authentication of a server performed based on at least one of identification information and a unique code of a base station to which the user terminal is accessed.
The method of claim 1,

Performing the multi-factor authentication,

A method of performing multi-factor authentication of a server, performed by comparing a degree of similarity between the first authentication information and the second authentication information through a k-nearest neighbors (KNN) algorithm.
In the server that performs multi-factor authentication,

Communication department;

A memory storing a program for performing multi-factor authentication; And

An authentication request including first biometric information of the user of the user terminal, first location information of the user terminal, and identification information of the user terminal is received from a user terminal, and the first biometric information and the first location information The first authentication information is generated by merging, and the second location information of the user terminal is obtained based on the identification information of the user terminal, and the user's second biometric information and the user corresponding to the identification information of the user terminal A server comprising a processor that detects second authentication information including at least one of second location information of a terminal, and controls to perform multi-factor authentication by comparing the first authentication information with the second authentication information.
The method of claim 10,

The first biometric information includes feature information on at least one of a user's fingerprint, iris, voice, and face of the user terminal.
The method of claim 10,

The first biometric information is a vector or matrix representing at least one biometric characteristic of a user of the user terminal obtained by the user terminal,

The first location information is a vector or matrix representing the location characteristics of the user terminal generated based on the unique location information allocated by the server or generated by the user terminal,

The first biometric information and the first location information are composed of at least one row and at least one column.
The method of claim 12,

The processor,

A server configured to generate the first authentication information by arranging rows or columns of the first location information in succession or alternating with the rows or columns of the first biometric information.
The method of claim 12,

The processor,

Compressing the row or column of the first location information by mutually calculating an entity constituting the first location information, and the row of the compressed first location information by successively or alternating with the first biometric information, or A server for generating the first authentication information by arranging rows.
The method of claim 12,

The processor,

A server configured to generate the first authentication information by mutually calculating the first biometric information and the first location information to convert at least some of the components constituting the first biometric information.
The method of claim 12,

The first authentication information and the second authentication information are a vector or matrix composed of the same number of rows and columns,

The processor,

The server for generating the second authentication information in advance based on the second biometric information of a pre-registered user and the second location information corresponding to one of a base station of the mobile communication service provider and storing the second authentication information in an authentication database.
The method of claim 12,

The unique location information includes a unique code allocated by the server for each base station of the mobile communication service provider, and is broadcast through the base station,

The processor,

A server that obtains the second location information based on at least one of identification information and a unique code of a base station to which the user terminal is accessed.
The method of claim 10,

The processor performs the multi-factor authentication by comparing the similarity between the first authentication information and the second authentication information through a k-nearest neighbors (KNN) algorithm.
A computer program product comprising a recording medium storing a program for executing the method of performing multi-factor authentication of a server according to any one of claims 1 to 9.