WO2021206289A1

WO2021206289A1 - User authentication method, device and program

Info

Publication number: WO2021206289A1
Application number: PCT/KR2021/002325
Authority: WO
Inventors: 오스티븐상근; 이진서
Original assignee: 오스티븐상근; 이진서
Priority date: 2020-04-08
Filing date: 2021-02-24
Publication date: 2021-10-14
Also published as: KR102199138B1

Abstract

The present invention relates to a user authentication method, device and program which enable a verification of whether or not original biometric data of an authentication module has been damaged, by means of hash information in an authentication server when authenticating the identity of a user by means of the biometric data. The user authentication method by means of an information device of the present invention comprises an authentication module preparing step, a biometric data input step, an intramodular processing step, a hash information generating step and an authentication confirmation step.

Description

User authentication method, device and program

The present invention relates to a user authentication method, apparatus and program, and more particularly, when authenticating whether a user is a user by biometric information, whether or not the original biometric information of an authentication module is damaged by hash information in an authentication server It relates to a user authentication method, apparatus and program.

In general, authentication of the identity of the user may be required prior to the use of information equipment, connection to a server, data processing, and the like. For example, when logging in to a server such as a shopping mall by using an information device such as a computer, or performing remittance processing in a server such as online banking by using an information device such as a smartphone, for example, a request for logging in or a request to perform remittance processing It needs to be verified whether the user who does this is a pre-registered person.

As a conventional user authentication method, there is a method by ID/password. However, verification of ID/password is only verification of knowledge of stored character data, and this knowledge can be exposed or transmitted to others. The problem is that there is no guarantee.

In addition, there are a pattern-based method, a PIN-based method, and a password-based method for user authentication. However, the verification of the pattern is basically only verification of knowledge, and thus has the same problem as the method using the ID/password.

In the prior art, according to the following patent document, 'in a method executed through an operation server that interworks with an application server that provides a vehicle sharing service that shares a driving right to drive a shared vehicle designated to a plurality of users for a certain period of time, , by one-to-one mapping of N vehicle information for N (N ≥ 1) shared vehicles that can share driving rights for a certain period of time to multiple users and N vehicle phone numbers uniquely assigned to each of the N shared vehicles. A first step of storing the designated number management D / B; When applying for a car sharing service through the app of any sharing applicant wireless terminal, vehicle information of the shared vehicle to be shared with the sharing applicant via a designated route, sharing time information to share the shared vehicle with the sharing applicant, and the sharing applicant wireless terminal a second step of receiving a mobile phone number of a third step of inquiring a number management D/B based on vehicle information of a shared vehicle to be shared with the sharing applicant and confirming a vehicle phone number of a designated numbering system assigned to a shared vehicle, not a calling device; a fourth step of mapping the mobile phone number of the sharing applicant wireless terminal, the vehicle phone number assigned to the shared vehicle, and sharing time information to share the shared vehicle, and storing the mapping in a designated storage medium; When the sharing start time of the stored sharing time information has not arrived, the call forwarding function of the shared vehicle's vehicle phone number mapped with the shared applicant's wireless terminal is inactivated (or maintained in an inactive state) and the sharing starts a fifth step of processing the call connection request to the vehicle phone number to be forwarded to the mobile phone number when the time arrives; a sixth step of checking whether a sharing end time for terminating sharing of the shared vehicle has elapsed based on the stored sharing time information; and a seventh step of inactivating (or releasing) the call forwarding function of the vehicle phone number assigned to the shared vehicle when the sharing end time of the shared vehicle has elapsed; has been disclosed.

[Prior art literature]

[Patent Literature]

(Patent Document 1) Patent Registration No. 10-1783555

The description of the above patent document specifies a co-owner who is a driver by using the mobile phone number of the applicant's wireless terminal. That is, the mobile phone number of the applicant's wireless terminal serves as an ID.

However, IDs and mobile phone numbers are just 'knowledge' that can be shared with others. As it is a piece of knowledge, there may be cases in which the person actively informs others of his/her ID or mobile phone number, and there may be cases in which the ID or mobile phone number is stolen by others against his/her will.

At this time, when another person who has acquired the knowledge applies for the service, there is a fear that the user (the person) in the name of the application and the user who actually uses the knowledge (the other person) may be different. For this reason, the performance for each user may be erroneously calculated, and furthermore, there is a risk of being misused for crime.

In addition, an ID or mobile phone number is an authentication method that is inconvenient to enter into the device by typing or the like. Therefore, in the case of temporary user change due to typing inconvenience, for example, when a temporary user changes, for example, when a factory worker entrusts a conveyor operation to an adjacent worker to go to the bathroom for a while, in the case of a temporary user change, an ID or mobile phone number for changing the user There are cases where typing is not performed, and even when typing is performed, there is a risk of authentication failure due to mistyping.

On the other hand, there is also a method using biometric information such as face, iris, and fingerprint for user authentication. Since biometric information does not fall under the verification of knowledge, there is no problem of exposure, transmission, or theft. Since such biometric information is extremely important personal information, strict management is required. In particular, when biometric information is transmitted and received through a network, an accident in which biometric information is leaked may occur due to hijacking of the network signal. Of course, hardware containing biometric information, for example, a server, terminal, module, etc. may be hacked, and biometric information may be stolen. Furthermore, if biometric information registered in a server, terminal, module, etc. can be altered without permission, after altering the biometric information of another person other than the originally registered user, that other person is authenticated by the biometric information, There is also a possibility that manipulation such as a crime that steals the effect of authentication of the originally registered user may occur.

The present invention is intended to solve the problems of the technology in the above patent document, and the user is accurately and quickly authenticated by an authentication method in which the person actively informs others or does not take over the person's will. It is to provide a user authentication method, apparatus and program that can do this.

In addition, in the case of user authentication using biometric information, it is an object of the present invention to provide a user authentication method, apparatus, and program that allow authentication to be performed in a state in which biometric information is not transmitted and received through a network.

Another object of the present invention is to provide a user authentication method, apparatus, and program that can prevent the occurrence of a crime of stealing the authentication effect of others according to alteration or modification of biometric information.

The method of the present invention for achieving the above object is a user authentication method through an information device, wherein an authentication module to be used for user authentication is registered in an authentication server, and the user's original biometric information is registered in the authentication module, an authentication module preparation step in which original hash information generated in a predetermined manner from the original biometric information by an authentication module is registered in the authentication server; a biometric information input step of newly inputting instantaneous biometric information of a current user into the authentication module through a biometric sensor of the authentication module detachably connected to the information device; In a state where both the original biometric information and the instantaneous biometric information are provided in the authentication module and not transmitted to the outside, the original biometric information and the instantaneous biometric information are compared in the authentication module, and the original biometric information a module internal processing step of outputting a predetermined biometric matching signal from the authentication module when the instantaneous biometric information coincides with a predetermined range; an instantaneous hash information generating step of generating instantaneous hash information from the original biometric information used for comparison in the authentication module and transmitting it to the authentication server; In a state in which both the original hash information and the instantaneous hash information are provided in the authentication server, the comparison result of the original hash information and the instantaneous hash information in the authentication server that received the biometric matching signal matches the hash coincidence in this case, an authentication confirmation step of outputting a predetermined authentication confirmation signal from the authentication server; It is characterized in that it is included.

Here, in the module internal processing step, it is preferable that the match degree determination is performed while the original biometric information and the instantaneous biometric information are loaded into a secure memory readable only within the authentication module.

In addition, the original biometric information is stored in an encrypted state, and it is preferable to be decrypted and processed immediately before the matching is determined in the processing step inside the module.

And, it is preferable that the instantaneous biometric information is irretrievably completely deleted immediately after the match is determined.

And, before the instantaneous hash information generating step, a designated position output step of outputting a designated position to be compared of hash information from the authentication server that has received the biometric matching signal is further provided, wherein in the instantaneous hash information generating step, the Instantaneous hash information of the specified position is generated and transmitted, and in the authentication confirmation step, it is preferable that the instantaneous hash information of the specified position and the original hash information are compared.

And, it is preferable that the designated position is determined by a random number.

And, it is preferable that the said designated position is plural.

On the other hand, the device of the present invention for achieving the above object is a user authentication device through an information device, with an external authentication server connected, one side is detachably connected to the information device, and the other side is connected to the biosensor. It is connected, the user's original biometric information is registered therein, and the original hash information generated from the original biometric information in a predetermined manner is registered in the authentication server, By receiving the instantaneous biometric information of the current user, both the original biometric information and the instantaneous biometric information are provided inside, and the original biometric information and the instantaneous biometric information are stored inside in a state in which the instantaneous biometric information is not transmitted to the outside. When the degree of coincidence between the original biometric information and the instantaneous biometric information falls within a predetermined range, a predetermined biometric coincidence signal is output, while instantaneous hash information is generated from the original biometric information used for comparison, and the authentication an authentication module to be transmitted to the server; In a state in which the original hash information is registered from the authentication module, the instantaneous hash information is received along with the biometric matching signal from the previously registered authentication module, and both the original hash information and the instantaneous hash information are provided inside In the present state, the original hash information and the instantaneous hash information are compared, and when they match, a hash match determination is made and an authentication server that outputs a predetermined authentication confirmation signal is included.

On the other hand, the program of the present invention for achieving the above object is a program for user authentication, in which an information processing device records a program for executing each step of the method described above in a storage medium readable by an information processing device. recorded program.

According to the present invention, there is provided a user authentication method, apparatus and program that can accurately and quickly authenticate a user by an authentication method in which the person actively informs others or does not take over the person against his/her will. is provided

In addition, in the case of user authentication using biometric information, a user authentication method, apparatus, and program are provided so that authentication is performed in a state in which biometric information is not transmitted and received through a network.

In addition, there is provided a user authentication method, apparatus and program capable of preventing the occurrence of a crime of stealing authentication effects of others according to alteration of biometric information.

1 is a block diagram of an embodiment of an apparatus in which a user authentication method according to the present invention will be implemented.

2 is a flowchart of the same method.

Hereinafter, with reference to the accompanying drawings, a method, apparatus, and program for detecting usage performance for each user for a shared object according to the present invention will be described in detail. However, for members having the same function due to the same configuration, the same reference numerals are maintained even if the drawings are different, and thus detailed description thereof may be omitted.

In addition, the relationship in which another member is arranged or connected to the front, rear, left, right, and upper and lower sides of a member includes a case in which a separate member is inserted in the middle. Conversely, when a member is said to be 'right', right, left, or top and bottom of another member, it means that there is no separate member in the middle. And when a part 'includes' other components, this means that other components may be further included, rather than excluding other components, unless otherwise stated.

In addition, the reason that the names of the components are divided into the first, the second, etc. is to classify them in the same relationship, and the order is not necessarily limited thereto. In addition, terms such as 'unit', 'means', 'unit', 'member', and 'module' described in the specification mean a unit of a comprehensive configuration that performs at least one function or operation. And information processing devices such as terminals and servers described in the specification basically mean hard wiring, which means hardware in which specific functions or operations are implemented, but should not be construed to be limited to specific hardware, and should not be construed as being limited to specific hardware. This does not exclude soft wiring, which consists of software running to cause a specific function or operation to be implemented. That is, the terminal or server may be any device or software installed on any device, such as an app.

And since the size and thickness of each component shown in the drawings are arbitrarily indicated for convenience of explanation, the present invention is not necessarily limited to the bar shown in the drawings, and in order to clearly express various parts and regions such as layers and regions In some cases, the thickness and the like are exaggerated and enlarged or reduced.

The method of the present invention is a method for authenticating the user 14 through the information device 10 . This method can be used when authentication of the identity of the user 14 is required prior to the use of the information device 10 , the connection to the server 30 , the execution of data processing 31 , and the like. For example, when logging in to the server 30, such as a shopping mall, etc. by the information device 10 such as a computer, or by the information device 10 such as a smart phone, for example, the remittance processing is performed in the server 30, such as online banking (31) In such a case, it can be used when it is necessary to verify whether the user 14 who requests the login or the request to perform the remittance processing is a previously registered person. However, the authentication of the user 14 is not limited to the cases exemplified above, and for example, in the case of verifying whether the user 14 is allowed in advance, such as in the military field or aerospace, in-company decision-making, or the entrance door. It is of course interpreted that it can be used for all of them.

The method of the present invention, the authentication module preparation step (S10) and; Biometric information input step (S20) and; Module internal processing step (S30) and; Instantaneous hash information generation step (S40) and; authentication verification step (S50); It is characterized in that it is included.

In the authentication module preparation step (S10) , the authentication module 12 to be used for authentication of the user 14 is registered in the authentication server 20, and the original biometric information of the user 14 is registered in the authentication module 12 In addition, original hash information generated in a predetermined manner from the original biometric information by the authentication module 12 is registered in the authentication server 20 .

The authentication server 20 is a server configured to output a predetermined signal corresponding thereto when receiving a predetermined signal. That is, unlike the conventional server, a high-level computational processing such as image comparison processing is not required. Accordingly, it is possible to increase the processing speed while reducing errors.

The authentication server 20 is preferably configured to respond only to signals from the authentication module 12 registered in advance. Accordingly, the authentication module 12 must be registered in the authentication server 20 in advance prior to signal transmission and reception. When the authentication module 12 is registered with the authentication server 20, security verification, for example, verification by a public certificate or a private certificate may be performed. Whether or not to register may be determined by a unique identification code of the authentication module 12, for example, a serial number or ID.

The original biometric information is biometric information serving as a standard to be used for authentication. The original biometric information may be obtained and input through the biometric sensor 13 connected to the authentication module 12 . However, it is not limited to this. For example, the original biometric information may be transmitted and input from another device (not shown) without going through the biosensor 13 .

On the other hand, in order to check whether the original biometric information is hacked, original hash information is generated in a predetermined manner by the authentication module 12 for the original biometric information, and is transmitted to the authentication server 20 for registration. have. This original hash information is data that is stored in advance to be used for verifying whether the original biometric information is hacked when comparing the biometric information later. Here, the hash information may be set, for example, as a hash function value, but is not limited thereto, and may be set, for example, as a predetermined processed value for the hash function value. Hereinafter, a hash function value or a processed value thereof is collectively referred to as hash information.

When the original hash information is transmitted from the authentication module 12 to the authentication server 20, it is transmitted in an encrypted state. If the original hash information is a hash function value, all hash function values may be transmitted, or the server may have all or part of the hash value for biometric information through another method. The authentication server 20 securely stores the original hash information.

In the biometric information input step (S20) , the current user is newly added to the authentication module 12 through the biometric sensor 13 of the authentication module 12 detachably connected to the information device 10. In step (14), instantaneous biometric information is input.

The information device 10 is a unit contributing to the processing of the authentication function according to the present invention in addition to the basic functions such as connection to the processing server 30 and information processing. For example, when the information device 10 makes a processing request such as logging in to the processing server 30 , the processing request unit 11 in the information device 10 performs the processing unit of the processing server 30 . It is connected to (31), determines a method of log-in processing, performs authentication processing through the authentication module 12 and authentication server 20 in the information device 10, and confirms authentication in the authentication server 20 It may be set to wait for the signal to be input to the processing unit 31 .

The processing request unit 11 may be included in the information device 10 to be integrally configured. However, it is not limited to this. The processing request unit 11 may be detachably configured to be detachably attached to the information device 10 . Similarly, the processing performing unit 31 may be included in the processing server 30 to be integrally configured. However, it is not limited to this. The processing performing unit 31 may be detachably configured to be detachably attached to the processing server 30 .

The authentication module 12 may be integrally installed and included in the processing request unit 11 or the information device 10 . In this case, with a stable electrical connection, an optimized configuration is possible.

However, the authentication module 12 is preferably configured to be detachably fastened to the processing request unit 11 or the information device 10 . The method of attachment and detachment is possible regardless of wired or wireless, for example, a case in which the authentication module 12 in the form of a USB dongle is physically attached to and detached from the processing request unit 11 or the information device 10 having a terminal of a USB interface. , as another example, a case in which the processing request unit 11 or the information device 10 and the authentication module 12 having a Bluetooth-type wireless means are paired with each other within a reachable range. In this detachable case, the authentication module 12 may be configured to be connected to various information devices 10 . Accordingly, it is possible to increase the degree of freedom of connection. In addition, during non-use time, the authentication module 12 can be separated from the processing request unit 11 and stored in a safer place, such as a safe.

In particular, the authentication module 12 may be configured to be formed in plurality. In this case, each of the plurality of authentication modules 12 may be for individuals assigned to each user 14 . In this case, the authentication module 12 of each user 14 is preferably configured such that the original biometric information of each user 14 is registered. By doing so, each authentication module 12 is thoroughly personalized and used only for authentication of each individual user 14 . And this personal authentication module 12 can be used for various information devices (10).

The instantaneous biometric information is biometric information input to be compared with the original biometric information. This is obtained from the biosensor 13 connected to the authentication module 12 . The biosensor 13 may be included in the authentication module 12 as an integral type installed. By doing so, security can be enhanced. However, it is not limited to this. The biosensor 13 may be detachably connected to the authentication module 12 . By doing so, there are advantages in that the newly developed sensor and different types of sensors can be replaced and installed, and the sensor itself can be managed separately.

In the module internal processing step (S30) , both the original biometric information and the instantaneous biometric information are provided in the authentication module 12 and are not transmitted to the outside; When the original biometric information and the instantaneous biometric information are compared and the degree of matching between the original biometric information and the instantaneous biometric information is within a predetermined range, a predetermined biometric matching signal is outputted from the authentication module 12 .

Here, it is preferable that the original biometric information and the instantaneous biometric information are configured to determine the degree of matching while being loaded in a secure memory (not shown) readable only within the authentication module 12 . The secure memory is not accessible from the outside of the authentication module 12 . Therefore, a hacking attempt by data access to the authentication module 12 itself is impossible, and security is extremely improved.

In addition, it is preferable that the original biometric information is stored in an encrypted state, and is decrypted immediately before the matching degree is determined so that the matching degree determination is processed. Accordingly, even if a hacking attempt occurs on the biometric information in the authentication module 12, the security is greatly improved due to the encrypted original biometric information.

It is preferable that the instantaneous biometric information is configured to be irretrievably completely deleted immediately after the match is determined. As a result, even if a hacking attempt occurs on the biometric information used for determining the degree of matching in the authentication module 12, since it is already in a state of being irretrievably completely deleted, security is extremely improved.

For the determination of the degree of matching, a conventional technique for determining the degree of agreement or similarity with respect to a pattern of biometric information may be used. To balance security and speed, the predetermined range of the degree of matching may be adjusted.

The biometric matching signal output as a result of determining the degree of matching is a signal predetermined between the authentication server 20 and the authentication module 12 registered in the authentication server 20 . The biometric signal is transmitted from the authentication module 12 directly to the authentication server 20 or from the authentication module 12 through the processing request unit 11 or the information device 10 to the authentication server 20 . ) is sent to

The instantaneous hash information generation step S40 is a step in which instantaneous hash information is generated from the original biometric information used for comparison in the authentication module 12 and transmitted to the authentication server 20 .

When the authentication module 12 confirms the degree of conformity of biometric information by comparing the original biometric information and instantaneous hash information (when user verification is performed), before or after confirming the degree of conformity through biometric authentication, the authentication module 12 is , calculates instantaneous hash information (eg, hash function value) for the original biometric data used in the comparison conducted this time. This instantaneous hash information is generated in the authentication module 12 and transmitted to the authentication server 20 in the same way as when registering the original biometric information and registering the original hash information in the authentication module preparation step S10 .

In the authentication verification step (S50) , the original hash information and the instantaneous hash information are both provided in the authentication server 20, and in the authentication server 20 receiving the biometric matching signal, the original This is a step of outputting a predetermined authentication confirmation signal from the authentication server 20 in the case of a hash coincidence as a result of comparing the hash information and the instantaneous hash information.

By comparing the instantaneous hash information generated and transmitted when the original hash information stored in the authentication server 20 and this biometric information is compared, it is confirmed that the original biometric information registered and stored in the authentication module 12 has not been forged or altered. can be checked

The predetermined authentication confirmation signal is a signal predetermined between the authentication server 20 and the authentication module 12 registered in the authentication server 20, and the authentication server 20 in the process server 30 ) is a predetermined signal to be transmitted. Accordingly, the processing server 30 waits for the input of the authentication confirmation signal, and upon receiving the authentication confirmation signal, performs a predetermined process by the processing performing unit 31 .

For example, when the user 14 logs in to the shopping mall that is the processing server 30 in the computer that is the information device 10, the user 14 engages the processing request unit 11 with the removable authentication module 12, Instantaneous biometric information is input by the biometric sensor 13 built into the authentication module 12 . Then, the degree of matching between the original biometric information and the instantaneous biometric information is determined inside the authentication module 12, and if it falls within a predetermined range, a biometric matching signal is output. The authentication server 20 receiving the biometric matching signal outputs an authentication confirmation signal, which is input to the processing server 30 . The processing server 30 performs login processing by the processing execution unit 31 .

In this way, since the processing execution unit 31 of the processing server 30 that has received the processing request of the information device 10 by biometric authentication performs a predetermined processing, it is possible to identify users based on knowledge such as mobile phone numbers and IDs. It avoids the problems, and it is possible to accurately and simply identify the true user. In particular, since the degree of matching of biometric information is determined only inside the authentication module 12, there is no external leakage of biometric information. And since the match determination result is output only as a predefined signal, there is no external leakage of biometric information.

Furthermore, instantaneous biometric information is stored in the secure memory, the original biometric information is stored in an encrypted state, and the instantaneous biometric information is deleted after the match is determined, thereby completely blocking hacking attempts.

In addition, when the authentication module 12 is detachable, plural assigned to each user, and for personal use, it is possible to connect to various information devices 10 with a high degree of freedom.

In addition, since the authentication module 12 generates original hash information for the original biometric information registered in the authentication module 12 and registers it in the authentication server 20, it is possible to determine whether the registered original biometric information is hacked. can be judged. That is, when instantaneous biometric information is subsequently input and compared with the original biometric information as described above, the authentication module 12 newly generates instantaneous hash information of the original biometric information used for the comparison, and the authentication server 20 will be sent to The authentication server 20 compares the previously registered original hash information with the instantaneous hash information transmitted this time, and determines the hash coincidence only when they match. This hash coincidence determination becomes evidence that the original biometric information registered in the authentication module 12 has not been hacked. Therefore, even if the hacker replaces the original user's original biometric information of the authentication module 12 with the biometric information of another person, the instantaneous biometric information of the other person is input and the biometric matching signal of the comparison result is in accordance with the present invention. According to this, since the authentication server 20 does not receive a hash match determination according to the comparison of hash information, there is an effect that theft can be prevented.

On the other hand, there may be cases in which it is considered unsafe to send the entire instantaneous hash information to the authentication server at once every time instantaneous biometric information is compared. Considering this case, it may be considered to transmit the instantaneous hash information only upon request of the authentication server, or to transmit only a portion (position) designated by the authentication server. By doing so, the read of the security check by the server can be made.

To this end, before the instantaneous hash information generation step (S40), a specified position output step of outputting a specified position to be compared of hash information in the authentication server 20 that has received the biometric matching signal; . In this situation, in the instantaneous hash information generation step (S40), the instantaneous hash information of the specified position is generated and transmitted, and in the authentication confirmation step (S50), the instantaneous hash information of the designated position and the original hash information are compared It is desirable to make it possible.

Since hash information of a position designated in the authentication server is input to the authentication server in this way, whether the authentication module has been hacked can be checked and the integrity of the biometric information can be checked.

Here, the designated position is preferably determined by a random number. The authentication server may be provided with a random number generator. By designating a position by a random number, a different position value may be transmitted to the authentication module each time.

And here, it is preferable that the said designated position is plural. The plurality of designated positions may be configured such that all or part of them are used for comparison of hash information.

The apparatus of the present invention is a user authentication apparatus via the information device (10). The apparatus of the present invention includes an authentication module 12 ; The authentication server 20 ; is characterized in that it is included.

The authentication module 12 , with the authentication server 20 connected to the outside, one side is detachably connected to the information device 10, the other side is connected to the biometric sensor 13, inside In a state in which original biometric information of the user 14 is registered and provided, and original hash information generated from the original biometric information in a predetermined manner is registered in the authentication server 20, the biometric sensor 13 is By newly receiving instantaneous biometric information of the current user 14 through the and the instantaneous biometric information are compared, and when the degree of matching between the original biometric information and the instantaneous biometric information is within a predetermined range, a predetermined biometric coincidence signal is output, while instantaneous hash information from the original biometric information used for comparison is a module that is generated and transmitted to the authentication server 20 .

The authentication server 20 receives the instantaneous hash information together with the biometric matching signal from the previously registered authentication module 12 in a state in which the original hash information is registered from the authentication module 12, In a state where both the original hash information and the instantaneous hash information are provided inside, the original hash information and the instantaneous hash information are compared, and if they match, a hash match determination is made and a predetermined authentication confirmation signal is output. is the server

The program for user authentication of the present invention is a program recorded in a storage medium readable by an information processing device in which a program for causing the information processing device to execute each step of the method is recorded.

Although the preferred embodiments of the present invention have been described above, the present invention is not limited to the embodiments disclosed above, but is implemented with various modifications within the scope of the claims, the detailed description of the invention, and the accompanying drawings. It is natural for those of ordinary skill in the art that other embodiments that can be implemented and equivalent are possible, which also fall within the scope of the present invention, and only the embodiments are provided so that the disclosure of the present invention is complete, and the present invention It is provided to fully inform those of ordinary skill in the art to which the scope of the invention belongs, and the present invention is only defined by the scope of the claims.

The present invention can be used in the industry of user authentication methods, devices and programs.

[Explanation of code]

10: information equipment

11: Processing request department

12: authentication module

13: biosensor

14: user

20: authentication server

30: processing server

31: processing unit

Claims

As a user authentication method through an information device,

An authentication module to be used for user authentication is registered in the authentication server, and the user's original biometric information is registered in the authentication module, and the original hash information generated by the authentication module from the original biometric information in a predetermined manner is authenticated. an authentication module preparation step to be registered in the server;

a biometric information input step of newly inputting instantaneous biometric information of a current user into the authentication module through a biometric sensor of the authentication module detachably connected to the information device;

In a state where both the original biometric information and the instantaneous biometric information are provided in the authentication module and not transmitted to the outside, the original biometric information and the instantaneous biometric information are compared in the authentication module, and the original biometric information a module internal processing step of outputting a predetermined biometric matching signal from the authentication module when the instantaneous biometric information coincides with a predetermined range;

an instantaneous hash information generating step of generating instantaneous hash information from the original biometric information used for comparison in the authentication module and transmitting it to the authentication server;

In a state in which both the original hash information and the instantaneous hash information are provided in the authentication server, the comparison result of the original hash information and the instantaneous hash information in the authentication server that received the biometric coincidence signal matches the hash match in this case, an authentication confirmation step of outputting a predetermined authentication confirmation signal from the authentication server;

User authentication method, characterized in that it is included.
The method according to claim 1,

In the module internal processing step, the match degree determination is performed while the original biometric information and the instantaneous biometric information are loaded in a secure memory readable only within the authentication module

User authentication method characterized in that.
The method according to claim 1 or 2,

The original biometric information is stored in an encrypted state, and is decrypted and processed just before the match is determined in the module internal processing step

User authentication method characterized in that.
The method according to claim 1 or 2,

The instantaneous biometric information is irretrievably deleted immediately after the match is determined.

User authentication method characterized in that.
The method according to claim 1 or 2,

Prior to the instantaneous hash information generating step, a designated position output step of outputting a designated position to be compared of hash information from the authentication server that has received the biometric matching signal; is further provided,

In the instantaneous hash information generation step, instantaneous hash information of the specified position is generated and transmitted,

In the authentication verification step, the instantaneous hash information of the designated position and the original hash information are compared

User authentication method characterized in that.
6. The method of claim 5,

The designated position is determined by a random number

User authentication method characterized in that.
6. The method of claim 5,

The designated positions are plural.

User authentication method characterized in that.
As a user authentication device through an information device,

With the authentication server connected to the outside, one side is detachably connected to the information device, the other side is connected to the biosensor, and the user's original biometric information is registered therein, and from the original biometric information In a state in which the original hash information generated by a predetermined method is registered in the authentication server, the instantaneous biometric information of the current user is newly inputted through the biosensor, so that both the original biometric information and the instantaneous biometric information are The original biometric information and the instantaneous biometric information are compared inside in a state in which the original biometric information and the instantaneous biometric information are not transmitted to the outside. an authentication module for outputting a biometric matching signal of , while generating instantaneous hash information from the original biometric information used for comparison and transmitting it to the authentication server;

In a state in which the original hash information is registered from the authentication module, the instantaneous hash information is received along with the biometric matching signal from the previously registered authentication module, and both the original hash information and the instantaneous hash information are provided inside an authentication server in which the original hash information and the instantaneous hash information are compared, and if they match, a hash match determination is made and a predetermined authentication confirmation signal is output;

A user authentication device, characterized in that it is included.
As a program for user authentication,

A program recorded in an information processing device readable storage medium in which a program for executing each step of the method according to claim 1 or 2 is recorded in an information processing device.