KR100986980B1 - Biometric Authentication Methods, Clients, and Servers - Google Patents

Abstract

The present invention relates to a biometric authentication method, a client, and a server. The biometric authentication method according to an aspect of the present invention includes generating an original template from biometric information, and generating a first random number permutation matrix and a first random permutation matrix from the original template. Generating a first one-time authentication template and requesting authentication using one-time conversion information including at least one of a random binary vector; comparing and comparing the first one-time authentication template with the one-time registration template; And if it is authenticated according to the result, updating the one-time registration template and the one-time conversion information, wherein the updated one-time conversion information is generated in comparison with the updated one-time registration template upon the next authentication request. It is characterized by being used.

Biometrics, one-time, client, server

Description

Biometric authentication method, client and server

The present invention relates to a biometric authentication method, a client and a server, and more particularly, to a biometric authentication method with improved security.

The present invention is derived from a study conducted as part of the IT new growth engine core technology development project of the Ministry of Information and Communication and the Ministry of Information and Communication Research and Development. [Task Management Number: 2007-S-020-01, Title: Privacy Protection Bio-Recognition System] Development].

Bio-recognition is a technique of identifying an individual using his / her physical / behavioral characteristics. Methods of using physical features include face recognition, fingerprint recognition, iris recognition, etc. Methods of using behavioral features include gait recognition and signature recognition. In general, a biometric device generates a template containing a user's physical / behavioral characteristics and information and uses the same to register and confirm a user. A template registered and stored in the biometric device is called a gallery or a registration template, and a template newly generated from a user when an authentication request is called a probe or authentication template. User authentication is based on comparison values generated by comparing two templates. For example, a template with a real value uses Euclidean distance as a binary value, and a template with a binary value uses a dissimilarity such as a hamming distance as a comparison value. If it is smaller than the predetermined threshold, it is classified as genuine, and if it is larger than the threshold, it is classified as impostor.

Since the biometric data contains unique information of each user, when leaked and disclosed, not only can it bring serious privacy infringement but also cause a big problem in operating a user authentication system. If the biometric data registered for user authentication is leaked and disclosed, the data is no longer used as secret information for user authentication, and thus, it should be replaced with other biometric information. Common passwords can be easily changed, but as long as one face, two irises and ten fingerprints, the types and number of data that can be used for biometrics are limited by individual and unless the user undergoes special surgery No modification is possible. Therefore, once the user's bio-authentication information is leaked, there is a problem that the secret information that can verify their identity is leaked forever.

Therefore, in the case of sensitive or sensitive data such as biometric information, a method of converting and storing the data into another type of data through an encryption method is recommended. However, in the case of biometric data, even if biometric information of the same person is obtained by using the same device, it is almost impossible to obtain the same value every time. In addition, due to the general characteristics of cryptographic functions, even if similar values are encrypted, they are encrypted with completely different values. As a result, when the encrypted bio data and the newly input bio data are encrypted and directly compared, a comparison value which is inconsistent with that of the original data which is not encrypted is compared. Therefore, encrypted data cannot be directly used for user authentication in biometrics, and encrypted data must be decrypted each time for comparison and recognition. That is, a major disadvantage of the method of protecting the biometric data of the user by using encryption is that when comparing data for user authentication, the encrypted and registered template must be decrypted each time, which may expose the original data.

In particular, with the development of networks such as the Internet, many important data are transmitted through the network. Networks such as the Internet, by their nature, are open to anyone and can be easily accessed, creating a lot of security holes. For example, a password transmitted through the Internet can be copied in the middle without being hacked directly into a client or a server and used to illegally authenticate a user. In this case, even if the password is encrypted and transmitted, regardless of deriving the original password from the encrypted password, the encrypted password can be copied and stored in the middle and retransmitted as it is to be authenticated later. have. If the data transmitted over the network is biometric information instead of a normal password, as mentioned earlier, this security hole is more serious and threatening.

An object of the present invention is to provide a biometric authentication method, a client and a server performing the biometric authentication method that can improve the security.

Another object of the present invention is to provide a biometric authentication method, a client and a server performing the biometric authentication method, which can further improve security when the original template is represented in binary.

The object of the present invention is not limited to the above-mentioned object, and other objects that are not mentioned will be clearly understood by those skilled in the art from the following description.

In one aspect of the present invention for achieving the above object, a biometric authentication method generates an original template from biometric information, and includes a first random permutation matrix and a first random binary vector from the original template. Generating a first one-time authentication template and requesting authentication using one-time conversion information including at least one of), comparing the first one-time authentication template with the one-time registration template, and authenticating according to the comparison result. And updating the one-time registration template and the one-time conversion information, wherein the updated one-time conversion information is used to generate a second one-time authentication template to be authenticated as a result of comparison with the updated one-time registration template at the next authentication request. do.

In addition, the biometric authentication method according to another aspect of the present invention, in the biometric authentication method between the user, client and server, generating the original template of the bitstream from the user's biometric information, and uses the one-time conversion information provided from the user Converting the original template into a one-time authentication template, comparing the one-time authentication template with a one-time registration template previously stored in the server, and authenticating according to a result of the comparison; Updating the one-time registration template using a key, updating the first one-time conversion key, storing the updated one-time registration template and the updated first one-time conversion key in the server, and the first one-time conversion. Update the one-time conversion information using a second one-time conversion key equal to the key. , Comprising the step of updating the same and the second one-time conversion to the updated first key, a one-time conversion key, the step of conversion to the one-time authorization template comprises the step of changing the order of the bits of the bit stream.

In addition, a client according to another aspect of the present invention, in a client requesting authentication to a server, generates an original template from biometric information of a user, multiplies the original template by a first random permutation matrix, and An authentication template generator that generates a one-time authentication template by adding a first random binary vector to the multiplication result, and when the one-time authentication template is compared with the one-time registration template previously stored in the server, the user. A second random number permutation matrix and a second random number binary vector are generated using a one-time conversion key provided from the second random number permutation matrix and the second random number permutation matrix using the second random number permutation matrix and the second random number binary vector. An updater for updating the first random number permutation matrix and the first random number binary vector using a binary vector It should.

In addition, the server according to another aspect of the present invention, the server to authenticate at the request of the client, the storage unit, the one-time registration template previously stored in the storage unit, and the one-time authentication template generated from the biometric information by the client A first random number permutation matrix and a first random binary vector are generated by using a one-time conversion key previously stored in the comparator and the storage unit. And a updating unit for multiplying one random number permutation matrix and adding the first random number binary vector to the multiplication result to update the one-time registration template.

Specific details of other embodiments are included in the detailed description and the drawings.

Biometric authentication method, client and server according to the present invention, even if the one-time authentication template generated for user authentication is leaked during network transmission can not infer the information about the original template from the leaked one-time authentication template to secure the original template It is effective.

In addition, the present invention has the effect of enabling user authentication through direct template comparison in the converted state without decrypting the converted template, unlike the conventional protection method using a conventional encryption method. In particular, the present invention maintains the sameity as the comparison using the template before conversion even if the converted template is used, so that the recognition rate does not decrease even if the present invention is applied to the existing bio recognition methodology and system.

In addition, since the present invention generates a new one-time authentication template and one-time registration template every time user authentication, the method of preventing hacking to prevent user authentication by intercepting and storing / reusing a template transmitted through a network or the like. It works.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but can be implemented in various different forms, and only the embodiments make the disclosure of the present invention complete, and the general knowledge in the art to which the present invention belongs. It is provided to fully inform the person having the scope of the invention, which is defined only by the scope of the claims. Like reference numerals refer to like elements throughout. “And / or” includes each and all combinations of one or more of the items mentioned.

1 to 3, a biometric authentication method and a client and server for performing the biometric authentication method according to an embodiment of the present invention will be described.

First, a process in which a user registers a one-time registration template with an authentication server to perform a biometric authentication method according to an embodiment of the present invention will be described with reference to FIG. 1. 1 is a block diagram illustrating a biometric authentication method, a client and a server for performing a biometric authentication method according to an embodiment of the present invention.

Referring to FIG. 1, the client 100 includes an extractor 110 and an authentication template generator 120.

The extraction unit 110 generates the original template x from the biometric information provided from the user. This original template may be a bit stream of binary numbers.

The authentication template generating unit 120 generates the first one-time registration template g when registering the original template x using the first random number permutation matrix A and the first random number binary vector b. Here, the first random number permutation matrix A is an m × n matrix, in which only one element in a column and a row is 1, and the remaining elements are 0, and a matrix in which an element of 1 may be randomly determined. For example, when the first random number permutation matrix is a 3 × 3 matrix, it may be the same as Equation 1.

In addition, the first random binary vector b refers to a vector having a value of 0 or 1 randomly. For example, when the first random binary vector is 3 × 1, it may be the same as Equation 2.

Can be.

In addition, the first random number permutation matrix may have characteristics as shown in Equation 3 below.

A ^T A = AA ^T = I

On the other hand, if the original template for registration generated from the user's biometric information x, the authentication template generator 120 uses the first random number permutation matrix and the first random number binary vector, one-time through the following equation (4) You can create a registration template.

Here, addition refers to modulo 2 addition. For example, 1 + 1 = 0.

After the one-time registration template g is generated, the original template x is discarded. The one-time registration template g is transmitted to the authentication server 200 and stored in the authentication server 200, and the first random number permutation matrix A and the first random number binary vector b are the storage medium 300 of the user, for example, a smart card. It is stored in the back and provided to the user.

Meanwhile, the method of generating the first random number permutation matrix A and the first random number binary vector b, the first random number permutation matrix A and the first random number binary vector b, respectively, are the first client random number generator 131 and the second. It may be generated from the client random number generator 132. And, it may be generated from a third client random number generator (not shown). That is, the first random number permutation matrix A and the first random number binary vector b may be randomly generated independently of the one-time conversion key K, respectively. The generated one-time conversion key K may be stored in the authentication server 200 and the storage medium 300 of the user, respectively. Although the first client random number generator 131 and the second client random number generator 132 exist inside the client 100 as an example, the present invention may not be present. In addition, unlike FIG. 1, the first random number permutation matrix A and the first random number binary vector b may be configured by using a random number generated from a random number generator (not shown), more specifically, a binary random number. The method of generating the first random number permutation matrix A and the first random number binary vector b may be variously implemented.

In summary, the one-time registration template g is generated from the user's biometric information, the one-time registration template g and the one-time conversion key K are stored in the authentication server 200, and the first random number permutation matrix A and the first random number binary vector b are described. And the one-time conversion key K are stored in the storage medium 30 of the user. That is, the first random number permutation matrix A, the first random number binary vector b, and the one-time conversion key K are stored by the user.

In this case, it is impossible to deduce the original template x from the one-time registration template g without the third party knowing the first random number permutation matrix A and the first random number binary vector b. Therefore, even if a hack is made on the authentication system or the authentication server 200 side, since the original template x is not leaked, security may be improved.

Next, a biometric authentication method according to an embodiment of the present invention is described as an example of a case where a user requests authentication for the first time after registration.

The user provides his or her biometric information, random number permutation matrix A, and random number binary vector b to the client or terminal to obtain confirmation of his identity, that is, to request authentication. The client or terminal then generates an original template y for authentication according to the existing biometric recognition method from the biometric information provided from the user. The template p is generated from the original template y, the random number permutation matrix A, and the random binary vector b as shown in Equation 5. At this time, the client or the terminal may discard the original template y.

The client or terminal transmits the one-time authentication template p to the authentication system or the authentication server instead of the original template y, and the authentication system or the authentication server compares the received one-time authentication template p with the one-time registration template g already stored, If it is less than the threshold, the decision is made either by genuine or by impostor. It should be noted that the authentication system or the authentication server performs authentication using the one-time authentication template and the one-time registration template without the original templates x and y and A and b. As shown in Equation 6, it can be seen that the comparison value between the one-time registration template g and the one-time authentication template p, that is, the hamming distance value, is equal to the comparison value between x and y. That is, even if the original template is converted in accordance with the present invention to protect the original biometric template of the user, it can be seen that for the legitimate user, the same comparison value is maintained as before the conversion. Therefore, even when the conversion templates g and p are used to protect the original template, it can be seen that the same user authentication as the existing biometric recognition system is possible without exposing the user's original biometric information.

Suppose that a one-time authentication template p is generated using wrong A 'and b' rather than A and b used to generate one-time registration template g. At this time, the equality relation of Equation 6 does not hold, and it is easy to see that the mismatch between A and A 'and b and b' will result in a larger hamming distance of g and p than that of the original template x and y. Can be. In other words, to be authenticated as a legitimate user, the correct A and b must be provided along with the user biometric information. Even if A and b are leaked, the attacker who has obtained it still needs to provide a valid biometric template in order to authenticate as a legitimate user from the authentication system or authentication server. Therefore, when the method proposed in the present invention is applied to the existing biometric recognition system, the false acceptance rate of an invalid user can be lowered without affecting the false rejection rate of a legitimate user.

Next, referring to FIG. 2, the biometric authentication method according to an embodiment of the present invention will be described in more detail by taking a case where a user requests a t-th authentication as an example. FIG. 2 is a block diagram illustrating a biometric authentication method for a case where a user requests a t-th authentication, and a client and a server performing the biometric authentication method. For convenience of explanation, hereinafter, the first random number permutation matrix and the first random number binary vector are referred to as one-time conversion information.

The client 100 may include an extractor 110, an authentication template generator 120, and a client updater 130. The authentication server 200 may include a comparator 220 and a storage 210. And a server updater 230.

In the t-th authentication, the authentication server 200 stores the one-time registration template g _t and the one-time conversion key K _t which is the password, and the user has one-time conversion information A _t , b _t and the one-time conversion key K _t . lets do it. A _t , b _t and K _t may be stored in a personal storage device such as a smart card as user personal secret information.

At the t-th authentication, the extraction unit 110 of the client 100 extracts biometric information from the user to generate an original template y of the bitstream. The authentication template generating unit 120 generates a t-th one-time authentication template p _t as in Equation 7 by using the original template, its own biometric information and A _t , b _t provided from the user. The client 100 then discards the original template y.

p _t = A _t y + b _t

That is, the authentication template generating unit 120 multiplies the original template y by A _t in order to change the order of each bit constituting the bitstream original template y. Then, b is added to the result of the multiplication in order to change at least some bits in the bitstream of the result of the multiplication into complementary bits.

(a_i는 0 또는 1)일 때, 원본 템플릿 y에 수학식 1의 제1 난수 순열 행렬을 곱한 결과는

일 수 있다. 즉, 첫번째 비트 a₂ 와 두번째 비트 a₁ 의 순서가 변경된다. 그리고, 곱한 결과

에 수학식 2의 b를 모듈로2 덧셈(modulo 2 addition)을 통해 더하면, 일회성 인증 템플릿 p_t는

이 될 수 있다. 즉, 두번째 비트 a₂가 상보 비트

으로 변경된다. 이와 같이 생성된 일회성 인증 템플릿은 p_t 인증 서버(200)로 전송된다.More specifically, the original template y

When (a _i is 0 or 1), the result of multiplying the original template y by the first random permutation matrix of Equation 1 is

Can be. That is, the order of the first bit a ₂ and the second bit a ₁ is changed. And multiply

By adding b in equation 2 through modulo 2 addition, the one-time authentication template p _t is

This can be That is, the second bit a ₂ is the complementary bit

Is changed to The one-time authentication template generated as described above is transmitted to the p _t authentication server 200.

Comparator 220 of the authentication server 200 by receiving and p _t compared to the previously stored g _t in the storage unit 210 and performs user authentication. For example, the comparison unit 220 compares the received one-time authentication template p _t with the one-time registration template g _t already stored, and if it is smaller than a preset threshold, it is a genuine or an impostor. Make a decision

Meanwhile, even if the original template y is converted into one-time authentication template p _t and transmitted, the one-time authentication template p _t leaked in the middle of transmission may be used for a replay attack. To prevent this, the biometrics authentication method according to an embodiment of the present invention, a one-time authentication template for a different value each time at every authentication p _t, and one-time registration template g _t using, and a successful authentication is a one-time registration template g _t after To this Update the. That is, if the t-th authentication is successful, the authentication server 200 updates the one-time registration template g _t , and the client 100 updates the one-time conversion information A _t and b _t .

More specifically with reference to FIG. 3. 3 is a block diagram illustrating an update process of a biometric authentication method according to the present invention.

Referring to FIG. 3 further, the server updater 230 of the authentication server 200 includes a first server random number generator 231, a second server random number generator 232, and a first server calculator 233.

The first server random number generator 231 and the second server random number generator 232 use the new random number permutation matrix A ' _t and the new random number binary vector b' _t using the one-time conversion key K _{t previously} stored in the storage 210. Create each of them. That is, the first server random number generator 231 and the second server random number generator 232 use the one-time conversion key K _t as a state number (seed number) and a random number permutation matrix A ' _t and a random binary vector b'. Create _t respectively.

The first server operator 233 updates the t th one-time registration template g _t by using the random number permutation matrix A ' _t and the random number binary vector b' _t . That is, the update to the first one-time t g _t registered template, as shown in equation 8 t + 1 th one-time registration template g _{t + 1.}

g _{t +1} = A ' _t g _t + b' _t

The updated one-time registration template g _{t +1} is stored in the storage unit 210 and the previous registration template g _t is discarded. As such, each time a user is successfully authenticated, a new one-time registration template is stored, so that a retransmission attack can be effectively coped with.

The client 100 includes a first client random number generator 131, a second client random number generator 132, a first client calculator 133, and a second client calculator 134.

The first client random number generator 131 and the second client random number generator 132 use the one-time conversion key K _t provided from the user's storage medium 300 to generate a second random number permutation matrix A ' _t second random number binary vector b. 'create _t That is, the first client random number generator 131 and the second client random number generator 132 use the one-time conversion key K _t as a state number and a seed number, so that the random number permutation matrix A ' _t and the random number binary vector b are used. 'Generate _t each.

The first client operator 133 and the second client operator 134 may convert the first random number permutation matrix A _t , the first random number binary vector b _t , the second random number permutation matrix A ′ _t , as shown in Equation 9 below. The second random number binary vector b ' _t is used to update the new one-time conversion information A _{t + 1} and b _{t + 1} .

A _{t +1} = A ' _t A _t

b _{t +1} = A ' _t b _t + b' _t

Addition here refers to modulo 2 addition, as described above. For example, 1 + 1 = 0.

Since the product of the two permutation matrices is again a permutation matrix, the updated A _{t +1} and b _{t +1} become the random number permutation matrix and the random binary vector, respectively. In detail, for example, when the first random permutation matrix A ' _t and the second random permutation matrix A _t are the same as Equations 10 and 11,

According to equation (9), the updated A _{t +1} also becomes a permutation matrix as shown in equation (12).

Further, when the first random binary vector b _t and the second random binary vector b ' _t are equal to Equation 13 and Equation 14,

By equation (9), the updated b _{t +1 is} also a binary vector as in equation (15).

Thus, even after the update, A _{t + 1} becomes a random permutation matrix and b _{t + 1} becomes a random binary vector. In addition, it can be easily seen that the conversion method used for updating the one-time registration template in Equation 8 is equally accumulated in Equation 9. That is, since the conversion method for updating the one-time registration template and the conversion method for generating the one-time authentication template are consistent, it can be seen that Equation 6 is established at each authentication as well as the initial authentication after user registration. .

Here, the second random permutation matrix A ' _t and the second random binary vector b' _t are generated through the one-time conversion key K _t . That is, the client 100 and the authentication server 200 independently use the same one-time conversion key K _t as a state number and a seed number, respectively, so that the second random number permutation matrix A ' _t and the second random number binary vector b are used. ' _t can be generated.

The server updating unit 230 of the authentication server 200 updates the one-time conversion key K _t to K _{t +1} .

More specifically, referring to FIG. 3, the server updater 230 includes a second server operator 234 and a random key generator 240.

If the authentication is successful, the random key generation unit 240 generates a random key R _t and provides it to the second server operation unit 234.

The second server operator 234 updates the one-time conversion key K _t using the random key R _t . For example, the second server operator 234 may update the one-time conversion key K _t to K _{t +1} through Equation 16 below.

K_{t +1} =H(K_tR_t)

K _{t +1} = H (K _t R _t )

는 배타적 논리합(exclusive or)을 나타낸다. 갱신된 K_{t +1}은 저장부(210)에 저장하고, K_t를 폐기한다. 해시함수를 이용하여 K_t를 갱신하기 때문에 K_{t +1}로부터 K_t을 역으로 유추하는 것은 계산상으로 불가능하다.Where H () represents a hash function,

Denotes an exclusive OR. The updated K _{t +1} is stored in the storage 210 and discards K _t . Since updating the K _t by using the hash function is to derive the K _t K _{t +1} is not possible to reverse from the computationally.

On the other hand, the client 100 can also update the one-time conversion key K _t to K _{t +1} when authentication is successful.

More specifically with reference to FIG. 3, the client updater 130 includes a third client calculator 135. For example, the third client calculator 135 may update the one-time conversion key K _t to K _{t +1} through Equation 16 using the random key R _t . The updated K _{t +1} is stored in the storage medium 300 of the user. In this case, the random key R _t may be transmitted from the authentication server 200.

When the random key R _t is transmitted from the authentication server 200, only the random key R _t may be transmitted. However, since the random key R _t may be changed or manipulated by a third party to be invalid during transmission, the random key R _t may be invalid. It is necessary to check whether the random key R _t is valid. That is, to check whether the random key R _t transmitted from the authentication server 200 is valid, the authentication server 200 may further transmit the check key to the client 100.

To this end, the authentication server 200 may further include a server check key generator 250, as shown in FIG. 3, and the client 100 may include a client check key generator 150 and a checker 140. ) May be further included.

The server check key generator 250 receives a random key from the random key generator 240 and generates a check key. The check key can be generated through H (K _t || R _t ). Where || represents the concatenation.

The client check key generation unit 150 receives the random key R _t and generates H (K _t || R _t ). The checker 140 compares the check key H (K _t || R _t ) provided from the client check key generator 150 with the check key H (K _t || R _t ) provided from the authentication server 200. It is checked whether the random key R _t transmitted from the server 200 is valid. When the random key R _t transmitted from the authentication server 200 is valid, the checker 140 transmits the random key R _t transmitted from the authentication server 200 to the third client calculator 135. If it is not valid, the client 100 may request retransmission of the random key R _t to the authentication server 200.

Even if the random key R _t and the check key H (K _t || R _t ) are leaked during the transmission process, the original template y using the leaked random key R _t and the check key H (K _t || R _t ) and p _t , It is not possible to deduce the previous one-time authentication template p _{t -1} and the next one-time authentication template p _{t + 1} . Therefore, even if R _t , H (K _t || R _t ) and p _t are leaked during network transmission, the user cannot be authenticated using this information.

Table 1 below shows an example of a communication protocol between the client 100 and the server 200.

R_t)로 갱신한다.
3. 사용자는 H(Kt||Rt)를 이용하여 R_t의 유효성을 검사한 후, K_t를 이용하여 A_t와 b_t를 갱신하고, K_t를 K_{t +1} =H(K_t

R_t)로 갱신한다.1. The user sends the one-time authentication template p _t to the authentication server 200.
2. The authentication server 200 performs user authentication using g _t and p _t . If it is determined as the identity, the server 200 transmits R _t and H (K _t || R _t ) to the user. Then, g _t is updated using K _t , and K _t is K _{t +1} = H (K _t

R _t ).
3. The user H (Kt || Rt) and then check the validity of R _t, by using a K _t update the A _t and b _t, and _t K using K _{t +1} = H (K _t

R _t ).

In the above, the case of using both the first random number permutation matrix and the first random number binary vector in the process of generating the one-time authentication template from the original template has been described as an example, but the present invention is not limited thereto. Only one of the random binary vectors may be used to generate a one-time authentication template. That is, the one-time authentication template may be generated by changing the order of bits from the original template y of the bit stream, or the one-time authentication template may be generated by changing at least some bits from the original template y of the bit stream to complementary bits. When generating a one-time authentication template using only one of the first random number permutation matrix and the first random number binary vector, the client updater 130 may select only one of the first random number permutation matrix and the first random number binary vector. The server updater 230 updates the one-time registration template using only one of the first random number permutation matrix and the first random number binary vector.

In the above, specific preferred embodiments of the present invention have been illustrated and described. However, the present invention is not limited to the above-described embodiments, and various modifications can be made by those skilled in the art without departing from the gist of the present invention. For example, the present invention may be implemented in a system to which the method of the present invention is applied, or may be implemented in an apparatus for performing the method of the present invention or a system including the apparatus, and a program for realizing the method of the present invention may be implemented. It can be easily understood by those of ordinary skill in the art that the recording medium may be implemented in various forms such as a recorded recording medium.

1 is a block diagram illustrating a biometric authentication method, a client and a server for performing a biometric authentication method according to an embodiment of the present invention.

FIG. 2 is a block diagram illustrating a biometric authentication method for a case where a user requests a t-th authentication, and a client and a server performing the biometric authentication method.

3 is a block diagram illustrating an update process of a biometric authentication method according to the present invention.

<Explanation of symbols for the main parts of the drawings>

100: Client 110: Authentication Server

110: extraction unit 120: authentication template generation unit

130: client update unit 200: authentication server

210: storage unit 220: comparison unit

230: server update unit

Claims (19)

Generating an original template from the biometric information, and using the one-time conversion information including at least one of a first random permutation matrix and a first random binary vector from the original template, the first one-time authentication Creating a template and requesting authentication; Comparing the first one-time authentication template with the one-time registration template; And Updating the one-time registration template and the one-time conversion information if authenticated according to the comparison result, The updated one-time conversion information is used to generate a second one-time authentication template to be authenticated as a result of comparison with the updated one-time registration template at the next authentication request, Generating the first one-time authentication template Multiplying the original template by the first random number permutation matrix; Modulo 2 addition the first random binary vector to the original template; And Multiplying the original template by the first random number permutation matrix, and modulo 2 addition of the first random number binary vector to the multiplication result Comprising any one of steps Biometric authentication method. The method of claim 1, And the original template is a bitstream. delete delete delete The method of claim 1, Updating the one-time registration template and the one-time conversion information And updating using the same one-time conversion key. The method of claim 6 Updating the one-time registration template and the one-time conversion information Generating a second random number permutation matrix and a second random number binary vector using the one-time conversion key; And updating the one-time registration template and the one-time conversion information, respectively, using the second permutation matrix and the second random number vector. The method of claim 7, wherein Updating the one-time conversion information And converting the first random number permutation matrix and the first random number binary vector according to Equation 1 below. [Equation 1] A _{t +1} = A ' _t A _t b _{t +1} = A ' _t b _t + b' _t Where A _{t +1} is the updated first random permutation matrix, A ' _t is the second random permutation matrix, A _t is the first random permutation matrix before updating, b _{t +1} is the updated first random binary vector, b ' _t is 2 random binary vectors, and b _t is the first random binary vector before update) The method of claim 7, wherein Updating the one-time registration template Multiplying the one-time registration template by the second random number permutation matrix and adding the random number binary vector to the multiplication result. In the biometric authentication method between user, client and server, Generating an original template of a bitstream from the biometric information of the user, and converting the original template into a one-time authentication template using one-time conversion information provided from the user; Comparing the one-time authentication template with the one-time registration template previously stored in the server, and authenticating according to the comparison result; Update the one-time registration template using the first one-time conversion key previously stored in the server, update the first one-time conversion key, and update the updated one-time registration template and the updated first one-time conversion key to the server. Storing; And And updating the one-time conversion information by using a second one-time conversion key identical to the first one-time conversion key, and updating the second one-time conversion key to be identical to the updated first one-time conversion key. Converting to the one-time authentication template includes changing the bit order of the bitstream. The method of claim 10, The converting into the first one-time authentication template further comprises converting at least some bits of the bitstream into complementary bits. The method of claim 11, Updating the first one-time conversion key and updating the second one-time conversion key are respectively Biometric authentication method using a random key to convert through the following equation 2. [Equation 2] K _{t + 1} = H (K _t

R _t ) (Where, K _{t + 1} 'is an updated first one-time conversion key or an updated second one-time conversion key, K _t is a first one-time conversion key before update or a second one-time conversion key before update, R _t is a random key, H () is a hash function,

Is an exclusive OR) The method of claim 12, The server generating the random key; Providing the random key to the client; Providing a check key for checking whether the random key is valid; And checking whether the random key is valid using the check key and the random key. The method of claim 13, The check key is a biometric authentication method generated through H (K _t || R _t ). (Where || is a concatenation) In a client that requests authentication to a server, Generating an original template from the user's biometric information, multiplying the original template by a first random permutation matrix, and adding the first random binary vector to the multiplication result to generate a one-time authentication template. An authentication template generator; And When the one-time authentication template is authenticated as a result of comparing with the one-time registration template previously stored in the server, a second random number permutation matrix and a second random number binary vector are generated using the one-time conversion key provided from the user, and the second random number permutation is generated. And an updater to update the first random number permutation matrix and the first random number binary vector using a matrix and the second random number binary vector, and to update the one-time conversion key using a random key provided from the server. delete The method of claim 15, And a checker configured to receive a check key from the server and check validity of a random key provided from the server using the check key. A server that authenticates at the request of a client, Storage unit; A comparison unit comparing the one-time registration template previously stored in the storage unit with a one-time authentication template generated by the client from biometric information; And When the comparison result is authenticated, a first random number permutation matrix and a first random binary vector are generated by using the one-time conversion key previously stored in the storage unit, and the one-time registration template includes the first random number. And an updater to multiply a first random number permutation matrix, add the first random number binary vector to the result of the multiplication, and update the one-time registration template, and update the one-time conversion key using a random key. The method of claim 18, And a check key generation unit generating a check key for checking the random key and validity of the random key, and providing the random key and the check key to the client.

Images