KR101792220B1 - Method, mobile terminal, device and program for providing user authentication service of combining biometric authentication - Google Patents

Abstract

The present invention provides a biometric authentication combined simple user authentication method and an authentication application and an authentication service apparatus therefor, in which authentication information like a password required for user authentication when an authorized certificate of a user or a user account of an online service is used is divided into a device token and a server token; the tokens are matched with the biometric authentication, and divided and stored at a user mobile terminal and an online service apparatus; and, when a corresponding authorized certificate or the online service is used, user biometric authentication is performed and the server token is received from the online service apparatus according to the biometric authentication result to recover the authentication information through combination with the device token and perform an authentication procedure like automatic password input, thereby increasing user convenience and at the same time strengthening security reliability.

Description

Technical Field [0001] The present invention relates to a biometric authentication combined user authentication method, a user mobile terminal equipped with an authentication application for the same, an authentication service device, and a computer program,

The present invention relates to a biometric authentication combined user authentication method, an authentication application, an authentication service device, and a computer program. More particularly, the present invention relates to a biometric authentication combined user authentication method, And stores the generated authentication information as a device token and a server token separately from the user mobile terminal and the on-line service device according to a result of the user biometric authentication. When a password is requested according to the authorized certificate or the online service, The server token is received from the on-line service device according to the biometric authentication result obtained by performing the biometric authentication, and authentication is performed by recovering the authentication information by combining with the device token and automatically inputting the password. He will at the same time on the authentication scheme that also reinforces security reliability.

With the development of ICT technology, the use of the Internet has increased dramatically from work to everyday life, and everyday life as well as business has been difficult without the online service using the Internet.

As the online service has expanded into a wide range of fields, authentication of the user has become a very important issue. Especially, in case of online service which causes mental or economic damage to the user when the personal information is leaked, Authentication is being performed.

For example, when an online financial service is used, a digital signature of a user certificate is required for a financial statement. In order to use the authorized certificate, an authentication method in which a password set by the user is input in response to the authorized certificate is performed.

Further, even in the case of online services that require protection of personal information in addition to the field of online financial services, user authentication is performed by receiving a password corresponding to a user account.

However, the password input authentication method may cause a large damage when a password is leaked, and it is troublesome that the user has to input a password every time, and since different passwords are set for various online services, the user can not remember the password .

In order to solve the inconvenience of the password input authentication technique and the problem of security vulnerability, authentication methods using biometrics are spreading. In the online environment, the FIDO Alliance is used to open the open technology standard for the authentication method using the biometric technology. .

FIDO proposes a new standard for a new authentication system that allows authentication to be processed through simple procedures that can not be replaced by fingerprint recognition, iris recognition, face recognition, etc. instead of ID and password. For example, the UAF authentication method uses a password The authentication is implemented in a form of being included in the terminal device so that the terminal recognizes the user's own biometric information such as a fingerprint and performs authentication in comparison with the previously registered authentication information.

However, since most of the online systems requiring user authentication are constructed as a password input authentication method, in order to change the user authentication policy of the online system to the biometric authentication method, it is necessary to change the overall system security policy, It will take a long time to get the individual to use the corresponding security policy. Therefore, there is a need for an authentication technique that can more effectively replace the password input authentication method with the biometric authentication method during such a transitional period.

In addition, various authentication techniques for replacing the password of the authorized certificate with the biometric authentication have been proposed. However, such authentication techniques are not suitable for storing the entire password in the user mobile terminal or other storage, The security itself may be leaked in the case of being hacked, and the security may be made more vulnerable than when the user directly inputs the password.

Patent Registration No. 10-1482321

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problems of the prior art, and it is an object of the present invention to solve the problem that a large amount of damage may be caused when a password is leaked in a password input authentication method, And by setting different passwords for various online services, users want to solve the problem of not remembering passwords.

Especially, since most of the on-line systems that have been built up to now apply user authentication as a password input authentication method, it is necessary to solve the problem that it takes a long time to induce user's use and enormous cost to change the user authentication policy of the online system .

Further, in the case of authentication technologies for replacing the password of the authorized certificate with the biometric authentication, the password itself is stored entirely in the user's mobile terminal or other storage, so that if the user's mobile terminal is lost or the password-stored storage is hacked, We want to solve the problem of security vulnerability that can be leaked.

According to an aspect of the present invention, there is provided a biometric authentication combined user authentication method, wherein an authentication application installed in a user mobile terminal divides authentication information including a password for user authentication into a plurality of fragments , A server token including a device token including one or more fragments and a remaining fragment is generated, the server token is registered in the authentication service device according to the biometric authentication result for the user, and the device token is stored in the user mobile terminal An authentication service registration step; And the authentication application transmits the biometric authentication result of the user according to the authentication request for the user to the authentication service apparatus, receives the server token from the authentication service apparatus according to the biometric authentication result, And an authentication service providing step of combining pieces included in the device token to recover the authentication information and providing a password included in the authentication information for authentication to the user.

Preferably, the authentication service registration step includes: an authentication information encryption step of generating an encryption key corresponding to the authentication information and encrypting the authentication information; A token generation step of dividing the encrypted authentication information and the encryption key into a plurality of fragments, generating a device token with a combination of fragments selected from the authentication information fragments and the encryption key fragments, and generating a server token with a combination of remaining fragments; And a token storage step of registering the server token in the authentication service device according to the biometric authentication result for the user and storing the device token in the user mobile terminal.

Preferably, the authentication service providing step may include transmitting a biometric authentication result for the user performed according to an authentication request for the user to the authentication service apparatus, and transmitting the biometric authentication result to the authentication service apparatus according to the verification result of the biometric authentication result A token extracting step of receiving the server token and extracting the device token; An authentication information recovery step of recovering the encrypted authentication information and the encryption key by combining the server token and an authentication information fragment included in the device token and an encryption key fragment; A password extracting step of decrypting the authentication information encrypted with the encryption key and extracting a password included in the authentication information; And a password providing step of providing the password for authentication to the user.

Further, the storing of the token may include transmitting a server token signed with a biometric authentication key previously held in accordance with the biometric authentication result for the user to the authentication service apparatus; Receiving a registration result of the server token according to a verification result of the server token signed by the authentication service device; And storing the device token in the user mobile terminal according to the registration result.

The step of extracting the token may further include: generating a biometric authentication result for the user performed according to an authentication request for the user; Requesting the server token while transmitting the biometric authentication result to the authentication service device; Receiving the server token according to the verification result of the biometric authentication result from the authentication service device; And extracting the device token according to the verification result.

Further, the authentication service registration step may include generating a device token and a server token for each authentication information corresponding to each of a plurality of passwords, registering each of the plurality of server tokens in the authentication service apparatus, It can be stored in the terminal.

The authentication service registration step further includes a step of registering, in the authentication service registration step, any one of the plurality of biometric authentication methods for the device token corresponding to each of the plurality of pieces of authentication information and the token pair of the server token, And registering each of the server tokens in the authentication service device based on a result of the biometric authentication, wherein the authentication service providing step includes a step of, based on the biometric authentication result obtained by performing the biometric authentication on the user using the biometric authentication method set corresponding to the pair of tokens The server token can be received from the authentication service device.

Another embodiment of the biometric authentication combined user authentication method according to the present invention is characterized in that the authentication service apparatus includes one or more fragments obtained by dividing authentication information including a password for user authentication from an authentication application installed in the user mobile terminal An authentication service registration step of receiving a server token corresponding to the biometric authentication result for the user and registering the server token according to the verification of the biometric authentication result; And the authentication service apparatus receives a transmission request of the server token together with the biometrics authentication result of the user according to an authentication request for the user from the authentication application, and transmits the server token in accordance with the verification of the biometrics authentication result And transmitting the extracted authentication service to the authentication application.

Preferably, the authentication service registration step divides the authentication information and the cryptographic key, which are encrypted with the cryptographic key corresponding to the authentication information, from the authentication application into a plurality of fragments, A token receiving step of receiving a server token generated as a combination corresponding to a biometric authentication result for the user; And a registration result transmission step of performing verification of the biometric authentication result, registering the server token according to the verification result, and transmitting the registration result to the authentication application.

Further, the providing of the authentication service may include: receiving a request for transmitting the server token together with a biometric authentication result for the user performed according to an authentication request for the user from the authentication application; A token extracting step of verifying the biometric authentication result and extracting the server token according to a verification result; And a token transfer step of transferring the server token to the authentication application.

More preferably, the token receiving step receives the server token signed with the biometric authentication key corresponding to the biometric authentication of the user from the authentication application, and the registration result transmitting step transmits the signature of the server token It can be verified with biometric authentication key.

Further, in the authentication service registration step, each of the server tokens generated for each authentication information corresponding to each of the plurality of passwords is received from the authentication application and each of the plurality of server tokens is registered.

In addition, the authentication application according to the present invention includes a device token and a server token, which are installed in a user mobile terminal and divide authentication information including a password for user authentication to generate a device token and a server token, The server token is stored in the device token, the server token is received from the authentication service device based on the biometric authentication result of the user according to the authentication request for the user, And an authentication combination application that combines fragments included in the device token to recover the authentication information and to provide the password included in the authentication information for authentication to the user.

As an example, the authentication information including the password for the authorized certificate is received from the authorized authentication application installed in the user mobile terminal and supporting the management of the user's authorized certificate and digital signature, and the server token and the device token And recover the authentication information based on the server token and the device token according to the authentication request for the user to provide a password for the authorized certificate to the authorized authentication application.

As another example, a biometric authentication application installed in the user mobile terminal for performing biometric authentication for a user may request the signature of the server token through the biometric authentication of the user, receive the signed server token, The biometric authentication result of the user according to the authentication request for the biometric authentication application can be received from the biometric authentication application.

Further, the authentication combining application may include a biometric authentication support unit for performing a biometric authentication of a user, signing the server token, and performing a biometric authentication of the user according to an authentication request for the user to generate a biometric authentication result have.

The authentication combination application further includes management and digital signature support of a user's authorized certificate, extracting and providing authentication information including a password for the authorized certificate, and providing the authorized certificate And a public authentication support unit for receiving the password for the public key certificate and providing the digital signature of the public key certificate.

The authentication service apparatus according to the present invention may further include a server token including one or more fragments obtained by dividing authentication information including a password for user authentication from an authentication application installed in the user mobile terminal to a biometric authentication result for the user An authentication support unit for registering the server token and receiving the server token transmission request together with the biometric authentication result of the user according to the authentication request for the user from the authentication application and providing the server token; A biometric authentication unit which holds a biometric authentication key corresponding to biometric authentication for the user and receives and verifies the biometric authentication result of the user from the authentication support unit and provides a verification result; And a server token storage unit for storing the server token according to the registration decision of the authentication support unit.

The present invention also includes a computer program stored in a user terminal for executing each step of the biometric authentication combined user authentication method.

The present invention also includes a computer program stored in an authentication service apparatus for executing each step of the biometric authentication combined user authentication method.

According to the present invention, since the biometric authentication method is combined with the password input authentication method, the user can perform the user authentication process through the biometric authentication without inputting the password, so that the hassle of the user having to input the password is eliminated In addition, when setting different passwords for various online services, the user does not have to remember the passwords individually.

In addition, most online systems that have been built up to now apply biometric authentication technology without changing the online system in a situation where user authentication is applied as a password input authentication method.

Particularly, authentication information such as a password, which may cause serious damage in the case of external leakage, is divided into a device token and a server token, and the authentication information is stored in the authentication service device and the user mobile terminal in association with the biometric authentication. Even if a user is lost or hacked, only a part of the password is leaked, and the entire password can not be confirmed, thereby enhancing the security reliability.

Furthermore, not only the encrypted password but also the encryption key capable of decrypting the encrypted password can be divided into several pieces and stored, thereby further enhancing the security.

1 shows a block diagram of an embodiment of an authentication service system according to the present invention,
Figure 2 shows a block diagram of an embodiment of a user mobile terminal to which the present invention is applied,
Figure 3 shows a block diagram of an embodiment of an authentication application according to the present invention,
4 shows a configuration diagram of a modification of the authentication application according to the present invention,
5 shows a configuration diagram of an embodiment of an authentication service apparatus according to the present invention,
6 is a conceptual diagram of an authentication service registration process in a biometric authentication combined user authentication method according to the present invention,
7 is a conceptual diagram of a process of providing an authentication service in a biometric authentication combined user authentication method according to the present invention,
8 is a flowchart illustrating an authentication service registration process in the biometric authentication combined user authentication method according to the present invention,
9 is a flowchart of an embodiment of an authentication service providing process in a biometric authentication combined user authentication method according to the present invention,
FIG. 10 illustrates an example of providing authentication services for a plurality of authorized certificate passwords and online service account passwords in a biometric authentication combined user authentication method according to the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other objects, features and advantages of the present invention will become more apparent from the following detailed description of the present invention when taken in conjunction with the accompanying drawings.

First, the terminology used in the present application is used only to describe a specific embodiment, and is not intended to limit the present invention, and the singular expressions may include plural expressions unless the context clearly indicates otherwise. Also, in this application, the terms "comprise", "having", and the like are intended to specify that there are stated features, integers, steps, operations, elements, parts or combinations thereof, But do not preclude the presence or addition of features, numbers, steps, operations, components, parts, or combinations thereof.

In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

The present invention proposes a biometric authentication combined user authentication method capable of automatically performing a password authentication when a biometric authentication success of a user by matching a password of an authorized certificate or an online service account with a biometric authentication of a user.

Particularly, in the present invention, the convenience of the user authentication process is improved by replacing the password input process required for performing digital signature using the user's authorized certificate with biometric authentication. At this time, passwords The authentication information of the user is divided into a plurality of fragments, and a part of the authentication information is stored in a separate authentication service apparatus according to the result of the user biometric authentication, and when the digital signature of the user's authorized certificate is requested, And a method for enhancing security reliability by automatically performing user authentication by restoring authentication information such as a password by collecting and combining distributed pieces in accordance with the verification of the authentication service device with respect to the result.

1 shows a block diagram of an embodiment of an authentication service system according to the present invention.

The authentication service system according to the present invention includes a user mobile terminal 100 that is roughly provided with various online services, an authentication service device 200 that provides the biometric authentication combined user authentication service to the user mobile terminal 100, And an online service server 300 for providing the online service to the user mobile terminal 100 through the Internet.

The user mobile terminal 100 can be applied to a variety of portable wireless communication terminals such as a smart phone, a tablet, and a PDA, which are in general use. The user mobile terminal 100 can be connected to the authentication service apparatus 200 through a wireless communication network And can receive the online service from the online service server 300 according to the user authentication.

When the authentication application according to the present invention is installed in the user mobile terminal 100 and the password input is requested according to the user authentication request, the authentication application automatically inputs the corresponding password based on the biometric authentication result for the user and performs authentication . To this end, the authentication application according to the present invention divides authentication information such as a password into a plurality of fragments in advance and generates a server token and a device token. Then, the device token is transmitted to the user mobile terminal 100 according to the biometric authentication result of the user. And registers the server token in the authentication service apparatus 200. When the authentication of the user is requested to use the online service, the authentication application retrieves and combines the server token and the device token separated and stored according to the biometric authentication result of the biometric authentication of the user, and obtains authentication information such as a password Recovery.

The authentication service apparatus 200 operates in cooperation with an authentication application installed in the user mobile terminal 100 to verify and register the biometric authentication result of the user with the server token for the authentication information such as the password, 100 and transmits the registered server token to the authentication application of the user mobile terminal 100 according to the verification result of the received biometric authentication result. Of course, in order for the authentication service apparatus 200 to verify the biometrics authentication result with respect to the user, registration of the biometrics authentication for the user is required in advance in cooperation with the authentication application of the user mobile terminal 100. [ Here, various authentication techniques of the existing biometric authentication method may be applied to the biometric authentication registration for the user. For example, a UAF (Universal Authentification Framework) authentication method according to the FIDO standard may be applied.

The online service server 300 provides various online services to the user mobile terminal 100 through a password input authentication method. For example, in the case of a banking server, various online financial services are provided to a corresponding user mobile terminal 100 based on an electronic signature such as a user authentication certificate. In the case of a mail server or the like, on the basis of authentication information such as a user's ID and a password, Provide mail service. As described above, in the present invention, the online service server 300 can be applied to various on-line service devices in various fields for providing an online service requiring authentication for a user as a password input authentication method.

Although not shown in FIG. 1, an authentication authority server may be additionally configured according to a security policy to which the present invention is applied. For example, when a user issues a public key certificate from a credit information agency, And a credit information agency server for verification may be included in the authentication system according to the present invention.

With reference to the detailed configuration of the authentication service system according to the present invention, the user mobile terminal will be described in more detail with reference to the embodiment.

FIG. 2 is a block diagram of an embodiment of a user mobile terminal to which the present invention is applied. In the embodiment shown in FIG. 2 (a), the user mobile terminal 100a is provided with a banking application 110a and an authentication application 150a according to the present invention.

In the above embodiment, the banking application 110a is shown as an example. However, the present invention is not limited to this, and various online services for using various online services requiring user authentication through authentication information such as a password, The application may be installed in the user mobile terminal 100a and the user authentication process may be supported through the authentication application 150a according to the present invention. Also, the user authentication process may be supported through the authentication application 150a in the process of performing the user authentication for the online service through the mobile browser installed on the user mobile terminal 100a.

A user who wishes to use the banking application 110a may install the banking application 110a in his / her user mobile terminal 100a, and the banking application 110a may be installed in the user's mobile terminal 100a, The user authentication process through the user authentication certificate or the like is indispensable when using the online financial service through the Internet 110a. For example, when the electronic signature of the corresponding online financial document is requested with a user's authorized certificate, the user is required to input a password for the authorized certificate. The authentication application 150a does not perform a process of receiving a separate password from the user, The electronic signature process of the authorized certificate for the corresponding online financial statement is supported by replacing the password input.

To this end, the authentication application 150a separates the fragments obtained by dividing the authentication information including the password of the corresponding authorized certificate into different places according to the result of biometrics authentication of the user, and stores the pieces of biometrics authentication result And retrieves fragments separated and stored to recover the authentication information including the password, thereby performing the digital signature of the corresponding authorized certificate. As described above, according to the present invention, it is possible to safely secure the password even when some information is leaked by hacking or the like of the user mobile terminal 100a by separating and storing pieces of the authentication information including the password.

Further, as shown in FIG. 2 (a), the online service application and the authentication application may be separately installed on the user mobile terminal, but the authentication application may be included in the online service application, Authentication application may be implemented, which will be described with reference to the embodiment shown in FIG. 2 (b).

In the case of the banking application 110b, a user authentication function may be installed in the banking application reflecting the security policy of the financial institution. The present invention may be applied to the banking application 110b as the authentication SDK 150b.

For example, an authentication toolkit 110b for performing a user authentication function is installed in the banking application 110b itself, and an authentication SDK 150b for applying the present invention is additionally installed, and the authentication toolkit 110b and the authentication SDK 150b The authentication service according to the present invention can be implemented by mutual interoperation.

That is, the authentication toolkit 110b performs digital signature of a public certificate for performing user authentication when using an online financial service. In the form of an SDK (Software Development Kit) or an API (Application Programming Interface) The authentication toolkit 110b divides the authentication information such as the password of the authorized certificate used in the authentication toolkit 110b into separate parts according to the result of the biometrics authentication of the user, Upon use of the certificate, pieces of fragments separated and stored according to the result of biometrics authentication of the user can be recovered, authentication information including a password can be restored, and the password can be transmitted to the authentication toolkit 110b.

Furthermore, as another embodiment of the authentication application according to the present invention, the authentication application may be divided into various functions according to various functions, and each functional application may be loaded on the user mobile terminal. In this regard, the embodiment of FIG. 3 will be described .

The authentication application 400 may include an authorized authentication application 410, a biometric authentication application 430, an authentication combination application 450, and the like.

The authorized authentication application 410 provides an electronic signature based on a public key certificate when requesting authentication to a user while managing a public key certificate of a user. Various authentication applications or authentication modules for managing a public key certificate can be applied as needed . In addition, the public authentication application 410 may store a plurality of public certificates and provide an electronic signature corresponding to the requested user authentication with the corresponding public key certificate selected by the user.

In addition, when applying the present invention to a user authentication based on a password input for an online service account or the like for which a public authentication certificate is not required, the public authentication application 410 may be omitted, and the authentication application 400 may authenticate the authentication service Authentication information such as a password for the corresponding account may be received through the corresponding online service server or user input.

The biometrics authentication application 430 performs user authentication through biometrics of the user. Biometrics of the user may be various biometrics methods such as fingerprint recognition, iris recognition, blood vessel recognition, or voice recognition of the user. The biometric authentication application 430 may have corresponding recognition means separately or may interact with various recognition means already provided in the user mobile terminal.

The authentication combination application 450 divides the authentication information such as the password of the public certificate stored in the public authentication application 410 to generate a device token and a server token, and then generates the device token and the server token using the biometrics authentication application 430 Registers the server token in the authentication service apparatus 200 and stores the device token in the token storage provided on the user mobile terminal. At this time, the authentication combining application 450 transmits the signed server token to the authentication service apparatus 200 according to the biometric authentication result, and when the server token is registered according to the verification result of the biometric authentication result in the authentication service apparatus 200, Depending on the result, the device token may be stored in the token store. The authentication combination application 450 may transmit an identification tag or the like to the server token and transmit the identification information tag to the authentication service apparatus 200. The authentication service apparatus 200 may register the server token with reference to the identification information tag.

Preferably, the authentication combining application 450 receives the authentication information including the password and the like for the user's authorized certificate from the authorized authentication application 410, generates a cryptographic key corresponding to the corresponding authentication information, and encrypts the authentication information A server token and a device token may be generated by a combination of pieces of authentication information and encryption key pieces obtained by dividing the encrypted authentication information and the encryption key, respectively.

When the digital signature of the authorized certificate for the user of the authorized authentication application 410 is requested, the authentication combining application 450 transmits the biometric authentication result obtained by performing the biometric authentication for the user through the biometric authentication application 430 to the authentication service To the device 200 and requests a server token. Upon receiving the server token based on the verification result of the biometric authentication result from the authentication service device 200, the authentication combining application 450 extracts the device token from the token store, And transfers the password included in the authentication information to the authorized authentication application 410. [

At this time, the authentication combining application 450 transmits the identification information of the corresponding server token when requesting the server token, and the authentication service device 200 can extract the corresponding stored server token based on the identification information of the registered server token have.

Also, when the server token and the device token are generated as a fragment of the encrypted authentication information and the encrypted key fragment, the authentication combining application 450 restores the encrypted authentication information and the encryption key, respectively, It is possible to decrypt and recover the authentication information.

Furthermore, in the present invention, an authentication application may be configured by selectively combining a public authentication application and a biometric authentication application in an authentication combining application, which will be described with reference to the embodiment shown in FIG.

4A is an embodiment in which the authentication combining application 450a includes the biometric authentication support unit 455a and the authentication combining application 450a is connected to the authentication service 410a according to the present invention in cooperation with the authorized authentication application 410a. It is possible to perform the biometric authentication function performed by the biometric authentication application including the biometric authentication support unit 455a in addition to the basic functions of the authentication combination application 450a shown in FIG.

4B shows an embodiment in which the authentication combining application 450b includes the authorized authentication support unit 455b and the authentication combining application 450b is configured to perform authentication according to the present invention in cooperation with the biometrics authentication application 430b In addition to the basic functions of the authentication combination application 450b shown in FIG. 3, the authentication service support unit 455b can perform the management of the authorized certificate and the signature function performed by the authorized authentication application .

The authentication application according to the present invention may be implemented as a computer program stored in a user terminal to execute each step of the biometric authentication combined user authentication method according to the present invention to be described later.

Next, an authentication service apparatus according to the present invention will be described with reference to the configuration diagram of the embodiment shown in FIG.

The authentication service apparatus 200 may include a biometric authentication unit 210, an authentication support unit 230, and a server token storage unit 250.

The biometric authentication verification unit 210 holds the biometric authentication key corresponding to the biometric authentication for the user, verifies the biometric authentication result transmitted from the authentication application of the user mobile terminal, and provides the verification result accordingly.

For this, the biometric authentication verification unit 210 receives the biometric authentication key corresponding to the biometric authentication for the user from the authentication application of the user mobile terminal in advance and registers the biometric authentication for the user. At this time, The biometric authentication unit 210 receives a public key corresponding to the biometric authentication result from the authentication application of the user mobile terminal and registers the public key, and transmits the private key corresponding to the biometric authentication result from the authentication application Can be verified with the registered public key to generate the verification result.

The authentication support unit 230 receives a server token including one or more fragments obtained by dividing authentication information including a password for user authentication from an authentication application installed in the user mobile terminal in correspondence with the biometric authentication result for the user, At this time, the server token signed with the biometric authentication key can be received according to the biometric authentication result of the user. Then, the authentication support unit 230 verifies the signature of the server token through the biometric authentication verification unit 210, registers the server token in accordance with the verification result, stores the server token in the server token storage unit 250, send. At this time, an ID tag may be attached to the server token transmitted from the authentication application, and the authentication support unit 230 may register the server token based on the ID tag.

When the authentication support unit 230 receives a transmission request of the server token together with the biometric authentication result of the user according to the authentication request of the user from the authentication application of the user mobile terminal, the authentication support unit 230 transmits the biometric authentication result Transmits the verification result to the authentication application, extracts the server token according to the verification result, and transmits the extracted server token to the authentication application. At this time, identification information corresponding to the corresponding server token can be received at the time of the transmission request for the server token from the authentication application, and the registered server token can be extracted based on the identification information.

The server token storage unit 250 receives and stores the server token from the authentication support unit 230 according to the registration decision of the corresponding server token of the authentication support unit 230. [

The authentication service device may be constituted by individual devices. In addition, when a commonly-used server is applied as an authentication service device, each step of the biometric authentication combined user authentication method according to the present invention A server on which a computer program is loaded may be applied as an authentication service apparatus.

As described above, the authentication system according to the present invention includes an authentication application installed in the user mobile terminal 100 and an online application in which most of the on-line systems established up to now through the authentication service apparatus 200 are user authentication The biometric authentication technology can be applied without changing the service system itself.

In addition, the present invention proposes a biometric authentication combined user authentication method through each of the above-described configurations of the authentication service system.

A biometric authentication combined user authentication method according to the present invention can be classified into an authentication service registration process and an authentication service providing process. First, in an authentication service registration process, an authentication application installed in a user mobile terminal includes a password for user authentication The authentication information is divided into two or more pieces to generate a server token including a device token and a remaining piece including one or more pieces. The authentication application transmits the server token to the authentication service device according to the biometric authentication result of the biometric authentication performed by the user. The authentication service device verifies the biometric authentication result and registers the server token according to the verification result And transmits the registration result to the authentication application. The authentication application then stores the device token in the user mobile terminal according to the registration result of the server token.

When the user authentication is requested after the authentication service registration process, the authentication service providing process is performed. When the user authentication of the password input is requested through signing of the authorized certificate or using the online account through the user mobile terminal, The authentication application installed in the user mobile terminal requests the server token while transmitting the biometric authentication result of biometric authentication to the user to the authentication service device. The authentication service device verifies the biometric authentication result, extracts a corresponding server token according to the verification result, and transmits the extracted server token to the authentication application. The authentication application combines the transmitted server token and the device token stored in the user mobile terminal And provides the password included in the authentication information for authentication to the user.

Hereinafter, a biometric authentication combined user authentication method according to the present invention will be described in detail with reference to embodiments of an authentication service registration process and an authentication service provision process.

6 is a conceptual diagram of an authentication service registration process in a biometric authentication combined user authentication method according to the present invention.

The authentication application of the user terminal 100 encrypts the password 510 by generating an encryption key 520 corresponding to the password 510 for user authentication.

The cipher key 520 and the encrypted password 530 are divided into cipher key pieces 521 and 525 and password pieces 531 and 535 and then divided into pieces 521 and 525 of the cipher key pieces 521 and 525 And a piece 531 of the password pieces 531 and 535 to generate the device token 540 and generates the server token 550 as the remaining cryptographic key piece 525 and the password piece 535. [

Once the server token 550 is generated with the password snippet 535, the authentication application performs biometric authentication 560 for the user to sign the server token 550 with the biometric key in accordance with the biometric result, (570) to the authentication service apparatus (200).

The authentication service apparatus 200 verifies the signature of the server token 570 transmitted from the authentication application of the user mobile terminal 100. For this purpose, registration of the user biometric authentication is premised on the authentication service apparatus 200 in advance The authentication service apparatus 200 has a biometric authentication key corresponding to the user biometric authentication.

 Then, the authentication service apparatus 200 registers and holds the server token according to the verification result of the signature of the server token 570, and transmits the registration result to the authentication application of the user mobile terminal 100.

The authentication application of the user mobile terminal 100 stores the corresponding device token 540 on the user mobile terminal 100 according to the registration result for the server token from the authentication service device 200. [

7 is a flowchart illustrating an authentication method according to an embodiment of the present invention. Referring to FIG. 7, in the biometric authentication combination user authentication method according to an exemplary embodiment of the present invention, when a password authentication is requested for use in a state where the service registration process is completed, And a service providing process.

When the user authentication is requested, the authentication application of the user mobile terminal 100 requests the server token while transmitting the biometric authentication result of biometric authentication 610 to the user to the authentication service device 200.

Then, the authentication service apparatus 200 verifies the biometric authentication result transmitted from the authentication application, extracts the server token 630 according to the verification result, and transmits the extracted server token 630 to the authentication application of the user mobile terminal 100. At this time, the verification result of the biometric authentication result may be transmitted together.

The authentication application of the user mobile terminal 100 extracts the device token 620 corresponding to the server token 630 transmitted from the authentication service apparatus 200 and transmits the encrypted key piece 621 included in the device token 620, And combines 640 the cryptographic key fragment 631 included in the server token 630 to recover the cryptographic key 660 and also to recover the password fragment 625 and the server token 630 contained in the device token 620, (650) the password piece (635) contained in the encrypted password (670). When the encryption key 660 and the encrypted password 670 are restored, the authentication application decrypts the password 670 encrypted with the encryption key 660 to regenerate the password 680, encrypts the password 680 for user authentication, Lt; / RTI >

As described above, in the present invention, the password for user authentication can be replaced with the user biometric authentication by interlocking with the authentication application installed in the user mobile terminal 100 and the authentication service device 200. Particularly, Storage can improve security reliability.

The biometric authentication combined user authentication method according to the present invention will be described in more detail with reference to a detailed embodiment by way of how the embodiment is practically implemented on a user mobile terminal and an authentication service device.

FIG. 8 shows a flowchart of an embodiment of the authentication service registration process in the biometric authentication combined user authentication method according to the present invention.

The embodiment of FIG. 8 is a case of applying the authentication application of FIG. 3 as described above, which is one embodiment for explaining the present invention. The detailed configuration of the authentication service system may be variously modified as described above And each process performed in the detailed configuration of the authentication service system can be modified accordingly.

The biometric authentication application 430 of the user mobile terminal 100 registers the biometric authentication of the user in the authentication service device 200 in order to use the biometric authentication combined user authentication method according to the present invention. In the embodiment of FIG. 8, the biometric authentication application 430 performs the biometric authentication of the user and generates a biometric authentication key corresponding to the biometric authentication application 430 (S10) Transmits the biometric authentication key to the authentication service apparatus 200 while requesting the service apparatus 200 to register the user biometric authentication (S30), and the authentication service apparatus 200 registers the biometric authentication of the user (S50) And stores the biometric authentication key.

At this time, the user biometrics may be applied to various biometrics such as fingerprint recognition, iris recognition, blood vessel recognition or voice recognition of the user, and may generate individual biometrics keys for each biometrics for a user, The biometric authentication key corresponding to the biometric authentication key may be generated.

Preferably, the biometric authentication key can be generated in a two-key manner between the public key and the private key, and the public key can be registered in the authentication service apparatus 200 in association with the biometric authentication of the user.

After the biometric authentication for the user is registered in the authentication service apparatus 200, in order to use the biometric authentication combined user authentication service according to the present invention, the authentication combining application 450 receives the authentication certificate from the authorized authentication application 410 And receives a password (S110). In FIG. 8, a password of a user authentication certificate is described. As an example, it is possible to apply additional authentication information in addition to the password as described above. In addition, various authentication methods, such as a password of an online service account, The present invention can be applied to the form.

Upon receiving the password of the authorized certificate, the authentication combining application 450 generates a cryptographic key corresponding to the received password (S120), and encrypts the cryptographic key with the cryptographic key (S130). Then, each of the encrypted password and the encryption key is divided into a plurality of pieces, which are then formed into a password piece and a cipher key piece. Then, a device token is generated by selecting a combination of a password piece and a cipher key piece, and a server token is generated (S140, S150).

Preferably, an identification tag may be attached to the device token and the server token so that the device token corresponding to the password of each of the plurality of authorized certificates can be distinguished from the server token.

A concrete example of the process of generating the device token and the server token is as follows. First, each of the encrypted authentication information and the encryption key is divided into two pieces. Then, according to the sequential order of the pieces, To generate a device token, and a second piece of the authentication information piece and a second piece of the encryption key piece may be combined to generate a server token.

If the encrypted authentication information and the encryption key are divided into three or more pieces and combined or randomly combined, the sequential order of the pieces of authentication information and the sequential order of the cipher key pieces are set, The device token and the server token can be generated by combining the sequential numbers of the pieces of the key. At this time, the combination information of the order of the pieces of the authentication information pieces included in the device token and the server token and the order of the cipher key pieces is generated, You can attach tags to server tokens. Then, when the device token and the server token are combined to recover the encrypted authentication information and the encryption key, the pieces of authentication information and the encryption key can be restored by arranging each piece based on the combination information.

When the device token and the server token are generated through the above process, the authentication combining application 450 requests the biometric authentication application 430 to perform biometric authentication for the user (S160). When the biometric authentication application 430 requests the biometric authentication application 430 The biometric authentication is performed (S170), and the biometric authentication result is transmitted to the authentication combination application 450 (S180). Here, the binding application 450 requests the biometrics authentication for the user and delivers the server token generated by the biometrics authentication application 430. The biometrics authentication application 430 signs the server token with the biometrics authentication key according to the biometrics authentication result And transmit the signed server token along with the biometric result.

Then, the authentication combining application 450 transmits the signed server token to the authentication service device 200 based on the biometric authentication result (S190), and requests registration of the server token.

The authentication service apparatus 200 performs verification on the basis of the biometric authentication registered for the user in advance with respect to the signed server token transmitted from the authentication combining application 450. In accordance with the biometric authentication registration for the user, The authentication key can verify the signature of the server token.

In accordance with the verification result of the signature of the server token, the authentication service apparatus 200 registers and stores the server token (S220), and transmits the registration result to the authentication combination application 450 (S230).

The authentication combining application 450 stores a device token pairing with the registered server token on the user mobile terminal 100 according to the registration result from the authentication service device 200 (S240).

Through such a process, the authentication information such as the password of the authorized certificate can be divided and the divided pieces can be separately stored in different places.

Next, referring to the flow chart of the embodiment of the authentication service providing process in the biometric authentication combined user authentication method according to the present invention shown in FIG. 9 with reference to the use process of the authentication service in which the password input for user authentication is automatically performed by biometric authentication .

The embodiment of FIG. 9 is a process of connecting after the embodiment of FIG. 8, which has been described above, in which the signature of the authorized certificate is provided through the present invention when the online banking service provided by the banking server 300, which is an online service server, For example.

When the banking server 300 receives a request for signing a user certificate from the banking server 300 in step S310 during the process of using the online banking service provided by the banking server 300 through the user mobile terminal 100, (S320) to the authentication combination application 450 to perform authentication on the public certificate.

In response to the authentication execution request, the authentication combining application 450 requests the biometric authentication application 430 to perform biometric authentication for the user (S330), and the biometric authentication application 430 performs the biometric authentication of the user (S340) When the biometric authentication method corresponding to the authorized certificate is set to a specific biometric authentication method, the biometric authentication method is performed using the biometric authentication method. If there is no restriction of the biometric authentication method, Biometrics is performed using a recognition method.

Then, the biometric authentication application 430 transmits the biometric authentication result based on the biometric authentication to the authentication combination application 450 (S350). At this time, the authentication combining application 450 provides the original authentication text corresponding to the authentication process to the biometric authentication application 430, and the biometric authentication application 430 sends the authentication original text signed with the biometric authentication key according to the biometric authentication result to the authentication combination application 450).

Upon acquiring the biometric authentication result for the user, the authentication combining application 450 transmits the biometric authentication result to the authentication service device 200 (S350), and requests the server token. Upon request of the server token, the authentication combining application 450 may transmit the identification information of the server token corresponding to the authentication certificate to be used for user authentication to the authentication service apparatus 200. [

Upon receipt of the request for the server token, the authentication service apparatus 200 verifies the transmitted biometric authentication result (S370). For example, the authentication service apparatus 200 verifies the signature of the authentication original based on the biometric authentication key registered for user biometric authentication in advance .

Then, the authentication service apparatus 200 extracts a server token according to the verification result of the biometric authentication result (S380) and transmits the server token to the authentication combination application 450 (S390) ) Of the server token among the plurality of server tokens stored based on the identification information transmitted when the server token is requested.

Upon receiving the server token from the authentication service device 200, the authentication combination application 450 extracts a device token that is paired with the received server token (S410), and extracts the server token, the password fragment included in the device token, (S420) to recover the encrypted password and the encryption key.

The process of recovering the encrypted password and the encryption key will be described in detail. The authentication information piece and the encryption key piece are combined in the combination of the device token and the preset sequence number at the time of generating the server token to generate the device token and the server token , The authentication information pieces and the encryption key fragments included in the device token and the server token can be combined according to the combination of the set sequence numbers to recover the encrypted authentication information and the encryption key.

If a device token and a server token are generated by dividing each of the encrypted authentication information and the encryption key into three or more pieces when the device token and the server token are generated or by randomly combining them, It is possible to recover the encrypted authentication information and the encryption key by arranging and combining the authentication information pieces and the encryption key pieces included in the device token and the server token based on the combination information tagged in the server token.

9, after restoring the encrypted password and the encryption key, the authentication combination application 450 decrypts the password encrypted with the encryption key (S430), and transmits the recovered password to the authorized authentication application (S440).

The authorized authentication application 410 receives the password for the authorized certificate from the authentication combining application 450, thereby authenticating the authorized certificate with the received password without having to input the password for the authorized certificate from the user (S520 And transmits the user's signature of the corresponding authorized certificate to the banking server 300 (S550).

9, when a banking application for using the online banking service of the banking server 300 is installed in the user mobile terminal 100, the banking server 300 and the authorized authentication application 410 may perform banking And the banking application may be configured to selectively include the authorized authentication application 410, the biometric authentication application 430, and the authentication combination application 450. [

Furthermore, in the case where the present invention is applied to authentication information such as a password for a plurality of online service accounts or a plurality of authorized certificates stored on a user mobile terminal, FIG. 10 is a flowchart illustrating a biometric authentication combined user authentication ≪ / RTI > shows an example for providing authentication services for a plurality of authorized certificate passwords and online service account passwords.

As shown in FIG. 10, when the present invention is applied to the selective use of the public certificate A, the public certificate B, and the like through one user mobile terminal, or when the online service account C and the online service account D are additionally used in addition to the public certificate, The authentication application installed in the user mobile terminal generates the encryption key A 711 corresponding to the authentication certificate A password 710 and transmits the authentication authentication A password 710 and the encryption key A 711 The token pair of the device token A 713 and the server token A 715 is generated through the above-described process. The user biometrics authentication is performed to register the server token A 715 in the authentication service device and the device token A 713 in the user mobile terminal according to the biometric authentication result.

Similarly, individual encryption keys 721, 731, and 741 are generated for each of the public certificate B password 720, online service account C password 730, and online service account D password 740, and each corresponding device token 723, 733 and 743 and the server tokens 725, 735 and 745 to register the respective server tokens 725, 735 and 745 in the authentication service apparatus according to the result of the user biometric authentication, , 733, and 743 are stored in the user mobile terminal.

When a plurality of pairs of tokens are registered and stored, identification information is added to each of the device tokens 713, 723, 733, and 743 and each of the server tokens 715, 725, 735, So that the device token and the server token required among the device tokens 713, 723, 733, and 743 and the server tokens 715, 725, 735, and 745 can be extracted based on the identification information.

Furthermore, in the present invention, various biometric methods such as a fingerprint recognition 751, an iris recognition 753, a speech recognition 755, and a blood vessel recognition 757 can be applied to the user. The authentication application of the user mobile terminal performs the biometric authentication using the biometric authentication method selected by the user during the biometric authentication that is registered in the authentication service device, so that the biometric authentication combined user authentication method Each process can be performed.

If a specific authorized certificate or a specific online service account is limited to specific biometric authentication for reasons such as a security policy or a user's selection, as in the case of FIG. 10, a device token The biometric authentication method according to the biometric authentication method in which any one of the plurality of biometric authentication methods is set and set for each pair of tokens 713, 723, 733, and 743 and server tokens 715, 725, 735, 725, 735, and 745 are registered on the authentication service apparatus and the biometric authentication result according to the biometric authentication method set in the request of each of the server tokens 715, 725, 735, and 745 To request a corresponding server token.

For example, when the device token A 713 corresponding to the authentication certificate A password 710 and the server token A 715 are biometrics based on the iris recognition 753 scheme, the authentication application installed in the user mobile terminal is iris recognition It is possible to register the device token A 713 corresponding to the public certificate A password 710 only with the biometric authentication registered in the authentication service device in association with the authentication device 753 and also to register the device token A 713 with the authentication service device The authentication application installed in the user mobile terminal can receive the device token A 713 only as a biometric authentication result through the iris recognition 753. [

According to the present invention, most of the on-line systems established up to now apply biometric authentication technology without changing the on-line system itself in a situation where user authentication is applied as a password input authentication method.

Particularly, authentication information such as a password, which may cause serious damage in the case of external leakage, is divided into a device token and a server token, and the authentication information is stored in the authentication service device and the user mobile terminal in association with the biometric authentication. Even if a user is lost or hacked, only a part of the password is leaked, and the entire password can not be confirmed, thereby enhancing the security reliability.

The foregoing description is merely illustrative of the technical idea of the present invention, and various changes and modifications may be made by those skilled in the art without departing from the essential characteristics of the present invention. Therefore, the embodiments of the present invention are not intended to limit the scope of the present invention but to limit the scope of the present invention. The scope of protection of the present invention should be construed according to the following claims, and all technical ideas within the scope of equivalents thereof should be construed as being included in the scope of the present invention.

100, 100a, 100b: a user mobile terminal,
110a, 110b: banking application,
111b: authentication toolkit,
150a, 400: authentication application,
150b: Authentication SDK,
200: authentication service device,
210: biometric authentication verification unit,
230: Certification Authority,
250: a server token storage unit,
300: online service server,
410, 410a: Certified authentication application,
430, 430b: biometric authentication application,
450, 450a, 450b: Authentication combination application,
455a: biometric authentication support unit,
455b: Certified Certification Support.

Claims (20)

An authentication information encryption step of encrypting the authentication information by generating an encryption key corresponding to authentication information including a password for user authentication in an authentication application installed in a user mobile terminal;
Wherein the authentication application divides the encrypted authentication information and the encryption key into a plurality of fragments and generates a device token with a combination of a plurality of fragments selected from the authentication information fragments and the encryption key fragments, A token generating step of generating combination information on the order of the pieces of authentication information pieces included in the device token and the server token and the order of the cipher key pieces; And
Wherein the authentication application includes a token storage step of registering the server token in the authentication service device according to the biometric authentication result for the user and storing the device token in the user mobile terminal. Authentication method. The method according to claim 1,
The authentication application transmits the biometric authentication result for the user performed according to the authentication request for the user to the authentication service device and transmits the server token according to the verification result of the biometric authentication result from the authentication service device A token extracting step of extracting the device token;
An authentication information recovery step of the authentication application recovering the authentication information and the encryption key encrypted by combining the server token and fragments included in the device token based on the combination information;
A password extracting step of the authentication application decrypting the authentication information encrypted with the encryption key and extracting a password included in the authentication information; And
Wherein the authentication application includes a password providing step of providing the password for authentication of the user. delete The method according to claim 1,
Wherein the token storage step comprises:
Transmitting a server token signed with a previously stored biometric authentication key to the authentication service apparatus according to the biometric authentication result for the user;
Receiving a registration result of the server token according to a verification result of the server token signed by the authentication service device; And
And storing the device token in the user mobile terminal according to the registration result. 3. The method of claim 2,
The token extracting step includes:
Generating a biometric authentication result for the user performed according to an authentication request for the user;
Requesting the server token while transmitting the biometric authentication result to the authentication service device;
Receiving the server token according to the verification result of the biometric authentication result from the authentication service device; And
And extracting the device token according to the verification result. 3. The method of claim 2,
Generating a plurality of device tokens and a plurality of server tokens by performing the authentication information encryption step and the token generation step for each authentication information corresponding to a plurality of passwords,
Wherein the token storage step comprises:
Wherein each of the plurality of server tokens is registered in the authentication service apparatus and each of the plurality of device tokens is stored in the user mobile terminal. The method according to claim 6,
Wherein the token storage step comprises:
Wherein each of the plurality of biometric authentication methods is set for each of a pair of a device token and a token pair of a server token corresponding to each of a plurality of pieces of authentication information and sets each of the server tokens based on a biometric authentication result in accordance with the biometric authentication method And registers it in the authentication service apparatus,
The token extraction step,
And a server token is received from the authentication service device based on a biometric authentication result obtained by performing a biometric authentication on a user using a biometric authentication method set corresponding to the pair of tokens. The authentication service apparatus includes an authentication information piece generated by dividing the encrypted authentication information including the password for user authentication and the encryption key corresponding to the encrypted authentication information into a plurality of fragments, respectively, A token receiving step of receiving a server token generated as a combination of pieces selected from the cipher key piece and the cipher key piece, corresponding to the biometric authentication result for the user;
A registration result transmission step of the authentication service device performing verification of the biometrics authentication result, registering the server token according to a verification result, and transmitting a registration result to the authentication application; And
The authentication service apparatus receives a transmission request of the server token together with the biometrics authentication result of the user according to an authentication request for the user from the authentication application, extracts the server token according to the verification of the biometrics authentication result And transmitting the authentication service to the authentication application. delete 9. The method of claim 8,
The authentication service providing step may include:
A token request receiving step of receiving a transmission request for the server token together with a biometric authentication result for the user performed according to an authentication request for the user from the authentication application;
A token extracting step of verifying the biometric authentication result and extracting the server token according to a verification result; And
And a token transmission step of transmitting the server token to the authentication application. 9. The method of claim 8,
The token receiving step includes:
Receives the server token signed with the biometric authentication key corresponding to the biometric authentication of the user from the authentication application,
The registration result transmission step includes:
And verifying the signature of the server token with a previously stored biometric authentication key. 9. The method of claim 8,
The token receiving step includes:
Receiving a server token generated for each authentication information corresponding to each of a plurality of passwords from the authentication application,
The registration result transmission step includes:
And registering each of the plurality of server tokens and transmitting the respective registration results to the authentication application. Generating a cryptographic key corresponding to authentication information including a password for user authentication, encrypting the authentication information, dividing the encrypted authentication information and the cryptographic key into a plurality of fragments, Selecting a plurality of fragments from the fragment and generating a device token with a combination of the fragments, and generating a server token with a combination of the remaining fragments, and comparing the sequence number of the authentication information fragments included in the device token, Generating combination information for the sequence number, requesting the authentication service device to register the server token according to the biometric authentication result for the user, storing the device token,
Receiving the server token from the authentication service device based on the biometric authentication result of the user in response to the authentication request for the user and combining the server token and fragments included in the device token based on the combination information, And an authentication application for restoring the information and providing the password included in the authentication information for authenticating the user. 14. The method of claim 13,
The server receives the authentication information including the password for the authorized certificate from the authorized authentication application installed in the user mobile terminal and supports the management of the user's authorized certificate and the digital signature to generate a server token and a device token for the authentication information ,
And an authentication application for restoring authentication information based on the server token and the device token according to an authentication request for the user and providing a password for the authorized certificate to the authorized authentication application. 14. The method of claim 13,
A biometric authentication application installed in the user mobile terminal and performing biometric authentication for a user, receives a signature of the server token, requests signature of the server token through biometric authentication of the user,
And an authentication application for receiving the biometric authentication result of the user according to the authentication request for the user from the biometric authentication application. delete delete The encrypted authentication information including the password for user authentication and the encryption key corresponding to the encrypted authentication information from the authentication application installed in the user mobile terminal are divided into a plurality of fragments, A server token generated by combining the selected pieces of the server token with the server biometric authentication result for the user, and registering the server token; and, in response to the authentication request for the user, An authentication support unit for receiving a server token transmission request and providing the server token;
A biometric authentication unit which holds a biometric authentication key corresponding to biometric authentication for the user and receives and verifies the biometric authentication result of the user from the authentication support unit and provides a verification result; And
And a server token storage unit for storing the server token according to the registration decision of the authentication support unit. A computer program stored in a user mobile terminal for executing each step of the biometric authentication combined user authentication method according to any one of claims 1, 2 or 4 to 7. A computer program stored in an authentication service apparatus for executing each step of the biometric authentication combined user authentication method according to any one of claims 8 to 12.

Images