KR101937136B1 - System and method for authenticating identity using multi-biometrics - Google Patents

Abstract

The present invention relates to a system and method for authenticating an individual using multiple biometrics. More particularly, the present invention relates to a system and method for authenticating an individual using multiple biometrics, in which multiple biometrics devices are directly or indirectly connected to an authentication server and a service server, The present invention relates to an apparatus for performing highly authenticated personal authentication by tracking and storing information, and more particularly, to an authentication server connected to a well-known communication network 10 for legacy authentication and public key registration, 20); A service server (30) connected to the communication network (10) and requesting authentication of the user to provide a service to the user; A communication unit 100 including a communication module 110 connected directly or indirectly to the communication network 10 and capable of data communication with the authentication server 20 and the service server 30, A biometric identification unit 200 capable of recognizing two or more of biometric information such as a fingerprint, a fingerprint, an iris, a blood vessel, a face, a voice, a palm, a sweat gland, and a security medium such as a TPM or a UICC (300) for generating biometrics information, a private key and a public key pair based on two or more biometric information recognized by the multiple biometrics unit (200), storing the generated private key in the secure medium (300) It is possible to obtain the access right to the private key stored in the secure medium 300 through the multiple biometrics in accordance with the identity authentication request, Perform authentication And a multi-biometric device 40 including a control unit 400, so that the authentication of the user can be performed more conveniently and more securely while improving the accuracy and reliability of authentication of the user.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a biometric authentication system,

The present invention relates to a system and method for authenticating an individual using multiple biometrics. More particularly, the present invention relates to a system and method for authenticating a user using multiple biometrics, in which multiple biometrics devices are directly or indirectly connected to an authentication server and a service server, The present invention relates to an apparatus and method for performing authentication of a user with greater convenience and higher security while improving the accuracy and reliability of authentication of the user.

Generally, according to the rapid development of IT and communication fields, a non-face authentication method for authenticating a user as an online user is continuously being developed.

Here, non-face-to-face authentication (hereinafter simply referred to as "personal authentication") is largely based on knowledge base authentication such as a password, possession-based personal authentication such as SMS and e-mail, biometric authentication based on fingerprint, face, iris, Authentication, and feature-based authentication of location, access record, and so on.

Among them, biometric authentication based on biometrics means that the individual is authenticated by using information extracted from the biometrics inherent to each person and compared with the information registered in the past.

In particular, biometric authentication is generally regarded as one of high security authentication methods because it is generally difficult to forgive or alter the security of the theft or loss.

Accordingly, various types of devices capable of performing authentication by biometrics have been developed. In other words, a user terminal having a built-in biometrics device and a dedicated device for biometrics can be provided.

The user terminal incorporating the biometric device is, for example, a user terminal such as a smart phone or a tablet having a built-in biometric device for recognizing a fingerprint or a face of a user. It is only a low security level such as judging whether the use of the user terminal is allowed or not.

In addition, while dedicated devices for biometrics have advantages of high recognition rate and low risk of forgery and falsification, it is common that they do not include the communication module itself. For example, it is possible to use a separate smartphone or tablet After the data communication with the same user terminal has been preceded, the user terminal has to perform data communication to a well-known communication network such as WCDMA, 3G, LTE / LTE-A, etc. by using a built-in separate remote communication module.

In addition, at present, the development of a system for authenticating the user using two or more pieces of multiple biometric information is not enough. In addition, there is no procedure for checking the location information including the ground clearance at the authentication of the user, There was also a problem that it was not possible to prepare for the authentication attempted in an irrelevant area.

The present invention solves the above-mentioned problems, and it is an object of the present invention to provide a biometric authentication apparatus and a biometric authentication method, in which multiple biometric authentication apparatuses are directly or indirectly connected to an authentication server and a service server, The present invention provides a system and method for authenticating a user using multi-biometrics, which can improve accuracy and reliability of identity authentication by performing self-authentication by tracking and storing information.

The multi-biometrics authentication system of the present invention includes an authentication server connected to a well-known communication network and capable of legacy authentication and public key registration, and verifying digital signatures; A service server connected to the communication network and requesting authentication of the user to provide a service to the user; A communication module including a communication module capable of directly or indirectly connecting to the communication network and capable of performing data communication with the authentication server and the service server, and a communication module including a communication module, such as an ECG signal, a fingerprint, an iris, A security medium such as a TPM or a UICC capable of storing the generated private key, and a security medium such as a personal computer based on two or more biometric information recognized by the multi- The method includes generating a key and a public key pair, storing the generated private key in the secure medium, transmitting the generated public key to the authentication server, And a controller for performing authentication of the user through digital signature using the corresponding private key, It can be achieved by including;

Here, the communication unit of the multiple biometric device may include: It is preferable to include a telecommunication module for directly connecting to the communication network by well-known communication such as WCDMA, 3G, LTE / LTE-A or low-power M2M communication such as LTE-M, SigFox, LoRa and NB-IoT.

In addition, user terminals such as smart phones, tablets, laptops, and desktops connected directly to the communication network by wired / wireless connection are additionally configured; Wherein the communication unit of the multiple biometric device comprises: It may be possible to include a local communication module such as WiFi, RFID, and Bluetooth for connecting to the user terminal based on secure communication and indirectly connecting to the communication network through the user terminal.

In addition, the communication unit of the multiple biometric device may further comprise: It is preferable to be able to directly or indirectly access the three or more base stations located nearby to obtain location information including the ground level of the multiple biometric device.

Next, an authentication method using multiple biometrics according to the present invention is characterized by comprising: A registration step in which the multiple biometric device generates a private key and a public key pair through multiple biometric authentication, transmits the generated public key to the authentication server, and the authentication server registers the public key; And an authentication step in which the multiple biometric device accesses the private key through multiple biometric authentication in accordance with the authentication request, performs digital signature, and transmits the digital signature to the authentication server to authenticate the authentication server.

Here, the registration step may include: a registration request step of requesting the authentication server to register the legacy authentication and the public key according to the change of the authentication means by the multiple biometric device; a registration request step of registering the registration policy to the multiple biometric device A biometric authentication device for generating a private key and a public key pair through multiple biometrics, a step for storing the generated private key in a security medium, And a registration result transmission step of registering the public key received by the authentication server and transmitting the registration result to the multiple biometric device; Wherein the authentication step includes an authentication request step in which the multiple biometric device requests authentication to the authentication server according to an authentication request of the service server, a transaction information transmission step in which the authentication server transmits the transaction information to the multiple biometric device, An electronic signature step in which the biometric device accesses the private key through multiple biometric authentication and performs electronic signature; an electronic signature transmission step in which the multiple biometric device transmits an electronic signature to the authentication server; And an authentication result transmission step of transmitting the authentication result to the multiple biometric device.

Also, before the authentication step, an authentication requesting step of the service server requesting the multiple biometric device to perform authentication of the biometric authentication device; After the authentication step, the multi-biometric device transmits an authentication result to the service server. And a verification step of verifying the authentication result received by the service server through the authentication server.

In particular, in the public key transmission step, the multi-biometric device acquires position information including the ground-level information and transmits it to the authentication server together with the public key; In the registration result transmission step, the authentication server registers location information including the ground level information together with the public key; In the digital signature transmission step, the multiple biometric device acquires position information including the ground-level information and sends it to the authentication server together with the digital signature; In the authentication result transmitting step, it is most preferable that the authentication server verifies whether the location information including the ground clearance information together with the authentication for the electronic signature is registered in advance in the location information or the copper line.

In the present invention as described above, the multiple biometric device directly or indirectly accesses the authentication server and the service server to perform the authentication of the user more conveniently and securely, while tracking and storing not only the multiple biometric information but also the location information including the ground clearance It is an invention that can improve the accuracy and reliability of authentication of the user by performing the authentication of the user.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a schematic diagram showing an example of a personal authentication system using multiple biometrics according to the present invention;
FIG. 2 is a schematic diagram showing a multi-biometric device in a personal authentication system using multiple biometrics according to the present invention;
FIG. 3 is a diagram showing an example in which a multi-biometric device acquires position information including a ground level in the authentication system using the multi-biometrics of the present invention;
FIG. 4 is a flowchart illustrating an example of a method of authenticating a user using multi-biometrics according to the present invention.
FIG. 5 is a schematic flow chart showing a registration step and an authentication step in a state in which a multi-biometric device is directly connected to a communication network in an example of the authentication method using the multi-biometrics of the present invention;
FIG. 6 is a schematic flowchart showing a registration step and an authentication step in a state in which a multiple biometric device is indirectly connected to a communication network through a user terminal in an example of the authentication method using the multiple biometrics of the present invention;
FIG. 7 is a flowchart showing another example of the authentication method using the multi-biometrics of the present invention,
FIG. 8 is a schematic flow chart showing a registration step and an authentication step in a state in which a multiple biometric device is directly connected to a communication network in another example of the authentication method using the multiple biometrics of the present invention;
FIG. 9 is a schematic flow chart illustrating a registration step and an authentication step in a state in which a multiple biometric device is indirectly connected to a communication network through a user terminal in another example of the authentication method using multiple biometrics of the present invention;
FIG. 10 is a schematic configuration diagram showing another example of a personal authentication system using multiple biometrics according to the present invention; FIG.

FIG. 1 is a schematic diagram showing an example of a personal authentication system using multiple biometrics according to the present invention. FIG. 2 shows a multiple biometrics authentication system in a personal authentication system using multiple biometrics according to the present invention FIG. 3 is a diagram showing an example in which a multiple biometric device acquires position information including a ground level in the authentication system using the multiple biometrics of the present invention. FIG.

4 is a flowchart illustrating an example of the authentication method using multiple biometrics according to the present invention. FIG. 5 is a flowchart illustrating an authentication method using multiple biometrics according to an embodiment of the present invention. FIG. 6 is a schematic flowchart showing a registration step and an authentication step in a state in which a user is directly connected to a communication network. FIG. 6 is a flowchart illustrating an authentication method using the multi- FIG. 8 is a schematic flowchart showing a registration step and an authentication step in a state of being indirectly accessed through a terminal; FIG.

5 and 6, (a) shows the registration step (S10), and (b) shows the authentication step (S30).

FIG. 7 is a flowchart showing another example of the authentication method using multiple biometrics according to the present invention. FIG. 8 is a flowchart illustrating another example of the authentication method using multiple biometrics according to the present invention. FIG. 9 is a schematic flowchart showing a registration step and an authentication step in a state of being directly connected to the biometrics authentication system of FIG. Fig. 2 is a schematic flowchart showing a registration step and an authentication step in a state in which they are indirectly connected through the Internet.

8 and 9, (a) shows the registration step (S10), and (b) shows the authentication step (S30).

10 is a schematic configuration diagram showing another example of the authentication system using the multiple biometrics of the present invention.

The specific structure or functional description presented in the embodiment of the present invention is merely illustrative for the purpose of illustrating an embodiment according to the concept of the present invention, and embodiments according to the concept of the present invention can be implemented in various forms. And should not be construed as limited to the embodiments described herein, but should be understood to include all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

Meanwhile, in the present invention, the terms first and / or second etc. may be used to describe various components, but the components are not limited to the terms. The terms may be referred to as a second element only for the purpose of distinguishing one element from another, for example, to the extent that it does not depart from the scope of the invention in accordance with the concept of the present invention, Similarly, the second component may also be referred to as the first component.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, but it should be understood that there may be other elements in between something to do. On the other hand, when it is mentioned that an element is "directly connected" or "directly contacted" to another element, it should be understood that there are no other elements in between. Other expressions for describing the relationship between components, such as "between" and "between" or "adjacent to" and "directly adjacent to" should also be interpreted.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. It will be further understood that the terms " comprises ", or "having ", and the like in the specification are intended to specify the presence of stated features, integers, But do not preclude the presence or addition of steps, operations, elements, parts, or combinations thereof.

The multi-biometrics authentication system and method according to the present invention is a system and method for authenticating a user using multi-biometrics, in which a multi-biometrics device 40 directly or indirectly accesses an authentication server 20 and a service server 30, On the other hand, the basic feature of the present invention is that the accuracy and reliability of the authentication of the user can be improved by performing the authentication of the user by tracking and storing the location information including not only the multi-biometrics but also the ground clearance.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

As shown in FIGS. 1 and 2, the multi-biometrics authentication system according to the present invention is connected to a well-known communication network 10 to enable legacy authentication and public key registration, and performs verification of digital signatures An authentication server (20) A service server (30) connected to the communication network (10) and requesting authentication of the user to provide a service to the user; A communication unit 100 including a communication module 110 connected directly or indirectly to the communication network 10 and capable of data communication with the authentication server 20 and the service server 30, A biometric identification unit 200 capable of recognizing two or more of biometric information such as a fingerprint, a fingerprint, an iris, a blood vessel, a face, a voice, a palm, a sweat gland, and a security medium such as a TPM or a UICC (300) for generating biometrics information, a private key and a public key pair based on two or more biometric information recognized by the multiple biometrics unit (200), storing the generated private key in the secure medium (300) It is possible to obtain the access right to the private key stored in the secure medium 300 through the multiple biometrics in accordance with the identity authentication request, Perform authentication And a multi-biometric device 40 including a control unit 400.

That is, the multi-biometric authentication system according to the present invention includes an authentication server 20, a service server 30, and a multi-biometric device 40 connected to the communication network 10.

First, in the present invention, the communication network 10 may be a known mobile communication network such as a conventional WCDMA, 3G, LTE / LTE-A, etc. More preferably, the communication network 10 may include a low-power M2M communication network.

The authentication server 20 connected to the communication network 10 can perform legacy authentication and public key registration for the multiple biometric device 40 as well as verify the digital signature.

The authentication server 20 may include a separate database for storing authentication related information and results, and the operating entity should be a public authority capable of safely managing various authentication information.

Particularly, in the present invention, the authentication server 20 may store location information or copper lines including ground-level information for allowing authentication of the multi-biometrics device 40, which will be described later, will be good.

The location information including the ground-level information that can permit authentication may be set in advance by registering with the authentication server 20 by the user. Alternatively, the authentication server 20 may be set by the multi-biometric device 40 It may be a copper wire that repeatedly receives location information including the ground-level information transmitted from the base station and stores the information repeatedly.

For example, it is possible to set location information including ground-level information that allows the user to authenticate in advance to a home or a workplace.

In addition, the authentication server 20 tracks and stores location information including the ground-level information of the multiple biometric device 40 repeatedly received by the authentication server 20 without setting a separate user, It is also possible to create and store it yourself.

As described above, the location information or the copper line including the ground level information stored in the authentication server 20 can be used to perform additional verification of the location information or the copper line including the ground level information at the time of self-authentication by using multiple biometrics .

Next, the service server 30 is connected to the communication network 10 and requires the user's authentication of the user in order to provide various services such as electronic commerce, banking, Server.

In addition, the multi-biometric device 40 may be conveniently carried by a user or worn on the user's body. In the present invention, it is preferable to comprehensively include not only a smart phone and a tablet but also various types of wearable devices. There is no limit to the form.

The multi-biometric device 40 includes a communication unit 100, a multi-biometric unit 200, a security medium 300, and a control unit 400 as shown in FIG.

First, in the present invention, the multi-biometric device 40 is directly or indirectly connected to the above-described communication network 10 to communicate with the authentication server 20 or the service server 30, And a communication unit (100) including a communication unit (110).

In this case, the communication unit 100 of the multi-biometric device 40 includes: It is possible to include a remote communication module 111 for directly connecting to the communication network by well known communication such as WCDMA, 3G, LTE / LTE-A or low-power M2M communication such as LTE-M, SigFox, LoRa and NB-IoT Do.

Here, the remote communication module 111 may be configured such that the multiple biometrics device 40 is directly connected to the communication network 10 without a separate user terminal 50 based on well-known communication such as WCDMA, 3G, LTE / LTE- As shown in FIG.

However, the remote communication module 111 may include a module for directly accessing the communication network 10 based on low-power M2M communication such as LTE-M, SigFox, LoRa, and NB-IoT Lt; / RTI >

Here, 'M2M communication' refers to communication between a machine and a machine, and the Internet of things (IoT) that uses the Internet as a communication medium is also encompassed.

Such low power M2M communication uses power of relatively low data rate, relatively low frequency band, signal generation frequency for operation of transmission modem, etc. to greatly reduce power consumption so that battery 700 of multi- Means a communication method capable of greatly extending the replacement period or the charging period.

Such an example would be the case where the multiple biometric device 40 is a smartphone, tablet, laptop, or desktop.

Alternatively, as illustrated in FIG. 10, a user terminal 50 such as a smart phone, a tablet, a laptop, or a desktop connected directly to the communication unit 100 by wired / wireless is additionally configured; The communication unit (100) of the multi-biometric device (40) comprises: And a local communication module 112 such as WiFi, RFID, or Bluetooth for connecting to the user terminal 50 based on secure communication and indirectly connecting to the communication network 10 through the user terminal 50 It would be possible.

That is, the above-described remote communication module 111 can directly access the known communication network 10 without using the separate user terminal 50, but it is also possible to connect another user terminal 50 using the short- It may be possible to indirectly connect to the known communication network 10 through the network.

In this case, the short distance communication module 112 precedes the secure communication with the surrounding user terminal 50 via Bluetooth or RFID, and then the corresponding user terminal 50 accesses the authentication server 20 or the service server 30 to perform data communication.

Accordingly, the multi-biometrics device 40 includes the short-range communication module 112, and indirectly transmits / receives various information to / from the authentication server 20 or the service server 30 through the separate user terminal 50 It becomes possible.

The user terminal 50 may be connected to the communication network 10 by wire or wirelessly. For example, the user terminal 50 is connected to the communication network 10 and performs data communication with the authentication server 20 or the service server 30 So that various authentication related information such as the authentication status and the status can be transmitted and received so that the user can confirm it.

Such an example would be suitable for a multi-biometric device 40 dedicated to biometrics.

Particularly, in the present invention, the communication unit 100 of the multi-biometric device 40 comprises: It is preferable to be able to directly or indirectly connect to three or more base stations 11 located nearby to obtain location information including the ground level of the multiple biometric device 40. [

At this time, the multiple biometrics device 40 and the base station 11 can calculate the distance of the multiple biometrics device 40 from the base station 11 through mutual communication as shown in FIG. 3A.

3B, the multi-biometric device 40 accesses three or more base stations 11 located nearby to acquire time-of-arrival (ToA), time difference of arrival (TDoA), AoA by using it becomes possible to calculate the respective distances by _{R 1, R 2, R 3} , acquiring position information including a ground clearance for the multiple biometric devices (40).

In this case, the ground clearance means the height from the ground at the position where the multi-biometric device 40 exists. For example, the multi-biometric device 40 is located on the sixth floor of the building, It becomes possible to acquire positional information including the ground clearance.

The location information including the ground level of the multi-biometrics device 40 thus acquired may be transmitted to the authentication server 20 together with the public key or digital signature thereafter.

In this way, it is preferable that the multi-biometrics device 40 acquires the location information including the ground level in real time immediately before transmitting the public key or electronic signature to the authentication server 20. [

Next, the multiple biometric unit 200 of the multiple biometric device 40 recognizes two or more of various biometric information such as an ECG signal, fingerprint, iris, blood vessel, facial shape, voice, palm, It is possible.

At this time, the multi-body recognizer 200 recognizes a user's electrocardiogram (ECG) signal, a fingerprint or the like by placing a contact type recognition member in contact with the user's body, or a voice recognition member such as a microphone .

Similarly, by providing an optical recognition member such as a camera in the multi-biometrics recognition unit 200, it is possible to optically recognize biometrics information such as iris, blood vessel, face shape, palm, sweat glands and the like of the user.

That is, the means for recognizing the user's biometric information in the multi-biometric identification unit 200 is not limited.

Accordingly, the multi-biometric information detected by the multi-biometric recognizer 200 will be used by the controller 400 in the multi-biometric device 40 to generate the user's private key and public key pair.

Next, in the multi-biometric device 40, the secure medium 300 is configured as a TPM or a UICC capable of storing a private key among a pair of a private key and a public key generated based on the multiple biometrics.

The Trusted Platform Module (TPM) is designed to solve these problems because it is vulnerable to a variety of security attacks. Therefore, TCG (Trusted Computing Group) Means a standard specification of a security chip that provides a strong level of security environment by operating only within a security chip manufactured by hardware.

UICC 130 is a universal integrated circuit card that is a key component of a Universal Mobile Telecommunications System (UMTS), such as a Subscriber Information Module (SIM) of Global System for Mobile Communications (GSM) It means expanded.

Accordingly, the UICC 130 may be basically used to provide various services such as authentication and security functions while performing the function of the secure medium 300.

Accordingly, in the present invention, the private key generated through multiple biometrics recognition is stored in the secure medium 300.

Next, in the multi-biometric device 40, the control unit 400 is connected to the communication unit 100, the multiple biometric unit 200, and the secure medium 300, respectively, and controls them collectively.

In particular, the control unit 400 generates a private key and a public key pair through two or more multiple biometric authentication in the multi-biometric unit 200, and stores the generated private key in the secure medium 300 Meanwhile, the generated public key may be transmitted to the authentication server 20 to perform authentication registration through multiple biometrics.

In addition, when requesting the authentication of the user from the service server 30, not only the access authority to the private key stored in the security medium 300 described above can be obtained through the multiple biometrics, So that the user can be authenticated through authentication.

Here, the controller 400 determines whether a false acceptance rate (FAR) or a false rejection rate (FRR), which is a criterion used for comparing the matching accuracy at the time of biometric authentication, It would be desirable to be able to arbitrarily adjust.

Also, the control unit 400 may control the authentication server 20 to transmit the location information including the ground level of the multi-biometrics device 40 acquired as described above to the authentication server 20 together with the public key or digital signature.

In addition, the control unit 400 may receive the authentication result generated by the authentication server 20 by the communication unit 100, and may control the authentication server 20 to transmit the authentication result to the service server 30 again.

Of course, the multi-biometric device 40 may further include the input / output unit 500, the biometric authentication unit 200, the security medium 300, and the control unit 400 in addition to the communication unit 100, A memory 600 for storing various kinds of information on its own, and a battery 700 for supplying power to the above-described components.

Here, the input / output unit 500 is a configuration used by a user to operate the multiple biometric device 40 or to inform the user of various types of information.

In the input / output unit 500, the input device may include a touch panel such as a pressure type or an electrostatic type, or a button or a panel that can be operated by a user in a non-contact manner within a predetermined distance.

In the input / output unit 500, an output device may include a speaker for outputting sound, a motor for generating vibration, and the like. Most preferably, a display panel capable of expressing characters, shapes, It is also possible to apply the LED light emitting element in consideration of power consumption and the like.

Next, as shown in FIG. 4, the authentication method using multiple biometrics according to the present invention comprises: The multiple biometric device 40 generates a private key and a public key pair through multiple biometrics and transmits the generated public key to the authentication server 20 so that the authentication server 20 registers the public key S10); An authentication step in which the multiple biometric device 40 accesses the private key through multiple biometric authentication in accordance with the authentication request and performs digital signature and transmits the digital signature to the authentication server 20 to authenticate the authentication server 20 S30).

Herein, the registration step S10 is a step of registering the legacy authentication and the public key registration in accordance with the change of the authentication means, as shown in Figs. 4 and 5A and 6A, A registration policy transmission step S12 for transmitting the registration policy to the multiple biometric device 40 and the multiple biometric device 40 for requesting the registration request from the server 20, A key generation step S13 for generating a private key and a public key pair through multi-biometry, a step of storing the generated private key in the secure medium 300, A registration result transmission step (S15) of registering the public key received by the authentication server (20) and transmitting the registration result to the multiple biometric device (40) As shown in FIG.

The authentication step S30 is a step in which the multiple biometric device 40 is authenticated by the authentication server 40 in accordance with the authentication request of the service server 30 as shown in Figs. 4 and 5B and 6B A transaction information transmitting step (S32) in which the authentication server (20) transmits the transaction information to the multiple biometric device (40), the multiple biometric device (40) An electronic signature step (S33) for accessing the private key through the multiple biometrics to perform an electronic signature; an electronic signature transmitting step (S34) for the multi-biometrics device (40) to transmit the electronic signature to the authentication server (20) And an authentication result transmission step (S35) of authenticating the digital signature by the authentication server (20) and transmitting the authentication result to the multiple biometric device (40).

In addition, as shown in FIG. 4, before the authentication step (S30), an authentication requesting step (S20) of requesting the service server (30) to authenticate the multiple biometric device (40); After the authentication step (S30), an authentication result transmission step (S40) in which the multiple biometric device (40) transmits the authentication result to the service server (30); It is also possible that the verification step (S50) for verifying the authentication result received by the service server 30 through the authentication server 20 is additionally constituted.

That is, as shown in FIG. 4, the authentication method using multiple biometrics of the present invention essentially includes a registration step (S10) and an authentication step (S30).

At this time, the registration step S10 is subdivided into a registration request step S11, a registration policy transmission step S12, a key generation step S13, a public key transmission step S14, and a registration result transmission step S15 You can do it.

The authentication step S30 is further divided into an authentication request step S31, a transaction information transmission step S32, an electronic signature step S33, an electronic signature transmission step S34 and an authentication result transmission step S35 You can do it.

In addition, an authentication request step (S20) is included between the registration step (S10) and the authentication step (S30), and after the authentication step (S30), the authentication result transmission step (S40) and the verification step It is also possible to include more.

Hereinafter, the multi-biometrics authentication method according to the present invention will be described with reference to the drawings, together with the operation of the multi-biometrics authentication system of the present invention.

As shown in FIGS. 1 and 5, the multi-biometrics device 40 includes a long-range communication module 111 and performs well-known communication such as WCDMA, 3G, LTE / LTE-A or LTE- In the case of directly connecting to the communication network 10 by low-power M2M communication such as SigFox, LoRa and NB-IoT, the multi-biometric device 40 may be in the form of a smartphone or a tablet.

10 and 6, the multi-biometrics device 40 includes the short-range communication module 112 and can be connected to a smart phone, a tablet, a laptop, and a desktop using WiFi, RFID, Bluetooth, The multi-biometrics device 40 may be a dedicated device for multiple biometrics when indirectly connecting to the communication network 10 through a user terminal 50 such as a personal computer.

First, as shown in Figs. 4 and 5A and 6A, in the registration request step S11 in the registration step S10, the multi-biometrics authentication device 40, in accordance with the authentication means change, Authentication and public key registration to the authentication server 20.

Here, the authentication means change means to change the type of biometric information used for authentication of the user, such as ECG signals, fingerprints, irises, blood vessels, facial features, voice, palms and sweat glands of the user.

For example, in the past, ECG signals and fingerprints were used for authentication, but there may be a change in the authentication means by using a face shape and voice.

The legacy authentication means authenticating the multiple biometric device 40 actually used for authentication.

When the authentication server 20 receives a request for registration of the public key from the multiple biometric device 40, the authentication server 20 transmits the registration policy to the multiple biometric device 40 .

Here, the registration policy is for notifying the user of a series of policy matters related to the service provision related to the authentication of the authentication server 20.

The registration policy transmitted from the authentication server 20 to the multiple biometric device 40 will be displayed to the user through the output device of the multiple biometric device 40. [

When the user agrees with the registration policy, in the key generation step S13, the multiple biometric device 40 generates a private key and a public key pair through multiple biometric authentication.

Here, multiple biometrics may be implemented for two or more of the user's biometric information, such as ECG signals, fingerprints, irises, blood vessels, facial features, voice, palms, and sweat glands.

In the public key transmission step S14, when the private key and the public key pair are generated through the multiple biometric authentication, the multiple biometric device 40 stores the generated private key in the secure medium 300, And transmits the public key to the authentication server 20.

Thereafter, when the authentication server 20 receives the public key from the multiple biometric device 40, the registration result transmission step S15 registers the public key received by the authentication server 20 in the database, To the multi-biometric device 40 again.

As described above, in the authentication request step S20, the service server 30 provides various services to the user in the state that the user authentication is registered in the authentication server 20 through the registration step S10 The biometrics authentication apparatus 40 requests the multi-biometrics authentication apparatus 40 to authenticate itself.

In this authentication requesting step S20, the service server 30 requests the user to authenticate himself or herself in order to provide various services including e-commerce, banking, and securities transaction as well as personal information providing consent.

Accordingly, as shown in Figs. 4 and 5B and 6B, in the authentication request step S31 in the authentication step S30, in accordance with the authentication request of the service server 30 as described above, , And the multiple biometric device 40 requests the authentication server 20 for authentication.

When the authentication server 20 receives an authentication request from the multiple biometric device 40, the authentication server 20 transmits the transaction information to the multiple biometric device 40 in the transaction information transmission step S32.

When the multi-biometrics device 40 receives the transaction information from the authentication server 20, the multi-biometrics device 40 generates an ECG signal, a fingerprint, an iris, a blood vessel, a face shape , Biometrics information such as voice, palm, and sweat glands is registered using two or more biometrics information registered through the registration step (S10).

Through such multi-biometrics, it is possible to access the private key stored in the secure medium 300, thereby performing digital signature.

When the digital signature is performed, the multiple biometric device 40 transmits the digital signature to the authentication server 20 in the digital signature transmission step S34.

When the authentication server 20 receives the transmitted digital signature, the authentication server 20 authenticates the digital signature using the public key stored in the database in the authentication result transmission step S35, And sends the result back to the multiple biometric device 40. [

When the multi-biometric device 40 receives the authentication result from the authentication server 20, the multi-biometric device 40 transmits the authentication result to the service server 30 in the authentication result transmission step S40 as shown in FIG. .

When the service server 30 receives the authentication result from the multiple biometric device 40 and finally the verification step S50 verifies the authentication result received by the service server 30 through the authentication server 20 will be.

In addition, as shown in FIGS. 7 and 8A and 9A, in the public key transmission step S14 of the present invention, the multi-biometric device 40 transmits the ground-level information And transmits the acquired location information to the authentication server 20 together with the public key; In the registration result transmission step S15, the authentication server 20 registers location information including the ground level information together with the public key; As shown in Figs. 7 and 8 (b) and 9 (b), in the electronic signature transmission step (S34), the multiple biometrics device 40 acquires position information including the ground- To the authentication server (20) together with a digital signature; In the authentication result transmission step S35, it is preferable that the authentication server 20 confirms whether the location information including the ground clearance information together with the authentication for the electronic signature is registered in advance or within the copper line .

Here, the position information including the ground level of the multi-biometric device 40 is obtained by connecting to three or more base stations 11 located nearby by using ToA, TDoA, AoA or the like as described above with reference to Fig. 3 And the location information including the ground clearance for the multiple biometric device 40 thus obtained is used together with the authentication of the user.

In this case, as shown in Figs. 7 and 8 (a) and 9 (a), in the public key transmission step S14 of the registration step S10, The location information including the ground level information is acquired through the communication network 100, and the location information including the ground level information thus acquired is transmitted to the authentication server 20 together with the public key.

Accordingly, in the registration result transmission step S15, the authentication server 20 registers location information including the ground-level information together with the public key in the database.

Thereafter, as shown in FIGS. 7 and 8B and 9B, in the digital signature transmission step S34 of the authentication step S30, the multi-biometric device 40 transmits the digital signature And transmits the digital signature to the authentication server 20 together with the digital signature.

Accordingly, in the authentication result transmission step S35, the authentication server 20 verifies whether the location information including the ground clearance information together with the authentication for the electronic signature is registered in the pre-registered location information or the copper line, and performs authentication .

Here, the location information previously registered in the database of the authentication server 20 may be set by registering the user in advance in the authentication server 20 as described above, and may be registered in the database of the authentication server 20 in advance The moving line may be one in which the authentication server 20 repeatedly receives the location information including the ground level information transmitted from the multiple biometric device 40 and stores the location information by itself.

In this way, in the registration step S10, the location information including the ground clearance together with the public key is stored in the database of the authentication server 20 together with the location information including the ground clearance together with the digital signature in the authentication step (S30) It is also possible to verify whether or not the authentication is performed within a region or a line previously set so that the positional information of the multiple biometric device 40 in which the authentication is performed is permitted to be authenticated.

Therefore, in the present invention, by verifying the location information including the ground level for the multi-biometric device 40 performing the authentication together with the multi-biometric authentication, It may be possible to reject the requested authentication at the time of authentication, or to delay it while another user authentication or additional authentication is made.

The multi-biometrics authentication system and method of the present invention configured as described above have the following different advantages.

First, since the multi-biometric device 40 directly or indirectly connected to the communication network 10 authenticates itself through data communication with the authentication server 20 and the service server 30, the authentication is performed more quickly and easily. .

Second, in the multiple biometric device 40, authentication is performed using any two or more of biometric information such as an ECG signal, a fingerprint, an iris, a blood vessel, a face, a voice, a palm, Therefore, more accurate and reliable self-certification can be performed.

Third, in addition to the multi-biometrics, location information including the ground level of the multi-biometrics device 40 can be verified and it can be determined whether the authentication is performed within a preset permitted authentication area or a copper line, .

The above embodiment is an example for explaining the technical idea of the present invention specifically, and the scope of the present invention is not limited to the above-mentioned drawings or embodiments.

10: communication network 11: base station
20: authentication server 30: service server
40: Multiple biometric device 50: User terminal
100: communication unit 110: communication module
111: remote communication module 112: local communication module
200: multiple biometric unit 300: security medium
400: control unit 500: input /
600: memory 700: battery
S10: Registration step S11: Registration request step
S12: Registration policy transmission step S13: Key generation step
S14: Public key transmission step S15: Registration result transmission step
S20: Authentication request step S30: Authentication step
S31: Authentication request step S32: Transaction information transmission step
S33: Digital signature step S34: Digital signature transmission step
S35: Authentication result transmission step S40: Authentication result transmission step
S50: verification step

Claims (8)

An authentication server connected to a communication network and capable of registering location information including legacy authentication, public key and ground level information, repeatedly receiving location information including ground level information, storing a copper line, and verifying digital signatures;
A service server connected to the communication network and requesting authentication of the user to provide a service to the user;
A communication module including a communication module capable of directly or indirectly connecting to the communication network and capable of performing data communication with the authentication server and the service server, and a communication module including a communication module, such as an ECG signal, a fingerprint, an iris, A security medium such as a TPM or a UICC capable of storing the generated private key, and a security medium such as a personal computer based on two or more biometric information recognized by the multi- The method includes generating a key and a public key pair, storing the generated private key in the secure medium, transmitting the generated public key to the authentication server, And a controller for performing authentication of the user through digital signature using the corresponding private key, Comprising: a;
The communication unit of the multi-
Power M2M communication of either LTE-M, SigFox, LoRa or NB-IoT, which reduces power consumption by lowering the data transmission rate, frequency band, and the frequency of signal generation for transmission modem operation, A remote communication module,
Acquire positional information including the ground-level information of the multiple biometric device by connecting to three or more base stations located nearby;
The control unit of the multi-
The location information including the ground level information together with the generated public key can be transmitted to the authentication server,
A false acceptance rate (FAR) or a false rejection rate (FRR), which is a criterion used for comparing matching accuracy in biometrics, can be controlled through an algorithm. Authentication system. The mobile communication terminal of claim 1, further comprising: a user terminal such as a smart phone, a tablet, a laptop, or a desktop connected directly to the communication network by wired or wireless;
Wherein the communication unit of the multiple biometric device comprises:
And a local communication module such as WiFi, RFID, or Bluetooth for connecting to the user terminal based on secure communication and indirectly connecting to the communication network through the user terminal. . 11. An authentication method using the system of claim 2,
A registration step in which the multiple biometric device generates a private key and a public key pair through multiple biometric authentication, transmits the generated public key to the authentication server, and the authentication server registers the public key;
And an authentication step in which the multiple biometric device accesses the private key through multiple biometric authentication according to the authentication request to perform digital signature, and transmits the digital signature to the authentication server to authenticate the authentication server;
Wherein the registering step comprises:
A registration request step of requesting an authentication server for legacy authentication and public key registration in accordance with an authentication means change by the multiple biometric device;
A registration policy transmitting step of the authentication server transmitting the registration policy to the multiple biometric device;
A key generation step in which the multiple biometric device generates a private key and a public key pair through multiple biometric identification;
A public key transmission step of storing the private key generated by the multiple biometric identification device in a secure medium and acquiring positional information including the ground clearance information and transmitting the generated positional information together with the generated public key to the authentication server;
And a registration result transmitting step of registering location information and a public key including the ground level information received by the authentication server, repeatedly receiving location information including the ground level information, storing the copper line, and transmitting the registration result to the multiple biometric device ;
Wherein the authentication step comprises:
An authentication request step in which the multiple biometric device requests authentication to the authentication server according to the authentication request of the service server,
A transaction information transmitting step in which the authentication server transmits the transaction information to the multiple biometric device;
An electronic signature that accesses a private key through multiple biometric identifiers that compares the matching accuracy according to a false acceptance rate (FAR) or a false rejection rate (FRR) criterion by a multiple biometric device Step,
An electronic signature transmitting step of the multi-biometric device acquiring positional information including the ground level information and transmitting it to the authentication server together with the electronic signature;
And an authentication result transmitting step of authenticating the authentication server by verifying whether the location information including the ground and high-level information is included in the registered location information or the copper line together with the authentication of the digital signature, and transmitting the authentication result to the multiple biometric device Authentication method using multi - biometrics. 4. The method of claim 3, wherein before the authentication step,
An authentication request step of the service server requesting authentication of multiple biometric devices;
After the authentication step,
An authentication result delivery step in which the multiple biometric device transmits the authentication result to the service server;
And a verification step of verifying the authentication result received by the service server through the authentication server. delete delete delete delete

Images