KR101739098B1 - Certification system and method using electronic signature in plural terminals - Google Patents

Abstract

A system and method for identifying an identity using a digital signature in a plurality of terminals is disclosed. A method of authenticating a digital signature using an electronic signature performed by an electronic signature authentication server according to an exemplary embodiment of the present invention includes the steps of (a) receiving an electronic signature request including an input digital signature and terminal identification information from a user terminal Receiving; (b) checking whether the user terminal is a main terminal or a standby terminal through the terminal identification information; And (c) if the user terminal is the main terminal, checking whether the user is authentic according to a result of comparing an input digital signature included in the identity verification request with a digital signature registered in advance in the digital signature authentication server, Wherein the user authentication request further includes an input password when the user terminal is a standby terminal, and wherein the step (c) includes the step of, when the user terminal is a standby terminal, And comparing the registered digital signatures stored in the digital signature authentication server with the registered password stored in the digital signature authentication server.

Description

Technical Field [0001] The present invention relates to a system and method for identifying an individual using a handwritten signature in a plurality of terminals,

The present invention relates to a system and method for identifying a user using a digital signature that is signed by a user in a plurality of terminals. Here, the digital signature may be referred to herein as a handwritten signature, as described below.

Fingerprint recognition is an authentication method that extracts different fingerprint information for each person and informs them. Fingerprint recognition is a method of recognizing facial features by analyzing the symmetrical composition of the face, face, hair color, eye color, , And iris recognition is a technique of recognizing a person by using iris information of the eye having a characteristic unique to each person and vein recognition is a recognition technique of identifying the identity by using a blood vessel pattern such as palm, .

Biometrics is a technology that identifies the identity of a body part, such as fingerprint, face, iris, and fingerprint. This technology is called biometrics technology, and includes voices, handwriting, body shape, gait, It is the object of technology.

Biometrics is used in a wide range of fields from automotive, telecommunications, security and medical care to corporate marketing and the public sector, but its utilization in the financial industry is relatively low.

In recent years, various problems related to the public certificate and Active-X have been raised in the domestic market, and there is a growing interest in utilization of the biometrics technology centering on financial commerce.

However, the biometrics technology has a problem that duplication is possible, the system configuration is complicated, and an excessive cost is incurred. In addition, there are problems such as leakage of personal information, possibility of application to crime, possibility of human rights violation, and there is a problem that it is impossible to reset the information leakage.

Korean Patent Publication No. 10-2005-0041132 (public date May 4, 2005) - System and method for identification using biometric information

In the present invention, even if the main terminal registers only the electronic signature and the standby terminal registers both the electronic signature and the password, even if the main terminal can not be used due to loss or malfunction, it is possible to confirm the identity through the standby terminal, And to provide a system and method for identifying an identity using a digital signature at a terminal.

The present invention relates to a method and apparatus for verifying a user's identity by using an electronic signature and various signatures can be registered according to the use of the electronic signature to thereby enable electronic signatures in a plurality of terminals capable of replacing biometric information recognition, which is advantageous for financial transaction and security, And to provide a system and method for identifying a used identity.

Other objects of the present invention will become more apparent through the following preferred embodiments.

According to an aspect of the present invention, there is provided a method for authenticating a person using an electronic signature performed by an electronic signature authentication server, the method comprising: (a) receiving an identity verification request including an input digital signature and terminal identification information from a user terminal Receiving; (b) checking whether the user terminal is a main terminal or a standby terminal through the terminal identification information; And (c) if the user terminal is the main terminal, checking whether the user is authentic according to a result of comparing an input digital signature included in the identity verification request with a digital signature registered in advance in the digital signature authentication server, Wherein the user authentication request further includes an input password when the user terminal is a standby terminal, and wherein the step (c) includes the step of, when the user terminal is a standby terminal, Authenticating the user based on a result of comparing the registered digital signature stored in the electronic signature database and a result of comparing the input password with the registration password previously stored in the digital signature authentication server, .

Wherein the step (c) further comprises the step of determining at least one of a signature flow, a shape, a contact count and a connection position, an acceleration / velocity, a horizontal size, a vertical size, a ratio, a slope, As a comparison item, the similarity can be judged by comparing them independently by the parallel processing method.

According to another aspect of the present invention, there is provided an identity verification method using an electronic signature performed by an electronic signature authentication server, the method comprising: (a) receiving an identity verification request including an electronic signature and terminal identification information in the digital signature authentication server ; (b) analyzing the terminal identification information and confirming the type of the identity verification request terminal; (c) if the identity verification requesting terminal is a provisional terminal, checking the current state of the main terminal; And (d) if the main terminal is at a designated position, determining that the standby terminal is simply used and performing identity verification using only the digital signature included in the identity verification request, / RTI >

In the step (d), if the main terminal is not at the designated position, it may be determined that an error has occurred in the main terminal and the main terminal may be discarded to the main terminal.

(d2) switching the status of the identity verification requesting terminal to the main terminal.

The step (d2) may be performed only when the password request is requested to the identity verification requesting terminal and the inputted password matches the password previously stored in the digital signature authentication server.

According to another aspect of the present invention, there is provided an electronic signature authentication server for receiving and registering main terminal identification information, reserve terminal identification information, and a registered digital signature from a user; And a plurality of terminals requesting identity verification while transmitting the digital signature input from the user to the digital signature authentication server, wherein one of the plurality of terminals is designated as a main terminal and the rest is designated as a standby terminal, The digital signature authentication server compares the digital signature included in the identity verification request with the registered digital signature to authenticate the identity of the user.

The preliminary terminal receives a password in addition to a digital signature at the time of requesting the identity verification, and transmits the digital signature to the digital signature authentication server. The digital signature authentication server transmits the digital signature to the digital signature authentication server, The result of the comparison between the password included in the identity verification request and the registration password can also be used to authenticate the identity of the user.

The digital signature authentication server determines whether or not the digital signature and the registered digital signature included in the identity verification request include at least one of a line flow, a shape, a contact count and a connection position, an acceleration / speed, a horizontal size, a vertical size, And an authentication unit that compares one or more signature attributes among the coordinates as a comparison item and compares them independently in a parallel processing manner to determine similarity.

Other aspects, features, and advantages will become apparent from the following drawings, claims, and detailed description of the invention.

According to the present invention, even if the main terminal registers only the digital signature and the standby terminal registers the digital signature and the password together, even if the main terminal can not be used due to loss, malfunction, etc., There is an increased effect.

In addition, by performing the identity verification using the digital signature, it is possible to register various signatures according to the use, which is advantageous for financial transactions and security, and can be substituted for the biometric information recognition which can not be reset at the time of information leakage.

Brief Description of the Drawings Fig. 1 is a diagram illustrating a configuration of a personal identification system using digital signatures in a plurality of terminals according to an embodiment of the present invention; Fig.
2 is a diagram illustrating a process of registering an electronic signature and a terminal,
FIG. 3 is a flow chart of a personal identification method performed in a personal identification system according to an exemplary embodiment of the present invention;
FIG. 4 is a flow chart of a method of identifying an identity performed in the identity verification system according to another embodiment of the present invention; FIG.
5 is a diagram illustrating a configuration of comparison modules included in an authentication unit of an electronic signature authentication server,
6 is a diagram showing an example of a comparison item and a determination result;

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It is to be understood, however, that the invention is not to be limited to the specific embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The terms first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, the terms "comprises" or "having" and the like refer to the presence of stated features, integers, steps, operations, elements, components, or combinations thereof, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

It is to be understood that the components of the embodiments described with reference to the drawings are not limited to the embodiments and may be embodied in other embodiments without departing from the spirit of the invention. It is to be understood that although the description is omitted, multiple embodiments may be implemented again in one integrated embodiment.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Reference will now be made in detail to the preferred embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like reference numerals refer to the like elements throughout. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail.

FIG. 1 is a diagram illustrating a configuration of an identity verification system using a digital signature in a plurality of terminals according to an exemplary embodiment of the present invention. FIG. 2 is a diagram illustrating a process of registering an electronic signature and a terminal.

In the multiple-terminal verification system according to the embodiment of the present invention, the main terminal can perform authentication using only the digital signature and the standby terminal can perform double authentication using the encryption in addition to the digital signature, Even if it can not be used due to loss, malfunction or the like, it is possible to confirm the identity of the user through the reserve terminal, and to enhance the security.

The identity verification system according to the present embodiment is a system for verifying identity by utilizing an electronic signature as identity verification information that can replace biometric information, and can be utilized in fields of access, security, authentication, payment, and the like.

Referring to FIG. 1, the identity verification system according to the present embodiment includes an electronic signature authentication server 100, a main terminal 200, and a standby terminal 300. In the figure, one spare terminal 300 is shown, but this is merely an example, and it goes without saying that there may be two or more spare terminals.

The digital signature authentication server 100 receives and registers a digital signature for authentication from a user and then compares the digital signature with a registered digital signature when the digital signature is input through the terminal (the main terminal 200 or the standby terminal 300) And performs authentication according to the degree of similarity.

The main terminal 200 is a terminal capable of confirming the identity of the user to achieve a predetermined purpose (for example, entry or exit to a designated place, login to a website, financial transaction (including payment), etc.) to be. A terminal to be mainly used among a plurality of terminals accessible by the user can be designated as the main terminal 200. [

The backup terminal 300 is a terminal designated by the user so as to be able to confirm the identity of the user in order to achieve the above-mentioned predetermined purpose through digital signature in preparation for an emergency such as loss or failure of the main terminal 200. [

In this embodiment, the main terminal 200 may be a mobile communication terminal owned by the user, and the standby terminal 300 may be a tablet PC owned by a user or a mobile communication terminal owned by an acquaintance.

The main terminal 200 includes a first service application driver 210, a first user input unit 220, and a first authentication information transmission unit 230.

The first service application driver 210 drives an application related to the digital signature authentication service to achieve a predetermined purpose through digital signature.

The first user input unit 220 is a touch screen provided in the main terminal 200, and receives an electronic signature for identifying the user from the user. In the sense that the aforementioned digital signature is input by the user for identity verification using the first user input unit 220 which is a touch screen and / or the second user input unit 320 to be described later, have.

The first authentication information transmission unit 230 transmits the digital signature input through the first user input unit 220 to the digital signature authentication server 100 together with the terminal identification information after the first service application driver 210 is executed And ask for identification.

The backup terminal 300 includes a second service application driver 310, a second user input unit 320, and a second authentication information transmission unit 330.

The second service application driver 310 drives an application related to the digital signature authentication service to achieve a predetermined purpose through digital signature.

The second user input unit 320 is a touch screen provided in the standby terminal 300, and receives an electronic signature for identifying the user from the user. Also, the second user input unit 320 may further receive a password from the user.

The second authentication information transmitting unit 330 may transmit the digital signature inputted through the second user input unit 320 after the second service application driver 310 is executed Together with the terminal identification information, to the digital signature authentication server 100 to request identity verification.

Here, the input of the password may be performed together with the digital signature or after a request from the digital signature authentication server 100 after the identity verification request is made.

The digital signature authentication server 100 includes a terminal registration unit 110, an electronic signature registration unit 120, an encryption registration unit 130, and an authentication unit 140.

It is assumed that the user who registers the terminal to be used with the digital signature basically subscribes to the digital signature authentication service provided by the digital signature authentication server 100 (step S400).

The terminal registration unit 110 registers information on a terminal to be used by a user in performing identity verification using a digital signature (step S410). The user registers the standby terminal 300 to be used in a special case (abnormal situation) such as when the main terminal 200 and the main terminal 200 to be mainly used are lost or broken down.

In the terminal registration unit 110, for example, terminal identification information of at least one of a terminal telephone number and a terminal ID may be registered in association with user information.

The electronic signature registration unit 120 registers the electronic signature to be used by the user (step S405). The digital signature is a signature of the user input through the touch screen provided on the screen of the terminal (main terminal 200 or standby terminal 300).

The electronic signature registration unit 120 notifies the electronic signature registration unit 120 of the shape of the digital signature itself as well as the flow of the line, the shape of the line, the number of contact and / or the contact position, the acceleration, Data relating to signature attributes such as slope, touch pressure, line thickness, etc., can also be registered together.

The password registration unit 130 registers a password to be used by the user (step S415). A password can be made up of a combination of one or more of letters, numbers, and symbols. The password may be utilized as a double authentication means for authenticating the identity together with the digital signature when the reserve terminal 300 is to be used.

When the user inputs a digital signature using a terminal for a predetermined purpose (for example, entrance or exit to a specified place, login to a web site, financial transaction (including payment), etc.) It judges whether or not the signature matches the registered digital signature registered in advance or is similar to a predetermined reference value or more and confirms whether or not the signature is registered. Here, the determination of the degree of similarity between the input digital signature and the registered digital signature will be described later with reference to related drawings.

The authentication unit 140 may include or exclude the password as an additional comparison item according to the type of the terminal identified through the terminal identification information transmitted together with the digital signature.

For example, in the case where identity verification is requested through the main terminal 200, it can be confirmed whether or not the identity of the user is promptly confirmed through the matching of the digital signature. However, in the case where identity verification is requested through the backup terminal 300, it is possible to strengthen the confirmation process of identity by double checking by comparing whether or not the password registered separately in addition to the digital signature is strengthened for security enhancement.

Or the standby terminal 300, it is possible to check the status of the main terminal 200, compare only the electronic signature or compare the electronic signature with the password according to the result.

Hereinafter, a method of performing identity verification using a digital signature at a plurality of terminals will be described with reference to the drawings.

FIG. 3 is a flowchart of a personal identification method performed in the personal identification system according to an exemplary embodiment of the present invention.

The user starts the service application (application) through the terminal (step S500). Here, it is assumed that the user is a subscriber who subscribes to the digital signature identity verification service and registers the terminal to use it together with the digital signature.

After the service application is activated, the service application confirms the terminal type designated by the user for the current terminal (step S505). The terminal type designated by the user includes a main terminal which the user mainly uses the identity verification through digital signature and a spare terminal which will be used in an emergency such as loss or failure of the main terminal.

In the case of the main terminal, the digital signature is input through the first user input unit 220 provided in the terminal (step S510). The input digital signature may be transmitted to the digital signature authentication server 100 together with the terminal identification information by the first authentication information transmission unit 230 together with the identity verification request as the first authentication information.

The digital signature authentication server 100 checks whether or not the input digital signature included in the identity verification request transmitted from the terminal matches the registered digital signature stored in advance (step S515). If the digital signature has similarity with a predetermined reference value or more, It is determined that the signature has been digitally signed by the user (step S520). However, if it is determined that the input digital signature is not similar to the registered digital signature, it is regarded that the digital signature is not signed by the user and the authentication is regarded as unsuccessful.

In the case of the standby terminal, the digital signature is input through the second user input unit 320 provided in the terminal (step S530). If the password is also registered in the spare terminal, the password can be input as well. The input digital signature and the password can be transmitted to the digital signature authentication server 100 together with the terminal identification information by the second authentication information transmission unit 330 together with the identification confirmation as the second authentication information.

The digital signature authentication server 100 checks whether the input digital signature and the input password included in the second authentication information match with the registered digital signature and the registration password stored in advance in the digital signature authentication server 100 S535). If the digital signature has a similarity with a predetermined reference value or more and the passwords match, the authentication succeeds by the digital signature of the principal (step S540). However, if the electronic signature is judged not to be similar or if the password does not match, it is regarded that the authentication is unsuccessful by considering that the user has not digitally signed.

FIG. 4 is a flow chart of a method of identifying an identity performed in the identity verification system according to another embodiment of the present invention.

In the present embodiment, when a digital signature is input from the reserve terminal, it is determined whether the reserve terminal is regarded as being simply used according to the state of the main terminal or whether the terminal type is changed to the main terminal and the designated main terminal is to be discarded.

Upon receipt of the identity verification request, the digital signature authentication server 100 analyzes the terminal identification information included in the identity verification request and confirms the identity verification request terminal (step S600).

If the identity verification requesting terminal is the provisional terminal, the state (e.g., location) of the current main terminal is confirmed (step S605). Here, it is assumed that the main terminal 200 is provided with a position confirmation module (e.g., a GPS module) capable of confirming its position.

If the location of the main terminal is in a designated location (home, company, frequent place, etc. where the user is registered as a place where the main terminal is mainly used), it is determined that the main terminal is simply used for the standby terminal (step S610). That is, it is more advantageous that the user does not lose the main terminal or the main terminal malfunctions but uses the current standby terminal, so that it can be seen that the standby terminal is simply used. When it is judged that the backup terminal is simply used, it is possible to confirm the identity of the user by only digital signature without additionally checking the password.

However, if the location of the main terminal is not the designated location, it is possible to discard the status of the main terminal with respect to the main terminal (step S615). As the status of the main terminal is discarded, the main terminal may be downgraded to the standby terminal and may be additionally required to input a password, or the status as a terminal related to the digital signature may be completely discarded and may not function as a standby terminal. This is to prevent misuse of the main terminal by a third party who has learned the lost terminal.

Then, the standby terminal that has sent the current identity confirmation request can be switched to the main terminal. In this case, it is possible to input the password through the reserve terminal, and to change the status to the main terminal only when a normal password is input.

According to this, even in the case where the main terminal is lost or the main terminal is broken, the identity can be verified through the reserve terminal preliminarily specified, and switching to the main terminal is also possible, thereby improving user convenience.

FIG. 5 is a diagram illustrating a configuration of comparison modules included in an authentication unit of an electronic signature authentication server, and FIG. 6 is a diagram showing an example of a comparison item and a determination result.

The authentication unit 140 of the digital signature authentication server described above compares the input digital signature and the registered digital signature to determine the degree of similarity.

The authentication unit 140 includes a flow comparison module 710, a shape comparison module 720, and a comparison module 730. The flow comparison module 710 determines whether the input digital signature and the registered digital signature are similar to each other, A contact comparison module 730, an acceleration / speed comparison module 740, a horizontal size comparison module 750, a vertical size comparison module 760, a ratio comparison module 770, a slope comparison module 780, (790), and a coordinate comparison module (800).

The authentication unit 140 may add the comparison item according to the development of the hardware and software in order to minimize the error rate of the signature comparison.

The flow comparison module 710 sees the direction of movement of the touch means as a flow of lines contained in the signature when a signature is input and compares the similarity of the flow with respect to the registered electronic signature and the input digital signature.

The shape comparison module 720 segments the input signature into strokes, sees the movement distance of the stroke at the end of the stroke as a line shape, and compares the similarity of shape with respect to the registered electronic signature and the input digital signature.

The contact comparison module 730 may compare the similarity with information about the number of times and / or the position at which the touch means contacts the touch screen of the terminal while the signature is being input. For example, the number of times the touching means touches (or the number of times of falling from the screen) and the position of contact (coordinates) during the signature are included as the contact information.

The acceleration / speed comparison module 740 refers to the instantaneous movement speed of the touching means as speed information (acceleration or speed) for a predetermined time interval when a signature is input, .

The horizontal size comparison module 750 compares the similarity of the horizontal size among the entire images of each signature with respect to the registered electronic signature and the input digital signature.

The vertical size comparison module 760 compares the vertical size similarity among the entire images of each signature with respect to the registered electronic signature and the input digital signature.

The ratio comparison module 770 compares the similarity of the registered electronic signature and the input digital signature with respect to the ratio of the horizontal and vertical length of the entire image of each signature.

The slope comparison module 780 views the degree of inclination of the signature input unit 110 when inputting a signature as a device slope, and compares the slope with respect to the registered digital signature and the input digital signature.

The pressure comparison module 790 compares the measured touch pressure of the user during the input of the signature at the signature input unit 110 with respect to the registered electronic signature and the input electronic signature at the time of inputting the signature. In this case, the touch pressure may be replaced by the thickness of the line for the signature.

The coordinate comparison module 800 compares the error value of the positional information of the coordinate according to the flow of the line when the signature is input.

Each comparison module makes a pass (PASS) or a non-pass (PASS) decision whether or not the comparison item exceeds a preset similarity level.

The level of similarity may be set the same for each comparison module or may be set differently for each comparison module. For example, the similarity level for each comparison item is set to be equal to 30% in FIG. 3 (a), but this is only one embodiment, and the degree of similarity can be changed together or independently as needed . For example, in order to increase the reliability of identity verification, the level of similarity of individual comparison items may be set high.

The comparison modules operate independently of each other, and the comparison result in any one module does not affect other comparison modules.

The authenticating unit 140 determines authenticity of the signature based on the result of the similarity determination for each comparison item (signature attribute) determined in each comparison module. According to the determination result, whether or not the user who has performed the signature can be determined.

The similarity determination result of the comparison item can be used in parallel when determining whether the signature is true or false. For example, most comparator modules have high similarity. However, when a comparison module has a low similarity lower than that of a comparator module, it may be regarded as having similarity when it is averaged. However, It is determined that they are different from each other based on the parallel processing technique.

For example, as shown in FIG. 3 (b), when a pass determination is made for all comparison items, the authenticity determining unit 130 determines that the input digital signature is the same as the registered digital signature, . In this case, the user who performed the signature will be verified as correct.

3 (c), when the non-pass determination is made with respect to some comparison items (the "line shape" item in FIG. 3C), the authentication unit 140 determines that the input digital signature is registered electronic It can be determined that the signature is different from the signature and is not a signature by the true user. In this case, the user who performed the signature will be considered to be not himself.

In determining whether the signature is true or false, only a part of the plurality of comparison modules may be selectively activated and applied. In this case, it is judged that the signature is true only when the pass judgment is made for all the comparison items corresponding to the selected comparison module, and if the non-pass judgment is made even for one item, the signature fails to be authenticated .

According to this embodiment, it is impossible to satisfy the degree of similarity for all of the subdivided comparison items in the process of mimicking the signature by the other person, so that it can have high reliability.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention as defined in the appended claims. It will be understood that the invention may be varied and varied without departing from the scope of the invention.

100: Digital signature authentication server 110:
120: digital signature registration unit 130:
140: authentication unit 200: main terminal
210: first service application driver 220: first user input unit
230: first authentication information transmission unit 300:
310: second service application driver 320: second user input unit
330; The second authentication information transmission unit

Claims (9)

delete delete An identity verification method using an electronic signature performed by an electronic signature authentication server,
(a) receiving an identity verification request including an electronic signature and terminal identification information in the digital signature authentication server;
(b) analyzing the terminal identification information and confirming the type of the identity verification request terminal;
(c) if the identity verification requesting terminal is a provisional terminal, checking the current state of the main terminal; And
(d) if the main terminal is at a designated position, determining that the standby terminal is simply used, and performing identity verification using only the digital signature included in the principal authentication request,
In the step (d)
(d1) determining that an error has occurred in the main terminal if the main terminal is not in the designated position, and discarding the main terminal status with respect to the main terminal. .
delete The method of claim 3,
(d2) changing the status of the identity verification requesting terminal to the main terminal.
6. The method of claim 5,
Wherein the step (d2) is performed only when the input of the password is requested to the identity verification requesting terminal and the inputted password matches the password previously stored in the digital signature authentication server .
delete delete delete

Images