TWM673907U - Identity Verification Information System - Google Patents

Abstract

An identity verification information system includes a client device and a server device. The client device receives identity information input by a specific user and activates an application. The client device transmits device identification data to the server device, which then performs a device verification process. If the device verification process passes, the client device activates a biometric feature acquisition unit via the application and generates biometric feature collection data. The client device then performs a biometric feature verification process. If the result of the biometric authentication process is passed, the client device reads the authentication private key data and sends an authentication request including the identity identification information and the authentication private key data to the server device to perform an authentication process.

Description

Identity Verification Information System

This novel invention relates to an information system, in particular to an identity verification information system.

Currently, users typically authenticate their identities by entering their account name and password when logging into various websites. However, if a user's account name and password are accidentally leaked or stolen, their account could be hijacked, causing significant inconvenience. Furthermore, when users set up account names and passwords on multiple websites, they often become confused or forgetful, resulting in login issues.

Therefore, one of the objectives of this invention is to provide an identity verification information system that can solve the aforementioned problems.

Therefore, in some embodiments, the novel identity authentication information system includes a client device and a server device. The client device includes a processing unit, a storage unit, and a biometric acquisition unit. The storage unit is electrically connected to the processing unit and has an application installed therein. The storage unit stores biometric storage data, identity authentication private key data, and device identification data corresponding to the client device. The biometric storage data contains biometric information corresponding to a specific user, and the identity authentication private key data is generated based on the identity identification information of the specific user. The biometric acquisition unit is electrically connected to the processing unit and is used to generate biometric collection data. The server device is capable of connecting and communicating with the client device and storing multiple account data, multiple device identification and verification data, and multiple identity verification public key data. Each account data has identity identification information corresponding to a user, each device identification and verification data corresponds to the device identification data of a client device of a user, and each identity verification public key data is generated based on the identity identification information of a user using a predetermined algorithm and a corresponding identity verification private key data. The client device receives the identity identification information input by the specific user and receives an identity verification command to activate the application. The client device, through the application, initiates a process that transmits the device identification data to the server device. The server device then performs a device verification process by comparing the device identification data with the device identification verification data. If the device verification process passes, the client device, through the application, activates the biometric acquisition unit, which generates biometric data corresponding to the specific user. The client device then compares the biometric data with the biometric information in the stored biometric data to determine if it matches, thereby performing a biometric verification process. If the biometric authentication process is successful, the client device reads the authentication private key data and sends an authentication request including the identification information and the authentication private key data to the server device. The server device then performs an authentication process based on a comparison of the identification information with the account information and a verification analysis of the authentication private key data and the authentication public key data.

In some implementations, the biometric authentication procedure and the identity authentication procedure are performed in accordance with the FIDO standard.

In some embodiments, the biometric information corresponds to at least one of face, iris, fingerprint, palm print, palm shape, and voice print.

In some embodiments, the storage unit of the client device further includes a web browser. The identity information received by the client device is input into the web browser by the specific user, and the authentication command is issued by the specific user through an operation on the web browser. After the authentication process is completed, the server device transmits an authentication result to the client device. If the authentication result is successful, the web browser performs a website login process based on the identity information.

In some embodiments, the storage unit of the client device further stores at least one piece of personal identification code data. If the device verification process fails, the client device can receive a piece of identification code data to be verified and perform a corresponding identification code verification process based on a comparison between the piece of identification code data to be verified and the personal identification code data. If the result of the identification code verification process is a pass, the identity verification process is performed.

Another object of the present invention is to provide an identity verification information system. The identity verification information system includes a client device, a server device, and a terminal device. The client device includes a processing unit, a storage unit, a biometric feature acquisition unit, and a camera unit. The storage unit is electrically connected to the processing unit and has an application installed therein. The storage unit stores biometric feature storage data, identity verification private key data, and device identification data corresponding to the client device. The biometric feature storage data contains biometric information corresponding to a specific user, and the identity verification private key data is generated based on the identity identification information of the specific user. The biometric acquisition unit is electrically connected to the processing unit and is used to generate biometric collection data. The imaging unit is electrically connected to the processing unit and is used to generate image data. The server device is capable of communicating with the client device and storing multiple account data, multiple device identification and verification data, and multiple identity verification public key data. Each account data has identity identification information corresponding to a user, each device identification and verification data corresponds to the device identification data of a client device of a user, and each identity verification public key data is generated based on the identity identification information of a user through a predetermined algorithm together with a corresponding identity verification private key data. The terminal device is capable of connecting and communicating with the server device and/or the client device, and includes a computing unit, a memory unit, and a display unit. The memory unit is electrically connected to the computing unit and is installed with a web browser. The display unit is electrically connected to the computing unit and is used to display a screen. The terminal device runs the web browser and receives identity identification information input into the web browser by the specific user. The terminal device receives an identity verification command, and the display unit displays a screen including a verification barcode data, wherein the verification barcode data includes a message corresponding to the identity identification information. The client device runs the application, which initiates a process that transmits the device identification data to the server device. The server device then performs a device verification process by comparing the device identification data with the device identification verification data. If the device verification process passes, the camera unit of the client device generates image data containing the verification barcode data. The processing unit analyzes the image data to obtain the identity information. The client device activates the biometric acquisition unit through the application, which generates biometric data corresponding to the specific user. The client device compares the biometric information in the collected biometric data with the biometric information in the stored biometric data to determine if they match, thereby performing a biometric verification process. If the biometric verification process passes, the client device reads the authentication private key data and transmits an authentication request including the identification information and the authentication private key data to the server device. The server device then performs an authentication process based on a comparison of the identification information with the account data and a verification analysis of the authentication private key data with the authentication public key data.

In some implementations, the biometric authentication procedure and the identity authentication procedure are performed in accordance with the FIDO standard.

In some embodiments, the biometric information corresponds to at least one of face, iris, fingerprint, palm print, palm shape, and voice print.

In some implementations, after the authentication process is completed, the server device transmits an authentication result to the terminal device. If the authentication result is successful, the web browser performs a website login process based on the identity identification information.

In some embodiments, the storage unit of the client device further stores at least one piece of personal identification code data. After the client device obtains the identity information, if the biometric verification process fails, the client device can receive a piece of pending identification code data and, based on a comparison between the pending identification code data and the personal identification code data, perform a corresponding identification code verification process. If the identification code verification process passes, the identity verification process is performed.

This novel system has at least the following benefits: When performing the identity verification process, the identity verification information system uses the biometric verification process or personal identification code verification process to identify whether the specific user is personally operating the client device and/or the terminal device, provided that the application is running on the client device and the device verification process is passed. This allows the identity verification process to be completed even without entering any verification password, thereby improving the efficiency, convenience, and security of the overall process.

100: Identity Verification Information System

1: Client device

11: Processing unit

12: Storage unit

13: Biological Characteristic Acquisition Unit

14: Camera unit

2: Server equipment

3: Terminal device

31: Arithmetic Unit

32: Memory unit

33: Display unit

S01~S06, S11~S18: Steps

Other features and functions of the present invention will be clearly presented in the embodiments with reference to the accompanying drawings, wherein: Figure 1 is a system diagram illustrating a first embodiment of the present invention's identity verification information system; Figure 2 is an operational flow chart of the first embodiment; Figure 3 is a system diagram illustrating a second embodiment of the present invention's identity verification information system; and Figure 4 is an operational flow chart of the second embodiment.

Before the present invention is described in detail, it should be noted that similar components are represented by the same reference numerals in the following description.

Referring to Figures 1 and 2 , a first embodiment of the novel identity verification information system 100 is shown. The identity verification information system 100 can be used to perform identity verification procedures, such as those required when logging into a website account, and includes a client device 1 and a server device 2.

The client device 1 is, for example, an electronic device such as a mobile phone, tablet computer, laptop computer, or desktop computer operated by a specific user, and includes a processing unit 11, a storage unit 12, and a biometric feature acquisition unit 13.

The processing unit 11 is the operation control center of the client device 1 and can be implemented by a control component such as a central processing unit (CPU).

The storage unit 12 is electrically connected to the processing unit 11 and can be implemented using various types of data storage media, such as a hard drive. In this embodiment, the storage unit 12 is installed with an application that operates in conjunction with the server device 2 and stores biometric storage data, identity verification private key data, and device identification data corresponding to the client device 1. The biometric storage data contains biometric information corresponding to the specific user. This biometric information includes, for example (but not limited to), at least one of the specific user's physiological characteristics, including face, iris, fingerprint, palm print, palm shape, and voice print, and can be used to identify the specific user. The authentication private key data is generated based on the specific user's identity information. The identity information may be, but is not limited to, information representing the specific user's identity, such as their account name, ID number, or email address. The device identification data may be, for example, the International Mobile Equipment Identity (IMEI) or other information that can be used to identify the client device 1.

The biometric acquisition unit 13 is electrically connected to the processing unit 11 and is used to generate biometric data for use in identifying the specific user. Corresponding to the biometric information, the components of the biometric acquisition unit 13 may include, for example, at least one of a camera module, an infrared module, a fingerprint recognition module, a palm print recognition module, and a microphone module. The required functionality is achieved through appropriate hardware configuration.

The server device 2 is, for example, installed by the organization that developed the application. It can communicate with the client device 1 and operate in conjunction with various server hosts, such as web servers, application servers, database servers, and authentication servers. For simplicity, this embodiment does not detail the specific implementations. The server device 2 stores multiple account data, multiple device identification verification data, and multiple identity verification public key data. Each account data entry contains identity information corresponding to a user. Each device identification verification data corresponds to the device identification data of a user's client device 1. This device identification verification data can be generated by the specific user operating their client device 1 and executing a device binding program to store the device identification data of their client device 1 on the server device 2. Each public authentication key data is generated based on the user's identity information using a predetermined algorithm and a corresponding private authentication key data. For example, the private authentication key and the public authentication key are generated by the specific user registering a personal account on the client device 1 through methods such as FIDO (Fast Identity Online) authentication. The corresponding private authentication key and public authentication key are generated simultaneously using a public key encryption mechanism. The private authentication key is stored on the client device 1, while the public authentication key is uploaded by the client device 1 to the server device 2 for storage. In this embodiment, the aforementioned FIDO authentication-related technical standards may be implemented using FIDO 2, for example. However, different versions of the FIDO standard may be adopted in the future as needed, and the present invention is not limited to a specific implementation.

Continuing with Figures 1 and 2, the following describes the operation process of the identity verification information system 100 in the first embodiment.

In steps S01-S02, when the specific user operating the client device 1 needs to perform an identity verification process, such as logging into a company's internal website, the user can enter identification information such as an account name and employee ID on the client device 1 and issue an identity verification command. The client device 1 receives the identification information entered by the specific user and, upon receiving the identity verification command, activates the application. Specifically, when performing a website login operation, the storage unit 12 of the client device 1 is installed with a web browser. The identity information received by the client device 1 is input into the web browser by the specific user, and the identity verification command is issued by the specific user through an operation on the web browser.

In step S03, the client device 1 initiates a process to transmit the device identification data to the server device 2 through the application. The server device 2 then performs a device verification process by comparing the device identification data with the device identification verification data.

In step S04, if the device verification process passes, the client device 1 activates the biometric acquisition unit 13 via the application. The biometric acquisition unit 13 generates biometric data corresponding to the specific user. The client device's processing unit 11 then compares the biometric information in the biometric storage data with the biometric data to determine if they match, thereby performing a biometric verification process. In the aforementioned biometric verification process, the aforementioned biometric information, such as facial features, irises, fingerprints, palm prints, palm shape, and voice prints, can be used to perform real-time biometric identification of the specific user on the client device 1. This can be performed, for example (but not limited to), through facial recognition, fingerprint recognition, and the like.

In steps S05-S06, if the biometric verification process passes, the client device 1 is authorized to access the private authentication key data and transmits an authentication request including the identification information and the private authentication key data to the server device 2. Server device 2 then performs an authentication process based on a comparison of the identification information with the account information and a verification analysis of the private authentication key data with the public authentication key data (step S05). After the authentication process is complete, server device 2 transmits an authentication result to the client device 1 (step S06). If the identity verification result is successful, the web browser on the client device 1 will execute a website login process based on the identity identification information, allowing the specific user to successfully log in to the company's internal website.

In the above process, the biometric authentication process and the identity authentication process are performed in accordance with the FIDO standard, for example. Therefore, when the client device 1 runs the application and passes the device authentication process, the biometric authentication process determines whether the specific user is operating the client device 1. After passing the biometric authentication process, the client device 1 can further access the identity authentication private key data and execute the identity authentication process by issuing an authentication request. This eliminates the need to enter an account password during the entire process, and the multi-factor authentication mechanism (the application, the device authentication process, and the biometric authentication process) ensures the security of the identity authentication process, thereby improving the efficiency, convenience, and security of the entire process.

In the aforementioned execution steps, the identity verification process can be performed not only through the biometric verification process to verify the identity information of the specific user, but also through verification of a personal identification number (PIN). Specifically, in this embodiment, the storage unit 12 of the client device 1 also stores at least one PIN data. After executing the biometric verification process one or more times in step S04, if the biometric verification process fails, the client device 1 can instead receive a verification code data input by the specific user. Based on the comparison of the verification code data with the PIN data, the client device 1 can execute a corresponding PIN verification process. If the identification code verification process passes, the aforementioned identity verification process is executed (step S05). Similar to the above description, after the identity verification process is completed, the server device 2 transmits an identity verification result to the client device 1 (step S06). If the identity verification result passes, the web browser on the client device 1 executes a website login process based on the identity identification information, allowing the specific user to successfully log into the company's internal website.

Referring to Figures 3 and 4 , a second embodiment of the identity verification information system 100 is shown. In the second embodiment, the identity verification information system 100 is described as including a client device 1, a server device 2, and a terminal device 3.

In the second embodiment, the client device 1 is implemented in a manner substantially similar to the first embodiment and can be an electronic device such as a mobile phone, tablet computer, laptop computer, or desktop computer operated by a specific user. The primary difference is that the client device 1 of the second embodiment includes a camera unit 14 in addition to a processing unit 11, a storage unit 12, and a biometric acquisition unit 13. The implementation of the processing unit 11, storage unit 12, and biometric acquisition unit 13 is the same as in the first embodiment and will not be repeated here. The camera unit 14 is electrically connected to the processing unit 11 and is used to generate image data, which can be implemented using components such as a lens module.

In the second embodiment, the hardware configuration and stored data of the server device 2 are substantially the same as those of the first embodiment and will not be repeated here.

The terminal device 3 is, for example, a laptop, desktop computer, or other electronic device operated by the specific user, and includes a computing unit 31, a memory unit 32, and a display unit 33.

The computing unit 31 is the operation control center of the terminal device 3 and can be implemented by a control component such as a central processing unit (CPU).

The memory unit 32 is electrically connected to the computing unit 31 and is installed with a web browser program, which can be implemented through various types of data storage media such as hard drives.

The display unit 33 is electrically connected to the computing unit 31 and is used to display a screen image. This can be achieved through various types of screens such as liquid crystal screens and OLED screens.

Continuing with Figures 3 and 4, the following describes the operational flow of the identity verification information system of the second embodiment.

In steps S11-S12, when the specific user operating the terminal device 3 (e.g., a desktop computer) wishes to perform an identity verification process on the terminal device 3, such as logging into a corporate intranet website, the user can perform the relevant operations through the web browser of the terminal device 3. The terminal device 3 runs the web browser and receives identity identification information, such as an account name or employee ID, entered by the specific user into the web browser (step S11). The specific user can then perform subsequent operations, causing the terminal device 3 to receive an identity verification command and the display unit 33 to display a screen including a verification barcode (step S12). The verification barcode is, for example, a QR code and includes information corresponding to the identity identification information.

In steps S13 and S14, the specific user operates the client device 1 (e.g., a mobile phone) and causes the client device 1 to run the application (step S13). The application initiates a process that transmits the device identification data of the client device 1 to the server device 2. The server device 2 then performs a device verification process by comparing the device identification data with the device identification verification data (step S14).

In step S15, after the device verification process is successful, the specific user can continue to operate the client device 1. The camera unit 14 of the client device 1 captures the verification barcode data displayed by the display unit 33 of the terminal device 3, allowing the camera unit 14 of the client device 1 to generate image data containing the verification barcode data (step S15). The processing unit 11 then analyzes the image data containing the verification barcode data to obtain the identity identification information.

In step S16, the specific user can perform subsequent operations on the client device 1. Specifically, the client device 1 activates the biometric acquisition unit 13 via the application, which then generates biometric data corresponding to the specific user. As previously described, the biometric data may include biometric information corresponding to at least one of the following: face, iris, fingerprint, palm print, palm shape, and voice print. The client device 1 then compares the biometric data with the biometric information in the stored biometric data to determine whether it matches, thereby performing a biometric verification process.

In step S17, if the biometric verification process is successful, the client device 1 reads the authentication private key data and sends an authentication request including the identification information and the authentication private key data to the server device 2. The server device 2 then performs an authentication process based on a comparison of the identification information with the account information and a verification analysis of the authentication private key data and the authentication public key data.

In step S18, after the identity verification process is completed, the server device 2 transmits an identity verification result to the terminal device 3. If the identity verification result is passed, the web browser will execute a website login process based on the identity identification information, completing the login process for the enterprise intranet website, allowing the specific user to perform the required operations on the terminal device 3.

During the operation of the aforementioned second embodiment, the biometric verification process and the identity verification process are both performed in accordance with the FIDO standard. When the specific user needs to perform identity verification on the terminal device 3, such as logging into a website, the specific user simply scans the verification barcode data displayed by the terminal device 3 through the client device 1 and passes the biometric verification process. The identity verification information system 100 can then complete the subsequent process even if the client device 1 is connected to the terminal device 3 via Bluetooth communication or the client device 1 is not connected to the terminal device via Bluetooth communication. During the entire process, no password is required, and a multi-factor authentication mechanism (app, device, and biometrics) ensures the security of the authentication process, thereby improving the efficiency, convenience, and security of the entire process.

Similar to the description of the first embodiment, in the second embodiment, the identity verification process can also be performed by checking a personal identification number (PIN). Specifically, in this embodiment, the storage unit 12 of the client device 1 also stores at least one PIN data. After the client device 1 obtains the identity information in step S15, if the specific user fails to pass the biometric verification process one or more times, the client device 1 can instead receive a verification code data input by the specific user. The client device 1 then performs a corresponding verification process based on the comparison of the verification code data with the PIN data. If the identification code verification process passes, the aforementioned identity verification process is performed (step S17). In step S18, the server device 2 transmits an identity verification result to the client device 1. If the identity verification result passes, the web browser on the terminal device 3 executes a website login process based on the identity identification information, completing the login process for the company's internal website, allowing the specific user to perform the required operations on the terminal device 3.

In summary, when performing the identity verification process, the novel identity verification information system 100 uses the biometric verification process or the personal identification code verification process to identify whether the specific user is personally operating the client device 1 and/or the terminal device 3 when the application is run on the client device 1 and the device verification process is passed. This allows the identity verification process to be completed even without entering a verification password, effectively improving the efficiency, convenience, and security of the entire process, thereby achieving the purpose of the novel system.

However, the above descriptions are merely examples of embodiments of this new invention and should not be construed as limiting the scope of implementation of this new invention. All simple equivalent variations and modifications made within the scope of this patent application and the contents of the patent specification are still covered by this new patent.

100: Identity Verification Information System

1: Client device

11: Processing unit

12: Storage unit

13: Biological Characteristic Acquisition Unit

2: Server equipment

Claims (10)

An identity verification information system includes: a client device including: a processing unit; a storage unit electrically connected to the processing unit; the storage unit having an application installed therein and storing a biometric storage data, an identity verification private key data, and a device identification data corresponding to the client device; the biometric storage data having biometric information corresponding to a specific user; the identity verification private key data being generated based on the identity identification information of the specific user; and a biometric acquisition unit electrically connected to the processing unit for generating a biometric data. The invention relates to a server device that can connect and communicate with the client device and store multiple account data, multiple device identification verification data and multiple identity verification public key data, each account data has an identity identification information corresponding to a user, each device identification verification data corresponds to the device identification data of a client device of a user, and each identity verification public key data is generated based on the identity identification information of a user by a predetermined algorithm together with a corresponding identity verification private key data, wherein the client device receives the specific The user inputs an identification information and receives an identity verification command to start the application. The client device starts the process of transmitting the device identification data to the server device through the application, and the server device performs a device verification process by comparing the device identification data with the device identification verification data. If the result of the device verification process is passed, the client device starts the biometric feature acquisition unit through the application, and the biometric feature acquisition unit generates a biometric feature collection data corresponding to the specific user. The client device The device compares the biometric information of the collected biometric data with the biometric information of the stored biometric data to determine whether they match, thereby executing a biometric verification procedure. If the result of the biometric verification procedure is passed, the client device reads the identity verification private key data and transmits an identity verification request including the identity identification information and the identity verification private key data to the server device. The server device executes an identity verification procedure based on the comparison of the identity identification information with the account data and the verification analysis of the identity verification private key data and the identity verification public key data. The identity verification information system as described in claim 1, wherein the biometric verification procedure and the identity verification procedure are performed in accordance with the FIDO standard. The identity verification information system as described in claim 1, wherein the biometric information corresponds to at least one of face, iris, fingerprint, palm print, palm shape, and voice print. The identity verification information system as described in claim 1, wherein the storage unit of the client device is also installed with a web browser; the identity identification information received by the client device is input into the web browser by the specific user, and the identity verification instruction is issued by the specific user through an operation on the web browser; after the identity verification process is completed, the server device transmits an identity verification result to the client device; if the identity verification result is passed, the web browser executes a website login process based on the identity identification information. The identity verification information system as described in claim 1, wherein the storage unit of the client device further stores at least one personal identification code data; if the result of the biometric verification procedure is failure, the client device can receive a piece of identification code data to be verified and execute a corresponding identification code verification procedure based on a comparison between the piece of identification code data to be verified and the personal identification code data; if the result of the identification code verification procedure is a pass, the identity verification procedure is executed. An identity verification information system includes: a client device including: a processing unit, a storage unit electrically connected to the processing unit, the storage unit installing an application and storing a biometric storage data, an identity verification private key data and a device identification data corresponding to the client device, wherein the biometric storage data has a biometric corresponding to a specific user. The identity verification private key data is generated based on the identity identification information of the specific user, a biometric feature acquisition unit electrically connected to the processing unit for generating a biometric feature collection data, and a camera unit electrically connected to the processing unit for generating an image data; a server device capable of connecting to and communicating with the client device and storing multiple account data , multiple device identification verification data and multiple identity verification public key data, each account data has an identity identification information corresponding to a user, each device identification verification data corresponds to the device identification data of a client device of a user, and each identity verification public key data is based on the identity identification information of a user, through a predetermined algorithm and a corresponding identity verification The private key data is generated together; and a terminal device capable of communicating with the server device and/or the client device, comprising: a computing unit, a memory unit electrically connected to the computing unit, and a web browser installed thereon, and a display unit electrically connected to the computing unit for displaying a screen, wherein the terminal device runs the web browser and receives the The specific user inputs an identification information into the web browser; the terminal device receives an identity verification command, and the display unit displays a screen including a verification barcode data, the verification barcode data including a message corresponding to the identity identification information, the client device runs the application, and the application starts to transmit the device identification data to the The server device performs a device verification process by comparing the device identification data with the device identification verification data. If the device verification process is passed, the camera unit of the client device generates image data including the verification barcode data, and the processing unit analyzes the image data to obtain the identity identification information. The client device activates the biometric acquisition unit through the application, and the biometric acquisition unit generates a biometric collection data corresponding to the specific user. The client device compares the biometric collection data with the biometric information of the biometric storage data to perform a biometric verification process. If the result of the biometric verification process is The client device reads the identity verification private key data and transmits an identity verification request including the identity identification information and the identity verification private key data to the server device. The server device performs an identity verification process based on the comparison of the identity identification information with the account data and the verification analysis of the identity verification private key data and the identity verification public key data. The identity verification information system as described in claim 6, wherein the biometric verification procedure and the identity verification procedure are performed in accordance with the FIDO standard. The identity verification information system as described in claim 6, wherein the biometric information corresponds to at least one of face, iris, fingerprint, palm print, palm shape, and voice print. The identity verification information system as described in claim 6, wherein after the identity verification process is completed, the server device transmits an identity verification result to the terminal device; if the identity verification result is passed, the web browser executes a website login process based on the identity identification information. The identity verification information system as described in claim 6, wherein the storage unit of the client device further stores at least one personal identification code data; after the client device obtains the identity identification information, if the result of the biometric verification procedure is failure, the client device can receive a pending verification code data and transmit an identification code verification procedure based on the comparison of the pending verification code data with the personal identification code data.