WO2017018861A1 - Financial device using biometric information, and operation method therefor - Google Patents

Abstract

A financial device according to an embodiment of the present invention may comprise: a communication unit for receiving from a user terminal a primary user authentication result, encrypted user authentication information and a first key value, for transmitting to a server the encrypted user authentication information, and for receiving from the server a secondary user authentication result and a second key value; and a processing unit for processing a financial transaction requested from the user if the secondary user authentication result is successful, for executing a tertiary user authentication by comparing the received first key value and second key value, and for processing a final approval for the requested financial transaction if the tertiary user authentication result is successful.

Description

Financial device using biometric information and its operation method

The present invention relates to a financial device, a financial transaction system, and an operation method thereof using biometric information.

BACKGROUND ART A biometric information authentication method for authenticating a user using biometric information of a user has been developed. The biometrics recognition method is a method of authenticating a user using biometric information unique to an individual, and performs user authentication using biometric information such as a fingerprint or an iris.

Recently, user authentication technology using such biometric information has been applied to the financial field. For example, when a customer registers biometric information in a bank, the biometric information is stored in a server of a financial institution. Thereafter, when the user inputs the biometric information for the financial transaction using the financial device, the input biometric information is transmitted to the server of the financial institution. The server of the financial institution compares the transmitted biometric information of the customer with the biometric information previously stored in the database to determine whether to authenticate, and transmits the result of the determination to the financial device.

However, according to this method, since all the biometric information, which is the user's personal information, is stored in a financial institution, there is a serious problem of damage to the user in case of hacking and / or leakage. In addition, since the user directly inputs the biometric information into the financial device, the user may cause a feeling of rejection.

One object of the present invention is to provide a financial device, a financial transaction system, and a method of operating the same, which can minimize the damage of hacking and / or leakage of the user's biometric information and reduce the user's rejection.

Technical problems of the present invention are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art from the following descriptions.

The financial device according to an embodiment of the present invention receives the primary user authentication result, the encrypted user authentication information and the first key value from the user's terminal, and transmits the encrypted user authentication information to the server, and transmits 2 from the server. A communication unit receiving the second user authentication result and the second key value; And if the second user authentication is successful, proceed with the financial transaction requested by the user, perform the third user authentication by comparing the received first key value and the second key value, and perform the third user authentication. If the authentication result is the authentication success, it may include a processing unit for processing the final approval of the requested financial transaction.

The terminal according to an embodiment of the present invention divides the biometric information input from the user into a plurality of unit areas having an identification number and extracts a unit area having the same identification number as the password input from the user among the plurality of unit areas. Biometric information management unit for generating authentication information; A processor configured to perform first user authentication by comparing biometric information received from a user with previously stored biometric information; And a communication unit configured to receive a first key value from a server, transmit a result of the first user authentication and authentication information encrypted using the first key value, and transmit authentication information or the first key value to a financial device. Can be.

The server according to an embodiment of the present invention divides the user's biometric information into a plurality of unit areas having an identification number, and extracts a unit area having the same identification number as a password among the plurality of unit areas to generate authentication information. Biological information management unit; A communication unit which transmits a first key value to a terminal, receives authentication information including biometric information of the user from the terminal and is encrypted with the first key value, and transmits a result of the second user authentication to a financial device; And a processor configured to decode the received authentication information and perform second user authentication by comparing the user's biometric information included in the authentication information with the stored user's biometric information.

Method of operation of a financial transaction system according to an embodiment of the present invention comprises the steps of the terminal receiving biometric information and password for financial transactions from the user; Performing, by the terminal, first authentication using the biometric information; Generating, by the terminal, authentication information by encrypting the password, the biometric information, and the unique information of the user; Transmitting, by the terminal, the authentication information to a financial device when the first authentication is successful; Transmitting, by the financial device, the authentication information to a server; Decrypting, by the server, the authentication information and performing second authentication using the password, the biometric information, and the unique information of the user; And forwarding, by the server, the authentication result of the second authentication to the financial device.

According to an embodiment of the present invention, a financial device, a financial transaction system, and a method of operating the same according to an embodiment of the present invention may be applied to a financial transaction through a user authentication process of first authentication by a terminal, second authentication by a server, and third authentication by a financial device. Reliability can be secured.

A financial device, a financial transaction system, and an operation method thereof according to an embodiment of the present invention can minimize the user's discomfort by obtaining biometric information using a user's own terminal.

According to the biometric information recognizing apparatus, the biometric information management device, the authentication method using the biometric information, and the authentication system according to an embodiment of the present invention, biometric information, which is a user's personal information, may be protected from hacking / leakage. In addition, the user's refusal to transmit or store all of his personal information to the trading institution can be minimized.

1 is a block diagram showing a financial transaction system according to an embodiment of the present invention.

2 is a block diagram illustrating a terminal according to an embodiment of the present invention. 3 is a view for explaining the operation of the terminal according to an embodiment of the present invention.

3 is a block diagram illustrating a financial device according to an embodiment of the present invention.

4 is a block diagram illustrating a server 300 according to an embodiment of the present invention.

5 shows a method of operating a financial transaction system according to a first embodiment of the present invention.

6 shows a method of operating a financial transaction system according to a second embodiment of the present invention.

7 is a block diagram illustrating the biometric information recognizing apparatus or the biometric information management apparatus 150 or 350 according to an embodiment of the present invention.

8 shows a fingerprint image according to an embodiment of the present invention.

9 shows an iris image according to an embodiment of the present invention.

10 illustrates a process in which the fingerprint image is processed by the second processor 720 as an example of the biometric information image.

11 is a flowchart illustrating an authentication method using biometric information according to an embodiment of the present invention.

12 illustrates an embodiment using an iris image.

13 illustrates an embodiment using a fingerprint image.

14 is a block diagram showing a financial transaction system according to another embodiment of the present invention.

Hereinafter, some embodiments of the present invention will be described in detail through exemplary drawings. In adding reference numerals to the components of each drawing, it should be noted that the same reference numerals are assigned to the same components as much as possible even though they are shown in different drawings. In addition, in describing the embodiments of the present invention, if it is determined that the detailed description of the related well-known configuration or function interferes with the understanding of the embodiments of the present invention, the detailed description thereof will be omitted.

In describing the components of the embodiments of the present invention, terms such as first, second, A, B, (a), and (b) may be used. These terms are only for distinguishing the components from other components, and the nature, order or order of the components are not limited by the terms. In addition, unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art, and shall not be construed in ideal or excessively formal meanings unless expressly defined in this application. Do not.

1 is a block diagram showing a financial transaction system according to an embodiment of the present invention.

Referring to FIG. 1, a financial transaction system 1000 according to an embodiment of the present invention may include a terminal 100, a financial device 200, and a server 300.

According to the financial transaction system 1000 according to an embodiment of the present invention, a user performs user authentication through the terminal 100 and processes a financial transaction through the financial device 200 without a medium (credit card, etc.). This may be explained in more detail below.

The terminal 100 may perform user authentication for the use of the financial device 200 to process the financial transaction of the user. For example, the terminal 100 may include a program or an application for the user authentication. The program or application for user authentication may be driven according to a user's operation or may be driven through short-range wireless communication with the financial device 200. The terminal 100 may receive biometric information and / or a password from the user for the user authentication.

The terminal 100 may perform the user authentication using the biometric information of the user. For example, the terminal 100 may perform the user authentication by comparing the biometric information of the user with previously stored biometric information. For example, the biometric information may include an iris image, a fingerprint image, and / or a vein image. Alternatively, the biometric information may include feature points of the iris image, the fingerprint image, and / or the vein image. The feature point of the image is included as long as it can identify the divided unit areas of the image without scanning and storing the entire image. A method of using biometric information will be described later. In one aspect, user authentication of the terminal 100 may be understood as primary authentication. Meanwhile, the first authentication of the terminal 100 may be performed using user personal information such as a password and an authorized certificate in addition to the biometric information.

The terminal 100 may receive the first key value from the server 300 when the first authentication is successful. The terminal 100 may receive the first key value directly from the server 300. The terminal 100 may generate authentication information by encrypting a password, biometric information, and user's unique information input from the user using the first key value. According to an embodiment, the terminal 100 may generate authentication information by encrypting a password, a partial region matching a password among biometric information image regions, and unique information of a user using the first key value. The unique information of the user may include a user ID (UID) received from the server 300 when the user opens an account for a financial transaction, and may be pre-stored in the terminal 100. The terminal 100 may transmit the authentication information to the financial device 200 along with the authentication result of the first authentication or sequentially. The terminal 100 may transmit the first key value to the financial device 200.

If the first authentication is successful, the terminal 100 may be connected to the financial device 200 and the server 300 (can be connected). That is, when the first authentication is successful, the user may request processing of the financial transaction through the terminal 100 or directly by operating the financial device 200. In this regard, the first authentication may be understood that the user performs the user authentication through the terminal 100 before processing the financial transaction using the financial device 200.

Various embodiments of the terminal 100 include a cellular telephone, a smart phone having a wireless communication function, a personal digital assistant (PDA) having a wireless communication function, a wireless modem, a portable computer having a wireless communication function, and a digital camera having a wireless communication function. Handheld unit incorporating combinations of such functions as well as photographing devices, gaming devices with wireless communication capabilities, music storage and playback appliances with wireless communication capabilities, internet appliances with wireless internet access and browsing Or may include terminals, but is not limited thereto.

The financial device 200 may transmit the encrypted authentication information received from the terminal 100 to the server 300. That is, the financial device 200 may directly transfer the encrypted authentication information received from the terminal 100 to the server 300 without being decrypted. The server 300 may perform user authentication using a password, biometric information, and user's unique information obtained by decrypting the encrypted authentication information transmitted from the financial device 200.

The server 300 may decrypt the received encrypted authentication information by using the second key value. For example, the second key value may have the same value as the first key value. In one aspect, user authentication at server 300 may be understood as secondary authentication. The server 300 may transmit the authentication result for the second authentication to the financial device 200. The server 300 may transmit the second key value to the financial device 200 simultaneously or sequentially with the authentication result. For example, the financial device 200 may receive the second key value from the server 300 immediately before the final approval of the user's requested transaction.

Therefore, the financial device 200 may receive the first key value from the terminal 100 and the second key value from the server 300, respectively. The financial device 200 may perform user authentication by comparing the first key value received from the terminal 100 and the second key value received from the server 300 after the second user authentication. The financial device 200 may compare the first key value received from the terminal 100 and the second key value received from the server 300 to determine whether the financial transaction requested by the user is finally approved based on the same. . This is to authenticate the occupation of the terminal 100 and / or the financial device 200 by the same user. In one aspect, user authentication of the financial device 200 may be understood as tertiary authentication.

As described above, the financial transaction system 1000 according to an embodiment of the present invention is the first authentication by the terminal 100, the second authentication by the server 300, the third authentication by the financial device 200 By including the user authentication process of the financial transaction can be secured, and by obtaining the biometric information using the user's own terminal can minimize the user's rejection.

Hereinafter, the configuration and operation of the terminal 100, the financial device 200, and the server 300 will be described in more detail.

2 is a block diagram illustrating a terminal according to an embodiment of the present invention. 3 is a view for explaining the operation of the terminal according to an embodiment of the present invention.

First, referring to FIG. 2, the terminal 100 according to an embodiment of the present invention includes an input unit 110, a processing unit 120, a communication unit 130, a storage unit 140, and a biometric information management unit 150. can do.

The input unit 110 may receive biometric information and / or a password from a user. For example, the input unit 110 may include a camera for receiving biometric information of the user and / or a touch panel for receiving a password. The password may be set in advance through a contract with a user and an operating entity (ie, a financial company) of the financial device 200. For example, the biometric information may include an iris image, a fingerprint image, and / or a vein image. Alternatively, the biometric information may include feature points of an iris image, a fingerprint image, and / or a vein image.

The processor 120 may perform user authentication using the biometric information of the user. The processor 120 may perform user authentication by comparing the biometric information of the user with the biometric information stored in the storage 140. The processor 120 may determine success of user authentication when the biometric information of the user input through the input unit 110 and the biometric information of the user previously stored in the storage 140 match. The processor 120 may determine that the user authentication fails when the biometric information of the user input through the input unit 110 and the biometric information of the user previously stored in the storage 140 do not match.

The processor 120 may generate authentication information by encrypting a password inputted from a user, biometric information, and unique information of the user. The processor 120 may generate authentication information by encrypting the password, the biometric information, and the unique information of the user by using the first key value received from the server 300. The unique information of the user may include a UID (User ID) received from the server 300 when the user opens an account for a financial transaction, and may be pre-stored in the storage 140.

The communicator 130 may receive a first key value from the server 300. The communicator 130 may transmit a user authentication result (ie, a primary user authentication result) to the financial device 200. The communication unit 130 may transmit the authentication information and / or the first key value to the financial device 200. The communicator 130 may include various wireless communication interfaces such as WiFi, LTE, LTE-A, 3G, Bluetooth, and near field communication (NFC).

The storage 140 may store the biometric information of the user. The storage 140 may store unique information of the user. For example, the storage 140 may include a USIM.

The biometric information management unit 150 may divide the input biometric information into a plurality of unit areas having an identification number. For example, the biometric information management unit 150 may divide the biometric information into n unit areas (n ≧ 2, n is a natural number). The n value may be determined in consideration of the minimum area in which biometric information can be identified. The biometric information management unit 150 may assign an identification number to each of the n unit areas (or may assign an identification number in association with a feature point in the unit area). Biometric information having an identification number assigned to a unit area may be stored in the storage 140.

3 is a block diagram illustrating a financial device according to an embodiment of the present invention.

Referring to FIG. 3, the financial device 200 according to an embodiment of the present invention may include a communication unit 210 and a processing unit 220.

The communication unit 210 may receive an authentication result (ie, primary user authentication result) from the terminal 100. The communication unit 210 may receive the authentication information from the terminal 100. The communication unit 210 may transfer the user authentication information received from the terminal 100 to the server 300. The communication unit 210 may receive an authentication result (that is, a secondary user authentication result) from the server 300. The communication unit 210 may receive a first key value from the terminal 100. The communication unit 210 may receive a second key value from the server 300. The communication unit 210 may include various wireless communication interfaces such as WiFi, LTE, LTE-A, 3G, Bluetooth, near field communication (NFC).

The processor 220 may perform the user authentication by comparing the first key value with the second key value. The user authentication is for authenticating the occupation of the terminal 100 and / or the occupation of the financial device 200 by the same user. The processor 220 may determine whether to proceed with the financial transaction requested from the user according to the second user authentication result transmitted from the server 300. For example, the processor 220 may proceed with the financial transaction requested by the user when the authentication result transmitted from the server 300 is authentication success.

In addition, the processor 220 proceeds with the financial transaction requested by the user when the second user authentication result is the authentication success, and is transferred from the terminal 100 before approval for approval for completion of the final transaction of the financial transaction. By comparing the received first key value and the second key value received from the server 300, and performing the third user authentication to confirm the same, and finally approved the financial transaction requested by the user according to the authentication result. .

4 is a block diagram illustrating a server 300 according to an embodiment of the present invention.

Referring to FIG. 4, the server 300 according to an embodiment of the present invention includes a key value generation unit 310, a communication unit 320, a storage unit 330, a processing unit 340, and a biometric information management unit 350. can do.

The key value generator 310 may generate the first key value and the second key value. For example, the first key value and the second key value may have the same value.

The communication unit 320 may transmit the first key value to the terminal 100. The communicator 320 may transmit the second key value to the financial device 200. The communicator 320 may receive user authentication information from the financial device 200. The communicator 320 may transmit a user authentication result (that is, a second user authentication result) to the financial device 200. The communicator 320 may include various wireless communication interfaces such as WiFi, LTE, LTE-A, 3G, Bluetooth, and near field communication (NFC).

The storage unit 330 may store a password preset by the user, biometric information of the user, and a unique number of the user. For example, the storage unit 330 may match and store a password preset by the user, biometric information of the user, and a unique number of the user.

The processor 340 may perform user authentication using a password, biometric information, and unique information of a user obtained by decrypting user authentication information transmitted from the financial device 200. The processor 340 may decrypt user authentication information by using the second key value. The processor 340 stores the password, the biometric information, and the unique information of the user, which are obtained by decrypting the user authentication information transmitted from the financial device 200, and the user's biometric information. And user authentication can be performed by comparing with the unique number of the user.

The processor 340 is a password, biometric information and the user's unique information obtained by decrypting the authentication information transmitted from the financial device 200 is stored in the storage unit 330 preset by the user, the user's biometric information and the user If the unique numbers of the match the user authentication can be determined to be successful. The processor 340 is a password, biometric information and the user's unique information obtained by decrypting the authentication information transmitted from the financial device 200 is stored in the storage unit 330 preset by the user, the user's biometric information and the user If the unique numbers do not match, it can be determined that the user authentication failed.

The biometric information management unit 350 may divide the biometric information image into a plurality of unit areas having an identification number. For example, the biometric information management unit 350 may divide the biometric information image into n unit areas (n ≧ 2, n is a natural number). The n value may be determined in consideration of the minimum area where the biometric information image can be identified. The biometric information management unit 220 may assign an identification number to each of the n unit areas (or assign an identification number to a feature point in the n unit areas). The biometric information generated by the biometric information manager 350 is stored in the storage 330.

5 shows a method of operating a financial transaction system according to a first embodiment of the present invention.

Referring to FIG. 5, in a method of operating a financial transaction system according to a first embodiment of the present invention, a terminal receives biometric information and a password from a user (S11), and the terminal first uses biometric information of the user. Performing authentication (S12), receiving the first key value from the server by the terminal (S13), and generating the authentication information by encrypting the password, the biometric information, and the user's unique information using the first key value. In step S14, the terminal transmits the authentication information to the financial device (S15), the financial device sends the authentication information to the server (S16), the server decrypts the user authentication information (S17), The server performs the second authentication using the password, biometric information and the user's unique information (S18), the server delivers the authentication result to the financial device (S19), and the financial device in accordance with the authentication result Trading jean It may include the step (S20) to determine whether or not.

In the following, the above-described step S11 to step S20 will be described in more detail.

The terminal 100 may receive biometric information and / or a password from a user for user authentication (S11). For example, the biometric information may include an iris image, a fingerprint image, and / or a vein image, or a feature point of the iris image, fingerprint image, and / or vein image, and the password may be at least one of letters, numbers, and symbols. It can be composed of a combination of. The input biometric information may be assigned by the biometric information management unit 150 to the terminal 100 by dividing the user's biometric information into a plurality of unit areas and assigning identification numbers to each of the plurality of unit areas. The biometric information management unit 150 matches the password of the unit area (or a feature point for each unit area) having the same identification number as the password among the biometric information assigned the identification number to each of the plurality of unit areas. The first authentication may be performed by comparing the password and the corresponding password with the stored biometric information (S12). If the first authentication is successful, the terminal 100 may receive the first key value from the server 300 (S13). Step S13 may be performed before step S12, or may be performed simultaneously with step S12.

The terminal 100 may generate authentication information by encrypting the biometric information of the unit area having the identification number matched with the password input from the user and the unique information of the user using the first key value (S14). The terminal 100 may transmit the authentication information to the financial device 200 together with the authentication result of the first authentication or sequentially (S15).

The financial device 200 may transmit the authentication information transmitted from the terminal 100 to the server 300 (S16).

The server 300 may decrypt the authentication information transmitted from the financial device 200 using the second key value (S17). The server 300 may perform the second authentication using the password, biometric information, and the unique information of the user obtained by decrypting the authentication information (S18). The server 300 may transmit the authentication result for the second authentication to the financial device 200 (S19).

The financial device 200 may determine whether to proceed with the financial transaction requested by the user based on the authentication result transmitted from the server 300 (S20). For example, the financial device 200 may proceed with a financial transaction when the authentication result transmitted from the server 300 is authentication success.

6 shows a method of operating a financial transaction system according to a second embodiment of the present invention.

Referring to FIG. 6, in a method of operating a financial transaction system according to a second embodiment of the present invention, a terminal receives biometric information and a password from a user (S31), and the terminal performs first authentication using biometric information. (S32), the terminal receiving the first key value from the server (S33), the terminal encrypts the password, biometric information and the user's unique number to generate the authentication information (S34), the terminal the authentication information Step (S35), the financial device delivers the authentication information to the server (S36), the server decrypts the authentication information (S37), the server uses a password, biometric information and the user's unique information Performing second authentication (S38), the server transferring the authentication result to the financial device (S39), the financial device determining whether to proceed with the financial transaction (S40), and the server finances the second key value. Delivering to the device (S41), except Transferring the first key value to the financial device (S41), performing the third authentication by the financial device using the first key value and the second key value (S43), and whether the financial transaction is finally approved according to the third authentication result; Determining the step (S44), and may comprise the step of completing the financial transaction (S45).

In the following, the above-described step S31 to step S45 will be described in more detail.

The terminal 100 may receive biometric information and / or a password from a user for user authentication (S31). For example, the biometric information may include an iris image, a fingerprint image, and / or a vein image, or a feature point of the iris image, fingerprint image, and / or vein image, and the password may be at least one of letters, numbers, and symbols. It can be composed of a combination of. In the biometric information management unit 150, the terminal 100 divides the user's biometric information into a plurality of unit areas and assigns an identification number to each of the plurality of unit areas (or within the plurality of unit areas). Each feature point can be given an identification number). The biometric information management unit 150 matches the password with the unit area having the same identification number as the password among the biometric information assigned the identification number to each of the plurality of unit areas. The terminal 100 may perform first authentication by comparing biometric information of a unit area having an identification number matched with a password with previously stored biometric information (S32). The terminal 100 may receive the first key value from the server 300 (S33). Step S33 may be performed before step S32 or may be performed simultaneously with step S32.

The terminal 100 may generate authentication information by encrypting the password, biometric information, and the user's unique information input from the user using the first key value (S34). The terminal 100 may transmit the authentication information to the financial device 200 together with the authentication result of the first authentication or sequentially (S35).

The financial device 200 may transmit the authentication information transmitted from the terminal 100 to the server 300 (S36).

The server 300 may decrypt the authentication information transmitted from the financial device 200 using the second key value (S37). The server 300 may perform the second authentication using the password, biometric information, and the unique information of the user, which are obtained by decrypting the authentication information (S38). The server 300 may transmit the authentication result for the second authentication to the financial device 200 (S39).

The financial device 200 may determine whether to proceed with the financial transaction according to the authentication result for the second authentication (S40). For example, if the authentication result of the second authentication is authentication success, the financial device 200 may continue the financial transaction.

The server 300 may transmit the second key value to the financial device 200 (S41). The step S41 may be performed simultaneously with the step S39 or may be performed before the step S39.

The terminal 100 may transmit the first key value to the financial device 200 (S42). For example, the terminal 100 may transmit the first key value to the financial device 200 through short range wireless communication. The financial device 200 may perform the third authentication by comparing the first key value received from the terminal 100 and the second key value received from the server 300 (S43).

The financial device 200 may determine whether the financial transaction requested from the user is finally approved based on the authentication result of the third authentication (S44). For example, the financial device 200 may stop the progress of the financial transaction if the authentication result for the third authentication is an authentication failure. That is, if the authentication result of the third authentication is an authentication failure, the financial device 200 may stop the financial transaction and guide (or notify) the user, cancel all the financial transactions, and then return to the initial transaction screen. .

The financial device 200 may complete the financial transaction when the authentication result for the third authentication is authentication success (S45). For example, the financial device 200 may finally approve the financial transaction if the authentication result of the third authentication is a successful authentication.

Hereinafter, with reference to FIGS. 7 to 13, an embodiment in which the biometric information management unit 150 and 350 matches and matches the biometric information with a password will be described in detail.

7 is a block diagram illustrating the biometric information recognizing apparatus or the biometric information management apparatus 150 or 350 according to an embodiment of the present invention. 8 shows a fingerprint image according to an embodiment of the present invention. 9 shows an iris image according to an embodiment of the present invention. 10 shows a process of processing a fingerprint image according to an embodiment of the present invention.

First, referring to FIG. 7, a biometric information recognition device or biometric information management device 150 or 350 according to an embodiment of the present invention is illustrated. The configuration of the biometric information recognizing apparatus and the biometric information management apparatus 150 or 350 according to an embodiment of the present invention may be substantially the same. According to an exemplary embodiment, the biometric information recognizing apparatus and the biometric information managing apparatus 150 and 350 may be disposed in the terminal 100 and / or the server 300. Hereinafter, the biometric information management apparatus 150 and 350 will be described as an example.

The biometric information management apparatus 150 or 350 according to the exemplary embodiment of the present invention may include a first processor 710 and a second processor 720. In FIG. 7, the first processing unit 710 and the second processing unit 720 are shown separately, which is divided according to a function to the last, and the first processing unit 710 and the second processing unit 720 are one module. It may be configured.

The first processor 710 may divide the biometric information image into a plurality of unit areas. The bioinformation image may be, for example, an iris image or a fingerprint image. The first processor 710 may assign an identification number to each of the plurality of unit areas. For example, the identification number may be composed of a combination of at least one of letters, numbers, and symbols.

Referring to FIG. 8, a process of processing a fingerprint image by the first processor 710 as an example of a biometric information image is illustrated.

The first processor 710 may divide the fingerprint image into n unit areas (n ≧ 2, n is a natural number). The n value may be determined in consideration of the minimum area where the fingerprint image can be identified. That is, the first processing unit 710 may divide the fingerprint image into a plurality of unit areas in a range where user authentication is possible using the divided unit areas. The first processing unit 710 may assign an identification number (for example, 1 to 9) to each of the n unit areas (or may assign an identification number to a feature point in the n unit areas).

Referring to FIG. 9, a process in which an iris image is processed by the first processor 710 is illustrated as an example of a biometric image.

The first processor 710 may divide the iris image into n unit areas (n ≧ 2, n is a natural number). The n value may be determined in consideration of the minimum area where the iris image can be identified. That is, the first processor 710 may divide the iris image into a plurality of unit areas in a range where user authentication is possible using the divided unit areas. The first processor 710 may assign an identification number (for example, 0 to 9 and a to f) to each of the n unit areas.

Referring to FIG. 10, a process of processing a fingerprint image by the second processor 720 as an example of a biometric information image is illustrated. Although the fingerprint image is shown in FIG. 10, the same may be applied to the iris image.

The second processor 720 may store the unit area having the same identification number as the password among the plurality of unit areas by matching the password. For example, the second processor 720 may generate authentication information by matching a unit area having the same identification number as a password among a plurality of unit areas with the password, and store the generated authentication information in the storage unit 140. have. In addition, the second processor 720 may transmit and store the generated authentication information to the server 300. Here, the password may be a password input from the user, for example, a password for authenticating the user. The password may be composed of at least one of letters, numbers, and symbols in the same manner as the identification number. However, as described above, the second processing unit 720 does not generate the authentication number, but matches the unit area having the same identification number as the password among the plurality of unit areas with the password, and then the processing unit 120 does this. The authentication information may be generated by encrypting using the first key value.

The second processing unit 720 may include a unit area having the same identification number (eg, 1549) as the password (for example, 1549) input from the user among the plurality of unit areas divided by the first processing unit 710. Authentication information may be generated by matching the password. The second processor 720 may store the generated authentication information. The stored authentication information may be used for user authentication. However, as described above, the second processing unit 720 does not generate an authentication number, and after matching a unit area having the same identification number as the password among the plurality of unit areas with the password, the processing unit 120 generates a second number. The authentication information may be generated by encrypting using 1 key value.

11 is a flowchart illustrating an authentication method using biometric information according to an embodiment of the present invention.

Referring to FIG. 11, in the authentication method using biometric information according to an embodiment of the present invention, the biometric information is divided into a plurality of unit areas having an identification number (S1100), and the same as the password among the plurality of unit areas. Generating authentication information by matching a unit area having an identification number with the password (S1110), and transmitting the authentication information to the server 300 (S1120).

Hereinafter, the above-described steps S1100 to S1120 are described.

The biometric information management apparatus 150 or 350 may divide the biometric information image into a plurality of unit areas (S1100). The bioinformation image may be, for example, an iris image or a fingerprint image. The biometric information management apparatus 150 or 350 may assign an identification number to each of the plurality of unit areas. For example, the identification number may be composed of a combination of at least one of letters, numbers, and symbols.

The biometric information management apparatus 150 or 350 may generate authentication information by matching a unit area having the same identification number as a password among the plurality of unit areas with the password (S1110). Here, the password may be a password input from the user, for example, a password for authenticating the user. The password may be composed of at least one of letters, numbers, and symbols in the same manner as the identification number. However, as described above, the second processing unit 720 does not generate an authentication number, and after matching a unit area having the same identification number as the password among the plurality of unit areas with the password, the processing unit 120 generates a second number. The authentication information can also be generated by encrypting with 1 key value.

The authentication information generated by the biometric information management apparatus 150 or 350 or the processing unit 120 may be transmitted to the server (S1120). The server 300 may transmit the authentication result to the financial device 200 by comparing the transmitted authentication information with previously stored reference information.

Referring to FIG. 12, the reference line connecting both end points of the eyes included in the iris image may be rotated to be horizontal to divide the iris image into a plurality of unit areas having an identification number (or the identification number may be a plurality of units). May be stored in association with feature points within the area). This is to keep the position, size, etc. of the divided unit regions constant when the biometric information management units 150 and 350 divide the iris image into a plurality of unit regions. Therefore, the accuracy of user authentication using the iris image can be improved.

Referring to FIG. 13, when the input unit 110 receives a fingerprint image from the user, the input unit 110 may provide a guide line for fingerprint input to the user. This is to obtain an accurate fingerprint image from the user, and to minimize errors in user authentication using a fingerprint image input later. The biometric information management unit 150 or 350 may divide the biometric information image into a plurality of unit areas having an identification number. For example, the biometric information management unit 150 or 350 may divide the biometric information image into n unit areas (n ≧ 2, n is a natural number). The n value may be determined in consideration of the minimum area where the biometric information image can be identified. The biological information managers 150 and 350 may assign an identification number to each of the n unit areas.

14 is a block diagram showing a financial transaction system according to another embodiment of the present invention.

Referring to FIG. 14, a financial transaction system 1400 according to an embodiment of the present invention may include a financial device 1410 and a server 1420.

The financial device 1410 may be substantially the same as the financial device 1410 described with reference to FIGS. 12 and 13.

That is, the financial device 1410 may receive a password and biometric image from the user to proceed with the transaction requested by the user. The financial device 1410 may divide the input biometric image into a plurality of unit areas having an identification number. The financial device 1410 may generate authentication information by matching the unit area having the same identification number as the password among the plurality of unit areas with the password. Alternatively, authentication information may be generated by receiving a key value from the server 1200 and encrypting it. The financial device 1410 may request the user authentication by transmitting the generated authentication information to the server 1420.

The server 1420 may compare the authentication information transmitted from the financial device 1410 with previously stored reference information and transmit the authentication result to the financial device 1420. For example, the server 1420 may include a storage unit 330 that stores the authentication information and / or reference information. The server 1420 may compare the password included in the authentication information with a previously stored password. The server 1420 may compare the unit area having the same identification number as the password included in the authentication information and the previously stored unit area.

For example, when the authentication information transmitted from the financial device 1410 matches the reference information, the server 1420 may transmit an authentication success message to the financial device 1410. For example, if the authentication information transmitted from the financial device 1410 does not match the reference information, the server 1420 may transmit an authentication failure message to the financial device 1410. For example, the server 1420 may output an authentication failure message when at least one of the unit area having the same identification number as the password and password included in the authentication information does not match the password and unit area included in the reference information. 1410.

As described above, the biometric information management apparatus 150 or 350 according to the exemplary embodiment may store only a part of the biometric information having the same identification number as the password. Therefore, the biometric information, which is the user's personal information, can be protected from hacking / leakage. In addition, the user's refusal to transmit or store all of his personal information to the trading institution can be minimized.

In the above description, it is described that all the components constituting the embodiments of the present invention are combined or operated in one, but the present invention is not necessarily limited to these embodiments. In other words, within the scope of the present invention, all of the components may be selectively operated in combination with one or more. In addition, although all of the components may be implemented in one independent hardware, each or all of the components may be selectively combined to perform some or all functions combined in one or a plurality of hardware. It may be implemented as a computer program having a. Codes and code segments constituting the computer program may be easily inferred by those skilled in the art. Such a computer program may be stored in a computer readable storage medium and read and executed by a computer, thereby implementing embodiments of the present invention. The storage medium of the computer program may include a magnetic recording medium, an optical recording medium, a carrier wave medium, and the like.

In addition, the terms "comprise", "comprise" or "having" described above mean that the corresponding component may be inherent unless specifically stated otherwise, and thus excludes other components. It should be construed that it may further include other components instead. All terms, including technical and scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art unless otherwise defined. Terms used generally, such as terms defined in a dictionary, should be interpreted to coincide with the contextual meaning of the related art, and shall not be interpreted in an ideal or excessively formal sense unless explicitly defined in the present invention.

The above description is merely illustrative of the technical idea of the present invention, and those skilled in the art to which the present invention pertains may make various modifications and changes without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention but to describe the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The protection scope of the present invention should be interpreted by the following claims, and all technical ideas within the equivalent scope should be interpreted as being included in the scope of the present invention.

Claims (20)

Receive the first user authentication result, the encrypted user authentication information and the first key value from the terminal of the user, and transmits the encrypted user authentication information to the server, and receives the second user authentication result and the second key value from the server Communication unit; And If the result of the second user authentication is successful, proceed with the financial transaction requested by the user, perform the third user authentication by comparing the received first key value and the second key value, and authenticate the third user authentication. And a processing unit for final approval processing of the requested financial transaction if the result is authentication success. The method according to claim 1, And the processor determines the authentication result of the third user authentication as an authentication success when the first key value and the second key value are the same. The method according to claim 1, The encrypted user authentication information includes biometric information, And the biometric information is biometric information of a unit region corresponding to a password input from a user among biometric information divided into n unit regions (n≥2, n is a natural number) each having an identification number. The method according to claim 3, The biometric information includes a feature point of the biometric information image. Each identification number is assigned in association with a feature point of the biometric information image, The bioinformation image includes a iris image, a fingerprint image, and a vein image. The method according to claim 4, The first user authentication is performed by comparing the biometric information of the input user and the biometric information previously stored in the terminal. The method according to claim 4, The identification number and the password is a financial device consisting of a combination of at least one of letters and numbers. A biometric information management unit for dividing the biometric information input from the user into a plurality of unit areas having an identification number and generating biometric information from the unit area having the same identification number as the password input from the user among the plurality of unit areas; A processor configured to perform first user authentication by comparing the extracted biometric information received from the user with previously stored biometric information; And Receiving a first key value from the server, a terminal including a communication unit for transmitting the authentication information encrypted using the result of the first user authentication and the first key value, and transmitting the authentication information or the first key value to a financial device . The method according to claim 7, The biometric information management unit divides the received biometric information into n unit areas (n≥2, n is a natural number), and assigns an identification number to each of the n unit areas. The method according to claim 8, If the biometric information image is an iris image, The biometric information management unit is configured to rotate the reference line connecting both end points of the eyes included in the iris image to be horizontal to divide the iris image into a plurality of unit areas having the identification number. The method according to claim 8, Further comprising an input unit for receiving a password and biometric information from the user, The input unit provides a guide line for fingerprint input to a user when the fingerprint image is input. The method according to claim 8, The biometric information includes a feature point of the biometric information image. Each identification number is assigned in association with a feature point of the biometric information image, The biometric image includes at least one of an iris image, a fingerprint image, and a vein image. The method according to claim 7, When the biometric information input from the user and the previously stored biometric information match, the first user authentication result is an authentication approval. A biometric information management unit for dividing a user's biometric information into a plurality of unit areas having an identification number and generating biometric information extracted from a unit area having an identification number identical to a password among the plurality of unit areas; A communication unit for transmitting a first key value to a terminal, receiving authentication information including biometric information of the user from the terminal and encrypted with the first key value, and transmitting a result of the second user authentication to the financial device; And And a processor configured to decode the received authentication information and perform the second user authentication by comparing the user's biometric information included in the authentication information with the stored user's biometric information. The method according to claim 13, And the biometric information management unit divides the biometric information into n unit areas (n≥2, n is a natural number), and assigns an identification number to each of the n unit areas. The method according to claim 14, The n value is determined in consideration of the minimum area that can identify the biometric information in the biometric information. The method according to claim 13, And when the biometric information stored in the authentication information transmitted from the terminal matches the stored biometric information, the result of the second user authentication is an authentication approval. Receiving, by the terminal, biometric information and a password for a financial transaction from a user; Performing, by the terminal, first authentication using the biometric information; Generating, by the terminal, authentication information by encrypting the password, the biometric information, and the unique information of the user; Transmitting, by the terminal, the authentication information to a financial device when the first authentication is successful; Transmitting, by the financial device, the authentication information to a server; Decrypting, by the server, the authentication information and performing second authentication using the password, the biometric information, and the unique information of the user; And And transmitting, by the server, the authentication result of the second authentication to the financial device. The method according to claim 17, The biometric information is divided into biometric information of an input user into a plurality of unit areas having an identification number, and the financial transaction system, which is biometric information about a unit area having an identification number equal to a password input from a user among the plurality of unit areas Method of operation. The method according to claim 17, Determining, by the financial device, whether or not to proceed with a financial transaction according to the authentication result of the second authentication; Receiving a second key value from the server; Receiving the first key value from the terminal; Performing, by the financial device, third authentication using the first key value and the second key value; And And determining whether or not the financial transaction is finally approved according to the authentication result of the third authentication. The method according to claim 19, Receiving a second key value from the server; Receiving the first key value from the terminal; Performing, by the financial device, third authentication using the first key value and the second key value; And The determining of the final approval of the financial transaction according to the authentication result of the third authentication is performed when the financial transaction proceeds because the authentication result of the second authentication is successful.

Images