AUTHENTICATION IN UBIQUITOUS ENVIRONMENT

• US 20150312041A1
• Filed: 04/22/2015
• Published: 10/29/2015
• Est. Priority Date: 11/17/2009
• Status: Active Grant

• Current Assignee: Unho Choi
• Original Assignee: Unho Choi
• Inventors: CHOI, Unho
• Granted Patent: US 9,832,019 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

In some embodiments, encrypted biometric data are stored in advance in a device that is possessed or carried by a user (for example, a smartcard, a communication terminal, or the like) based on a public key certificate, and a user authentication (first user authentication) is performed by a biometric matching in the device. A public key certificate matching the encrypted biometric data is used to perform a user authentication (second user authentication) for a transaction authorization in a service providing server. According to some embodiments, one time password, keystroke, dynamic signature, location information, and the like are employed as additional authentication factors to tighten the security of the first and second user authentications. According to some embodiments, an authentication mechanism including the first user authentication and the second user authentication is applied to control an access to the IoT device.

Claims

1. A method of registering a user in an authentication management system based on a public key certificate, the method performed by a portable device of the user, the method comprising:

encrypting biometric data or a combination of pieces of biometric data of the user by using an encryption algorithm defined in the public key certificate;

storing encrypted biometric data or encrypted combination of the pieces of biometric data in the portable device;

tokening the encrypted biometric data or the encrypted combination of the pieces of biometric data to generate a biometric code;

generating a pair of keys including a private key and a public key by inserting a verification code containing at least the biometric code in an extension field of the public key certificate;

transmitting the public key to a remote entity; and

requesting a registration of the user.

2. The method according to claim 1, wherein the verification code the verification code further contains an additional code generated by encrypting unique identity data assigned to the portable device and tokening encrypted unique identity data.

3. The method according to claim 1, wherein the verification code the verification code further contains an additional code generated by encrypting characteristic information indicating behavioral characteristics of the user and tokening encrypted characteristic information.

4. The method according to claim 1, wherein the verification code the verification code further contains an additional code generated by encrypting location information indicating a position where an authentication of the user is requested and tokening encrypted location information.

5. The method according to claim 1, wherein the verification code the verification code further contains an additional code generated by encrypting unique identity data assigned to the user and tokening encrypted unique identity data.

6. The method according to claim 1, wherein the generating includes generating the pair of keys by inserting biometric codes respectively derived from different biometric data or different combinations of pieces of biometric data into a plurality of public key certificate, respectively.

7. The method according to claim 6, wherein the plurality of public key certificates has different usages from each other.

8. The method according to claim 1, wherein the generating includes

generating an additional biometric code from biometric data or a combination of pieces of the biometric data different from the biometric data or the combination of the pieces of biometric data used for generating the biometric code, and

generating the pair of keys by further inserting a further verification code containing at least the additional verification code in the extension field of the public key certificate.

9. The method according to claim 8, wherein the additional verification code is defined to notify a fact that the private key has been used due to a coercion from a third party.

10. The method according to claim 8, wherein the additional verification code is defined to request a cancelation of a user registration performed at the remote entity based on the public key transmitted at the transmitting.

11. The method according to claim 8, wherein the additional verification code is defined to request an initialization of an authentication management system managed by the remote entity.

12. The method according to claim 1, wherein the extension field of the public key certificate further contains at least one of electronic resident card, driver'"'"'s license, electronic money, or medical card, as additional information corresponding to a designated purpose of use of the public key certificate.

13. The method according to claim 1, wherein the extension field of the public key certificate further contains URL (Uniform Resource Locator) information of the remote entity to which the public key is to be transmitted.

14. The method according to claim 1, further comprising:

encrypting device identity data assigned to an IoT (Internet of Things) device; and

tokening encrypted device identity data to generate an additional code, wherein

the additional code is further inserted in the extension field of the public key certificate.

15. The method according to claim 14, further comprising generating pairs of keys including a private key and a public key respectively associated with a plurality of IoT devices different from each other by respectively inserting biometric codes derived from different pieces of biometric data or combinations of different pieces of biometric data and additional codes derived from pieces of device identity data of different IoT devices in a plurality of public key certificates.

16. The method according to claim 8, wherein the transmitting includes transmitting the public key to the remote entity via a virtual private network.

17. The method according to claim 1, wherein the portable device includes a smartcard or a mobile communication terminal.

18. A method of authenticating a user in an authentication management system based on a public key certificate, the method performed by a portable device of the user, the portable device storing a private key in which a verification code including a biometric code is inserted and encrypted biometric data or an encrypted combination of pieces of biometric data from which the biometric code is derived, the method comprising:

acquiring biometric data or a combination of pieces of biometric data of the user;

comparing the biometric data or the combination of pieces of biometric data of the user with at least one of the encrypted biometric data or the encrypted combination of pieces of biometric data stored in the portable device or the biometric code;

transmitting, when the biometric data or the combination of pieces of biometric data of the user matches the at least one of the encrypted biometric data or the encrypted combination of pieces of biometric data, authentication information including the verification code inserted in the private key to a remote entity; and

requesting an authentication of the user.

19. The method according to claim 18, wherein the verification code inserted in the private key further contains at least one of a first additional code derived from unique identity data assigned to the portable device, a second addition code derived from location information indicating a position where the authentication of the user is requested, a third additional code derived from unique identity data assigned to the user, a fourth additional code derived from characteristic information indicating behavior characteristics of the user, or a fifth additional code derived from device identity data assigned to an IoT (Internet of Things) device.

20. The method according to claim 18, wherein the authentication information further contains an OTP (One Time Password) generated by an OTP generation module built in the portable device.

21. The method according to claim 18, wherein the authentication information further contains time information on a time when the authentication information is transmitted.

22. The method according to claim 18, wherein the authentication information further contains location information on a position where the authentication of the user is requested.

23. The method according to claim 18, wherein the authentication information further contains time information on a time when the private key is generated.

24. The method according to claim 18, wherein the transmitting includes transmitting the public key to the remote entity via a virtual private network.

25. The method according to claim 24, wherein a destination URL (Uniform Resource Locator) of the virtual private network is contained in an extension field of the private key.

26. The method according to claim 18, wherein the portable device includes a smartcard or a mobile communication terminal.

27. A method of managing an authentication of a user in an authentication management system based on a public key certificate, the method performed by a remote entity connected to a portable device of the user via a network, the method comprising:

receiving, from the portable device, a public key corresponding to a private key in which a verification code including a biometric code derived from biometric data or a combination of pieces of biometric data of the user is inserted;

performing a registration of the user based on the public key;

receiving, from the portable device, authentication information including the verification code inserted in the private key;

verifying the authentication information based on the public key; and

performing the authentication of the user based on a result of the verifying.

28. A method of managing an authentication of a user in an authentication management system based on a public key certificate, the method performed by a public terminal configured to provide a predetermined service and a service providing server configured to manage the public terminal, the method comprising:

receiving including the service providing server receiving, from a portable device of a user, a public key corresponding to a private key in which a verification code including a biometric code derived from biometric data or a combination of pieces of biometric data of the user is inserted;

performing including the service providing server performing a registration of the user based on the public key;

receiving including the public terminal receiving, from the portable device, authentication information including the verification code inserted in the private key;

requesting including the public terminal requesting the service providing server to perform a verification of the authentication information based on the public key;

performing including the public terminal performing the authentication of the user based on a result of the verification; and

providing including the public terminal providing, when the authentication of the user is successful, the predetermined service.

29. The method according to claim 28, wherein the performing a registration of the user includes

generating including the service providing server generating a modified public key including a verification code from the public key, the modified public key configured to be used when the public terminal and the service providing server are in an offline state, and

transmitting including the service providing server transmitting the modified public key to the portable device.

30. The method according to claim 29, further comprising:

receiving including the public terminal receiving, from the portable device, when the public terminal and the service providing server are in the offline state, the verification code inserted in the private key and the verification code inserted in the modified public key;

verifying including the public terminal verifying whether or not the verification codes are generated based on the same public key certificate;

providing including the public terminal providing, when the verifying is successful, a limited service with a service range narrower than that provided when the public terminal and the service providing server are in an online state; and

transmitting including the public terminal transmitting, to the service providing server, when the offline state is changed to the online state, the verification codes and information on providing the service;

performing including the service providing server performing a verification of the verification codes;

adjusting including the service providing server balancing the information on providing the service based on a result of the verification.