# US 10,313,338 B2 · Authentication method and device using a single-use password including biometric image information > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,338 B2 - Document ID: US10313338B2 - Status: Granted - Kind: B2 - Application number: 14/233,140 - Filed: 2011-08-23 - Published: 2014-09-04 - Granted: 2019-06-04 - Earliest claimed: 2011-07-15 - Assignees: Iritech, Inc. - Applicants: Dae-hoon Kim; Hyeong-in Choi; Tuyen Nguyen; Dung Pham - Inventors: Dae-hoon Kim; Hyeong-in Choi; Tuyen Nguyen; Dung Pham - Web page: https://patentgrep.com/patent/US10313338B2 ## CPC - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - G06V 40/10: Human or animal bodies, e.g. vehicle occupants or pedestrians; Body parts, e.g. hands - G06V 40/197: {Matching; Classification} - H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key} - H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - G06V 40/53: {Measures to keep reference information secret, e.g. cancellable biometrics} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06V: IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING ## Abstract The present invention relates to an authentication method and device using a single-use password generated from iris image information. The device comprises: a terminal and a server storing, in respective memories thereof, the iris image information for authentication; a camera attached to and installed on the device to capture the iris image information for authentication; the terminal, which generates the single-use password from the iris image information acquired through the camera, and transmits the single-use password to the server; and the server, which has a built-in algorithm for comparing and determining whether or not the single-use password transmitted from the terminal matches single-use password stored in the server. ## Claims ### Claim 1 An authentication method using a single-use password generated from iris image information, comprising: registering and storing iris image information for authentication in memories of a terminal and a server, respectively; generating a plurality of single-use passwords using a hash function, wherein a portion of the iris image information relevant to a biometric characteristic of the user is used to seed the hash function when generating the plurality of single-use passwords; storing at least one single-use password in the memories of the terminal and the server, respectively, wherein the single-use password comprises data generated by the hash function, and wherein in a hash data chain of the hash function, a n-th hash data H_n is stored in the memory of the server and another n−1 hash data are stored in the memory of the terminal; after generating the hash data chain, the hash function deletes the iris image information used as a variable to seed the hash function from the memories of the terminal and the server; photographing and acquiring a second iris image information for authentication using a camera attached to the terminal; transmitting a single-use password comprising the i-th hash data in the hash data chain stored in the terminal to the server; performing authentication by determining whether the single-use password transmitted from the terminal matches the single-use password stored in the server which has an embedded algorithm for matching between single-use passwords; and deleting hash data following the i-th hash data in the hash data chain from the memory of the terminal to prevent the deleted hash data from being used as a single-use password in a future authentication, and wherein hash data that precedes the i-th hash data in the hash data chain is maintained within the memory of the terminal for subsequent use as another single-use password. ### Claim 2 (depends on 1) The authentication method according to claim 1, wherein Fourier transformation or wavelet transformation are applied to generate an iris image template from the iris image information, and wherein the iris image template is used as the seed to the hash function. ### Claim 3 (depends on 1) The authentication method according to claim 1, wherein a whole iris image is not used as the seed image but only those pixels in a certain sub-region of the iris image information which includes the biometric characteristic of the user. ### Claim 4 (depends on 1) The authentication method according to claim 1, further comprising: encoding the single-use password; and decoding the encoded single-use password at the server. ### Claim 5 (depends on 1) The authentication method according to claim 1, wherein, to determine whether a hash data H_i transmitted from the terminal is a user's single-use password, the server applies at least once the hash function to H_i; when the result hash data of the hash function matches H_n stored in the server, the server determines that H_i is a user's single-use password. ### Claim 6 (depends on 5) The authentication method according to claim 5, wherein both the terminal and the server update the existing hash data when the single-use passwords are matched with each other and approval is given; and updating is performed whenever approval is given, or limited by a preset update frequency in consideration of a burden on the terminal and the server. ### Claim 7 (depends on 6) The authentication method according to claim 6, wherein the hash data is updated based on the iris second image information photographed for authentication. ### Claim 8 (depends on 1) The authentication method according to claim 1, wherein the second iris image information and terminal identification (ID) are further added to data transmitted for authentication from the terminal to the server. ### Claim 9 An authentication device using a single-use password, comprising: a camera attached to the device to photograph and acquire iris image information for authentication, a terminal that stores the iris image information for authentication in memory, generates a plurality of single-use passwords, captures a second iris image information through the camera and transmits a single-use password comprising an i-th hash data in a hash data chain to the server, wherein the single-use password comprises at least data generated by a hash function and optionally one of the combinations of the second iris image information and terminal identification (ID), and wherein a portion of the iris image information relevant to a biometric characteristic of a user is used to seed the hash function when generating the plurality of single-use passwords; a server that stores the iris image information for authentication in memory and has an embedded algorithm for comparing and determining whether the single-use password transmitted from the terminal matches the single-use password stored in the server, wherein in the hash data chain generated with the hash function, a n-th hash data H_n is stored in the memory of the server and another n−1 hash data from the hash data chain are stored in the memory of the terminal, wherein after generating the hash data chain, the hash function deletes the iris image information used as a variable to seed the hash function from the memories of the terminal and the server; wherein after authentication is performed, hash data following the i-th hash data in the hash data chain is deleted from the memory of the terminal to prevent the deleted hash data from being used as a single-use password in a future authentication with the server, and wherein hash data that precedes the i-th hash data in the hash data chain is maintained within the memory of the terminal for subsequent use as another single-use password. ### Claim 10 (depends on 9) The authentication device according to claim 9, wherein Fourier transformation or wavelet transformation are applied to generate an iris image template from the iris image information, and wherein the iris image template is used as the seed to the hash function. ### Claim 11 (depends on 9) The authentication device according to claim 9, wherein a whole iris image is not used as the seed image but only those pixels in a certain sub-region of the iris image information which includes the biometric characteristic of the user. ### Claim 12 (depends on 9) The authentication device according to claim 9, wherein the single-use password is encoded in order to improve security of the authentication device, and the encoded single-use password is decoded at the server. ### Claim 13 (depends on 9) The authentication device according to claim 9, wherein, to determine whether a hash data H_i transmitted from the terminal is a user's single-use password, the server applies at least once the hash function to H_i; when the hash data of the hash function matches H_n stored in the server, the server determines that H_i is a user's single-use password. ### Claim 14 (depends on 13) The authentication device according to claim 13, wherein both the terminal and the server update the existing hash data when the single-use passwords are matched with each other and approval is given; and updating is performed whenever approval is given, or limited by a preset update frequency in consideration of a burden on the terminal and the server. ### Claim 15 (depends on 13) The authentication device according to claim 13, wherein the hash data is updated based on the iris image information photographed for authentication. ### Claim 16 An authentication device using a single-use password, comprising: a smart card which stores single-use passwords generated from iris image information, wherein the single-use password comprises at least a hash data chain generated by a hash function and optionally one of the combinations of iris image information and support identification (ID), wherein a portion of the iris image information relevant to a biometric characteristic of a user is used to seed the hash function when generating the plurality of single-use passwords; a support provided with a camera for photographing second iris image information for authentication and with a smart card reader; and a server that stores the iris image information for authentication in memory and has an embedded algorithm for determining whether a single-use password comprising an i-th hash data in the hash data chain transmitted from the support matches the single-use password stored in the server, and wherein in the hash data chain of the hash function, a n-th hash data H_n is stored in the memory of the server and another n−1 hash data are stored in the memory of the smart card, wherein, after generating the hash data chain, the hash function deletes the iris image information used as a variable to seed the hash function from the memory of smart card; wherein hash data is deleted from the smart card following authentication with the i-th hash data in the hash data chain from the smart card to prevent the deleted hash data from being used as a single-use password in a future authentication, and wherein hash data that precedes the i-th hash data in the hash data chain is maintained within the smart card for subsequent use as another single-use password. ### Claim 17 (depends on 16) The authentication device according to claim 16, wherein Fourier transformation or wavelet transformation are applied to generate iris image template from the iris image information, and wherein the iris image template is used as the seed to the hash function. ### Claim 18 (depends on 16) The authentication device according to claim 16, wherein a whole iris image is not used as the seed, but only those pixels in a certain sub-region of the iris image information which include the biometric characteristic of the user. ### Claim 19 (depends on 18) The authentication device according to claim 18, wherein the smart card encodes the single-use password and transmits the encoded single-use password to the server, and the server decodes the encoded single-use password. ### Claim 20 (depends on 16) The authentication device according to claim 16, wherein, to determine whether a hash data H_i transmitted from the smart card is a user's single-use password, the server applies at least once the hash function to H_i; when the hash data of the hash function matches H_n stored in the server, the server determines that H_i is a user's single-use password. ### Claim 21 (depends on 20) The authentication device according to claim 20, wherein the hash data is updated based on the iris image information photographed for authentication.