Device and system for providing identification information

Abstract

An electronic device is disclosed, comprising: a communication circuit configured to communicate with at least one authentication server to provide an identification authentication service; and a processor, wherein the processor is configured to: send first identification information corresponding to an object for which identification information is provided, and second identification information corresponding to the electronic device to at least one authentication server; receive information about a first item of multiple items of identification information from at least one authentication server, the information about the first item being determined at least in part based on the first identification information and the second identification information; and in response to successful user authentication, display information corresponding to a first value associated with the first item of multiple items of identification information through a display. Various other embodiments understood by the specification are also possible.

Description

Technical Field

[0001] Embodiments disclosed in this specification relate to technology for providing identity information of a user of an electronic device. Background Art

[0002] Identity information can be verified offline using, for example, a plastic card, so the user needs to carry the identity card in person. Nowadays, as payment services using electronic devices become active, mobile identity cards (e.g., student IDs or employee IDs) that can replace physical cards are being used. For example, the mobile identity card can be supported by an application installed in the electronic device. Summary of the invention

[0003] Technical issues

[0004] The electronic device can output a mobile identity card on a display. The mobile identity card may include various personal information (e.g., name, resident registration number, and address). The user is reluctant to disclose various personal information to others through the screen. Depending on the various situations in which the mobile identity card is used, the information that must be provided may be different. The various embodiments disclosed in this specification are intended to provide a portable electronic device that can provide only necessary identity information according to the situation.

[0005] Technical Solution

[0006] According to an embodiment disclosed in this specification, an electronic device may include: a communication circuit that communicates with at least one authentication server that provides an identity authentication service; a display; at least one memory that stores identity information associated with a user registered in the identity authentication service, and the identity information includes multiple items and values ​​corresponding to the multiple items; and a processor. The processor may be configured to: obtain first identification information corresponding to an object to be provided with identity information; send the first identification information and second identification information corresponding to the electronic device to at least one authentication server; receive information about a first item of multiple items of identity information from at least one authentication server, the first item being determined at least in part based on the first identification information and the second identification information; perform user authentication on the user; and in response to the success of the user authentication, display information corresponding to a first value through the display, the first value corresponding to the first item of multiple items of identity information.

[0007] In addition, according to the embodiments disclosed in this specification, a system for providing identity authentication services may include: at least one authentication server providing identity authentication services; an electronic device of a user registered in the identity authentication service, which includes identity information of the user (including multiple items and values ​​corresponding to the multiple items respectively); and an external device registered in the identity authentication service. The external device may send first identification information associated with the external device to the electronic device. The electronic device may send the first identification information and the second identification information corresponding to the electronic device to at least one authentication server. At least one authentication server may send information about a first item determined based on the first identification information and the second identification information among multiple items to the electronic device. The electronic device may perform user authentication on the user, and may display information associated with the first value (corresponding to the first item) through the electronic device or the external device in response to the success of the user authentication.

[0008] Beneficial Effects

[0009] According to the embodiments disclosed in this specification, the electronic device can provide identity information differently according to the situation. In addition, various effects directly or indirectly understood through this specification can be provided. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] Figure 1 A block diagram of an identity authentication system and an electronic device according to an embodiment is shown.

[0011] Figure 2 is a flow chart showing how an electronic device provides identity information according to an embodiment.

[0012] Figure 3 is a signal flow diagram of a method for providing identity information according to an embodiment.

[0013] Figure 4 is a signal flow chart of a method for changing a UI including identity information according to an embodiment.

[0014] Figure 5 is an example of a mobile identity card that includes situation-dependent identity information in various embodiments.

[0015] Figure 6 is an example of a mobile identity card that, in various embodiments, provides identity information that varies based on user selections.

[0016] Figure 7 is a signal flow diagram of a method for providing identity information according to various embodiments.

[0017] Figure 8 is a signal flow chart of a method of performing identity authentication in an external device according to various embodiments.

[0018] Fig. 9 An electronic device in a network environment according to various embodiments is shown.

[0019] In the description of the drawings, the same or similar components are marked with the same or similar reference numerals. DETAILED DESCRIPTION

[0020] Hereinafter, various embodiments of the present disclosure will be disclosed with reference to the accompanying drawings. However, it should be understood that this is not intended to limit the present disclosure to a specific implementation form, but includes various modifications, equivalent forms and / or alternative forms of the embodiments of the present disclosure.

[0021] Figure 1 A block diagram of an identity authentication system and an electronic device according to an embodiment is shown.

[0022] According to an embodiment, the identity authentication system 10 can provide an identity authentication service for a user registered in the identity authentication service. The identity authentication system 10 may include an electronic device 100 (e.g., Fig. 9 electronic device 901), authentication server 50 and external device 70.

[0023] For example, the authentication server 50 can provide an identity authentication service. The electronic device 100 and the external device 70 can provide an identity authentication service by communicating with the authentication server 50. The identity authentication system 10 may include a plurality of authentication servers. However, the identity authentication system 10 consisting of a single authentication server 50 is disclosed below by way of example. The electronic device 100 can exchange identity information and information associated with the identity information between the authentication server 50 and the external device 70.

[0024] For example, it is understood that the electronic device 100 is a portable electronic device such as a smart phone or a tablet. Alternatively, the electronic device 100 may be a wearable device worn on a part of the user's body. It is understood that the electronic device 100 is an electronic device owned by a user registered in the identity authentication service. The electronic device 100 may store identity information associated with the user.

[0025] For example, it can be understood that the external device 70 is a device installed in an offline object (e.g., a store or institution). For example, the external device 70 can be a point of service (POS) machine. The external device 70 can have a unique identity (ID) for each device or each offline object (hereinafter referred to as "object ID"). The external device 70 can perform specific functions (e.g., transactions or member registration) that require the user's identity information. Each specific function can have an ID for each function (hereinafter referred to as "function ID"). In various embodiments, the external device 70 can receive the identity information necessary to perform a specific function from the electronic device 100 and / or the authentication server 50.

[0026] For example, the authentication server 50 may have information about items of identity information necessary for the external device 70 to perform a specific function (hereinafter referred to as "necessary items"). The authentication server 50 may send the information about the necessary items to the electronic device 100. The electronic device 100 may operate the identity information about the user of the electronic device 100 based on the received information. In various embodiments, the authentication server 50 may pre-store whether the electronic device 100 or the external server 70 has access to the identity information stored in the electronic device 100. Therefore, the authentication server 50 may include items with access rights in the necessary items. In an embodiment, the electronic device 100 may include a processor 110 (for example, Fig. 9 processor 920), memory 120 (e.g., Fig. 9 Memory 930), communication circuit 130 (e.g., Fig. 9 communication module 990) and display 140 (e.g., Fig. 9 The processor 110 may control the overall operation of the electronic device 100. The electronic device 100 may transmit and receive data with the authentication server 50 and the external device 70 through the communication circuit 130.

[0027] In an embodiment, the memory 120 may store identity information associated with a user registered in an identity authentication service. For example, the identity information may include a plurality of items and values ​​corresponding to the plurality of items, respectively. For example, when the item is a date of birth, the value may be stored as data in a digital form of year-month-day. In an embodiment, the memory 120 may store a first application 122 for providing an identity authentication service. In various embodiments, the electronic device 100 may launch the first application 122, and may output an execution screen of the first application 122 through the display 140. The execution screen may include a user interface (hereinafter referred to as "UI") including the user's identity information in at least a portion of the execution screen. In various embodiments, the UI may be implemented in various forms depending on the type of identity information to be displayed. This will be referred to later. Figure 5 and Figure 6Describes an example of a UI.

[0028] In various embodiments, the electronic device 100 may include a security element (SE) 124. The security element 124 may store identity information 126. For example, the security element 124 may have limitations when communicating directly with an external device such as an authentication server 50 or an external device 70. In this case, the security element 124 may store a second application installed directly therein. In this case, the second application may relay data transmission / reception between the security element 124 and the authentication server 50 or the external device 70. In another example, the authentication server 50 or the external device 70 may communicate with the security element 124 via short-range wireless communication.

[0029] Figure 2 is a flow chart showing how an electronic device provides identity information according to an embodiment Figure 1 .

[0030] refer to Figure 2 The identity information providing method according to the embodiment may include operations 210 to 250. For example, operations 210 to 250 may be performed by Figure 1 The electronic device 100 shown in FIG. 1 is executed. For example, operations 210 to 250 may be implemented respectively by instructions that can be executed (or run) by the processor 110 of the electronic device 100. The instructions may be stored in, for example, Figure 1 In the computer-readable recording medium or memory 120 of the electronic device 100 shown in FIG. 1 , in the description associated with operations 210 to 250, the description associated with reference to FIG. 1 may not be repeated here. Figure 1 The description given is the same as the description given.

[0031] In operation 210, the electronic device 100 may obtain first identification information corresponding to an object to which identity information is to be provided. For example, the electronic device 100 may obtain first identification information from an external device 70 corresponding to an object to which identity information 126 is to be provided through the communication circuit 130. For example, the first identification information may include an object ID for an object associated with the external device 70, and a function ID for a function (e.g., transaction or membership registration) performed by the external device 70.

[0032] In operation 220, the electronic device 100 may send first identification information and second identification information corresponding to the electronic device to the authentication server 50. For example, the second identification information may include a user ID registered in the identity authentication service. It is understood that the second identification information refers to information necessary for the authentication server 50 to identify or authenticate the user of the electronic device 100.

[0033] In operation 230, the electronic device 100 may receive information about a first item of multiple items of identity information 126 from the authentication server 50, the first item being determined based on the first identification information and the second identification information. For example, it can be understood that the first item is the first item of the plurality of items of identity information 126. Figure 1 The authentication server 50 may select information about items required for the external device 70 to perform a specific function from among the identity information stored in the electronic device 100 or the authentication server 50. For example, the necessary items may be mapped to a function ID or an object ID and may then be stored.

[0034] At operation 240, the electronic device 100 may perform user authentication on the user. In various embodiments, the electronic device 100 may display a UI for requesting user authentication through the execution screen of the first application 122. The electronic device 100 may obtain authentication information of the user in response to the display on the UI. For example, the authentication information may include at least a portion of a password and biometric information (e.g., fingerprint information, iris information, or facial information).

[0035] In operation 250 , the electronic device 100 may display information corresponding to the first value (which corresponds to the first item among the plurality of items of the identity information 126 ) through the display 140 in response to success of the user authentication.

[0036] In an embodiment, the electronic device 100 may display the first value through the display 140. For example, when the value corresponding to the item of the date of birth is "1990-01-01", the electronic device 100 may display "1990-01-01" or "January 1, 1990" on the display 140. A user who has subscribed to the identity authentication service may perform identity authentication required by an offline object by presenting the identity information displayed on the electronic device 100 to the offline object.

[0037] In various embodiments, the electronic device 100 may generate a second value obtained by omitting at least a portion of the first value, and may display the second value through the display 140. For example, when "Are you an adult" is information required for an offline object, the electronic device 100 may display only information about the "year" in the date of birth on the display 140. In various embodiments, the electronic device 100 may generate a specific UI based on the first value. The electronic device 100 may display the generated UI on the display 140 through the execution screen of the first application 122. For example, when "Are you an adult" is information required for an offline object, the electronic device 100 may display a UI including phrases "I am an adult" and "I am over 19 years old" on the display 140. Reference will be made to Figure 6 Related embodiments are described.

[0038] In various embodiments, the electronic device 100 may send a first value to the external device 70. In this case, the external device 70 may perform a specific function by using the received first value. For example, when receiving a real value associated with "Are you an adult?", the external device 70 may pay for alcoholic beverages and cigarettes based on the real value. For another example, the external device 70 may receive values ​​associated with a plurality of items required for member registration, respectively, and may perform a member registration function with respect to the user by using these values.

[0039] Figure 3 is a signal flow of a method for providing identity information according to an embodiment Figure 2 . Figure 4 is a signal flow of a method for changing a UI including identity information according to an embodiment Figure 3 .

[0040] In the following, reference will be made to Figure 3 to Figure 4 A specific example of the operation performed by the identity authentication system 10 is described. In various embodiments, the user ID registered in the identity authentication service may be referred to as a "server ID". For example, a user who has subscribed to the identity authentication service may receive a server ID. The electronic device 100 may store the corresponding server ID in the memory 120.

[0041] It is understood that the authentication server 50 is one or more servers that provide the above-mentioned identity authentication service. In various embodiments, it can be assumed that at least a portion of the server ID and information about the electronic device 100 (eg, Figure 1 The electronic device 100 or Fig. 9 At least a portion of the identity information of the user of the electronic device 100 (the electronic device 901) is pre-stored in the memory of the authentication server 50. In some embodiments, information about the electronic device 100 registered in association with the server ID may be further stored in the memory of the authentication server 50. The authentication server 50 may include a server ID corresponding to each user who has subscribed to the identity authentication service, information about the electronic device 100, or at least a portion of the identity information about the user. The electronic device 100 may map the server ID to the first application 122, and may store the mapping result in the memory 120. For example, it will be understood that the external device 70 is an electronic device installed in an offline object (e.g., a store or an institution). In the following, stores in the offline object are described by way of example. The authentication server 50 may store a store ID corresponding to each store that has subscribed to the identity authentication service (e.g., Figure 2 ), the transaction ID of the transaction conducted by the corresponding store (for example, Figure 2The function ID in the store, and the identity information required for the corresponding store. It can be understood that the store ID is a unique ID for identifying a specific store. For example, the identity information required in the store can be a parameter and can be mapped and stored on the store ID.

[0042] In an embodiment, in operation 301, the electronic device 100 may request the external device 70 for storage information. For example, the electronic device 100 may request the store information by reading a barcode / QR code output by the external device 70 provided in an offline store. For example, the first application 122 of the electronic device 100 may provide a menu for requesting store information. For another example, the electronic device 100 may request the store information from the external device 70 through short-range wireless communication, Bluetooth communication, or Wi-Fi communication. In operation 303, the external device 70 may send the store information and the transaction ID to the electronic device 100 in response to the request of the electronic device 100. In operation 305, the electronic device 100 may send the received store information to the authentication server 50. In operation 307, in response to receiving the store information, the authentication server 50 may search for the store information stored in the authentication server 50, and may send parameters corresponding to the identity information requested by the corresponding store to the terminal. For example, the authentication server 50 may search for data stored after being mapped to the received store ID. For example, each item of the user identity information may be parameterized and stored in the authentication server 50. The authentication server 50 may transmit information on the above-mentioned "necessary items" through parameters to the electronic device 100 or the external device 70. For example, the parameters may include a date of birth, a name, and an image such as an ID photo of the user.

[0043] In various embodiments, it is understood that the parameters stored after being mapped to the store information and / or transaction ID are the minimum identity information required for the corresponding store and / or transaction. The authentication server 50 can limit the parameters sent or received so that only the minimum identity information is used depending on the type of store and / or transaction.

[0044] In various embodiments, when the authentication server 50 sends the parameters to the electronic device 100 , the electronic device 100 may select items to be used for identity authentication from the stored identity information 126 to output or send the selected items to the external device 70 .

[0045] In operation 309, the electronic device 100 may send a server ID pre-stored in the identity information 126 to the authentication server 50. In operation 311, the authentication server 50 may send the key ID stored after being mapped to the received server ID and the random value "r" to be used for subsequent authentication to the electronic device 100. For example, the key ID may be a public key corresponding to the electronic device 100. When the electronic device 100 is registered in the authentication server 50, a pair of encryption keys including the public key may be generated by the security element 124. According to various embodiments, in operation 309, the electronic device 100 may send a first application ID for identifying a first application together with the server ID. For example, when the authentication server 50 supports multiple applications according to the type of service, the authentication server 50 may identify different services according to each application ID.

[0046] In various embodiments, at operation 313, the electronic device 100 may receive authentication information from a user of the electronic device 100. For example, the authentication information may include biometric information of the user. In one example, the electronic device 100 may output an interface for requesting fingerprint authentication for user authentication through an execution screen of the first application 122, and may obtain fingerprint information from the user. For example, fingerprint information having a different identifier for each finger of the user may be obtained.

[0047] In various embodiments, the electronic device 100 may include a second application 128-1 and a third application 128-2 installed in the security element 124. For example, it is understood that the second application 128-1 and the third application 128-2 are small programs for sending and receiving data between the security element 124 and an external device or performing a specific function using data stored in the security element 124. In another embodiment, the second application 128-1 and the third application 128-2 in the security element 124 may be composed of a small program. In operation 315, the electronic device 100 may pass the obtained authentication information and key ID to the second application 128 (e.g., Figure 1 The electronic device 100 may store a second application 128 in the user's mobile phone and determine whether the identity authentication service is registered. For example, when the authentication information is fingerprint information, the electronic device 100 may compare the fingerprint information with pre-stored fingerprint information through the second application 128. When multiple pieces of fingerprint information with different identifiers for each finger of the user are stored, the electronic device 100 may compare the pattern with the identifier of the received fingerprint information.

[0048] In operation 317, the electronic device 100 may pass the authentication information, the key ID, the transaction ID, and the parameter to the secure element 124. In operation 319, the electronic device 100 may generate signature information by using the data transmitted in operation 317 and the data stored in the identity information 126. For example, operations 319 and 321 may be performed by the third application 128-2 installed in the secure element 1124.

[0049] In operation 323 , the electronic device 100 may generate a UI by using the generated signature information. The UI may be displayed through the execution screen of the first application 122 .

[0050] In an embodiment, the UI may include identity information. For example, the mobile identity card may be output through the corresponding UI. The mobile identity card may be generated based on the parameters received from the authentication server 50. For example, when the mobile identity card is displayed, only necessary items may be displayed, and the remaining items may be omitted, depending on the transaction with the store. For example, items corresponding to the received parameters may be displayed, and other items that do not correspond to the received parameters may not be displayed.

[0051] In various embodiments, in operation 325, the electronic device 100 may send the generated signature information to the external device 70. The external device 70 may directly perform identity authentication based on the received signature information. At this time, the external device 70 may send the received signature information to the authentication server 50, and may receive the identity information of the user of the electronic device 100 from the authentication server 50. In operation 327, the external device 70 may directly perform identity authentication on the user by using the received identity information. In operation 329, the external device 70 may perform a transaction to be performed based on the authenticated identity information. For example, the external device 70 may pay for items such as alcoholic beverages and cigarettes sold to people over the age of 19.

[0052] pass Figure 3 According to the operation shown, the user registered in the identity authentication service and the offline store registered in the identity authentication service can perform identity authentication by using the electronic device 100 and the external device 70. When providing the user authentication service according to an embodiment of the present disclosure, the electronic device 100 can generate a signature by using only the necessary information required for identity authentication. The UI output by the electronic device 100 can only display the necessary identity information, so all the identity information associated with the user may not be exposed.

[0053] In various embodiments, the electronic device 100 may change the UI of the mobile identity card displayed on the electronic device 100. Figure 3As described in , the electronic device 100 can generate a signature and identity card UI by using the minimum information required in the offline store. At this time, the user can select the identity information of the items to be provided additionally among the items not displayed. In various embodiments, when the user presents specific information to the employee in the store when facing the employee in the offline store, the user can selectively provide additional information by changing the UI. In an embodiment, at operation 401, a UI including identity information can be displayed through the display 140 of the electronic device 100. For example, based on Figure 3 The UI may be generated based on at least a portion of the parameters received in operation 307 of the present invention. The UI may include at least a portion of the identity information corresponding to the parameters. In various embodiments, the electronic device 100 may display a list of parameters that are not displayed through the UI or another UI (or another area of ​​the display 140 that does not display the UI).

[0054] In various embodiments, at operation 403, the electronic device 100 may receive a selection input from a user for a parameter to be displayed. For example, it is understood that the selected parameter is a parameter that is not currently displayed on the UI. In another embodiment, the electronic device 100 may receive an input to change the area in which the identity information is to be displayed. At operation 405, the electronic device 100 may additionally display the identity information corresponding to the selected parameter through the display 140 in response to the selection input. For example, a changed UI may be displayed to include the identity information corresponding to the selected parameter. Figure 4 Operations 407, 409, and 411 in the example may correspond to Figure 3 Operation 325, operation 327 and operation 329 in.

[0055] Figure 5 is an example of a mobile identity card that includes situation-dependent identity information in various embodiments.

[0056] refer to Figure 5 , shows a mobile identity card according to various embodiments. For example, it can be assumed that the identity information required by the offline store is "Are you an adult?" In this case, the transaction may be "Payment for alcoholic beverages and cigarettes requiring proof of adulthood." The necessary parameter corresponding to the corresponding store and the corresponding transaction may be "Date of Birth."

[0057] The first UI 510 is an example of a mobile identity card including all identity information. The second UI 520 is an example of a mobile identity card including only name information and information about the date of birth. For example, identity information (e.g., a photo or an address) may be vague and not necessary identity information. The third UI 530 is an example of a mobile identity card including additional information with the name information and information about the date of birth. For example, the third UI 530 may include additional information 531 showing “Are you an adult?” as necessary information required for an offline store.

[0058] The fourth UI 540 is an example of a mobile identity card including only information about “Are you an adult” as necessary information required by an offline store, but not information about a date of birth, which is. A user can perform identity authentication by providing only information 541 about “Are you an adult” to an offline store.

[0059] Figure 6 is an example of a mobile identity card that, in various embodiments, provides identity information that varies based on user selections.

[0060] In various embodiments, the electronic device 100 (eg, Figure 1 The electronic device 100 or Fig. 9 The electronic device 100 may change the UI according to the selection input. For example, the electronic device 100 may receive a selection input for a second item different from the first item that has been displayed from among the multiple items included in the identity information 126. The electronic device 100 may display information corresponding to the second value (which corresponds to the second item) on the display 140 through the execution screen of the first application 122 in response to the corresponding selection input. The electronic device 100 may display at least a portion of the remaining items other than the first item that has been displayed among the multiple items included in the identity information 126 on the display 140 as selection items. For example, when the user selects the second item displayed as a selection item, the electronic device 100 may display information corresponding to the second value (which corresponds to the second item) on the display 140.

[0061] For example, when a touch input is received in a specific area in which specific identity information of a mobile identity card output through the display 140 is displayed, the electronic device 100 may change whether to display the specific identity information.

[0062] Referring to the fifth UI 610, when a touch input 615 is received in the area where the photo is displayed, the electronic device 100 may control the display 140 so that the photo is displayed or not. For example, in the case where the photo is not displayed on the mobile identity card, when the user wishes to display the photo information in addition, the user may touch the area where the photo is to be displayed. When the electronic device 100 receives the touch input, the electronic device 100 may obtain parameters corresponding to the photo information from the authentication server 70 (or may use parameters received in advance), and may output the photo information through the display 140 based on the parameters.

[0063] In various embodiments, the electronic device 100 may display items of identity information that can be additionally provided through the display 140. The electronic device 100 may additionally display items selected from a plurality of items through the display 140. For example, the items of identity information may correspond to parameters previously received from the authentication server 50.

[0064] Referring to the sixth UI 620, a selection interface 622 for additional items is shown. The selection interface 622 may include items of identity information that can be provided additionally (resident registration number, photo, and address). For example, when a selection input 625 for a photo item among the items included in the selection interface 622 is received, the electronic device 100 may further display the photo item. For example, when all items included in the selection interface 622 are selected, all identity information included in the mobile identity card may be displayed through the display 140, as shown in the seventh UI 630.

[0065] In various embodiments, the electronic device 100 may display identity information in various forms other than the form of the above-mentioned mobile identity card. For example, when a user desires to purchase an alcoholic beverage from an offline store and have the alcoholic beverage delivered to his / her residence, the electronic device 100 may output a UI including only "Are you an adult" and "Address". For example, the user may use a mobile identity card to provide the store with address information in addition to proof of adulthood as the type of required information to be displayed. In various embodiments, when generating signature information, the electronic device 100 may additionally receive a parameter from the user, and may generate a signature by using the parameter.

[0066] Figure 7 is a signal flow of a method for providing identity information according to various embodiments Figure 4 .

[0067] In operation 701, the electronic device 100 (eg, Figure 1 The electronic device 100 or Fig. 9 The electronic device 901) may display a UI through the display 140. At this time, the electronic device 100 may display a UI including the parameters received from the authentication server 60.

[0068] In operation 703, the electronic device 100 may receive a selection input for a parameter to be displayed among the parameters that are not displayed. In another embodiment, the electronic device 100 may receive a change input for changing the area where the parameter is to be displayed. For example, the selection input or the change input may be received through the execution screen of the first application 122 that provides the identity authentication service. For another example, the selection input or the change input may be received through another menu button arranged in an area other than the area where the identity information is displayed (e.g., an area where a mobile identity card is displayed). Hereinafter, the parameters added by user input are described as "selected parameters".

[0069] In operation 705 , the electronic device 100 may transmit information about the selected parameter to the authentication server 50 . In operation 706 , the electronic device 100 may receive a random value “r” from the authentication server 50 .

[0070] In operation 707, the electronic device 100 may pass a plurality of pieces of data required to generate the signature information to a third application. For example, operation 707 may correspond to Figure 3 Operation 317. In operation 709, the electronic device 100 may generate a signature by using the received information and the data stored in the security element 124. For example, the electronic device 100 may generate a signature based on both the parameters received from the authentication server 50 and the parameters selected by the user. For example, the parameter may be information about the date of birth. The selected parameter may be address information selected by the user. In various embodiments, in operation 711, the signature generated by the third application 128-2 may be passed to the first application 122 and may be used. In operation 713, the electronic device 100 may output a UI including both the parameters and the received parameters.

[0071] In various embodiments, in operation 715, the electronic device 100 may send the signature generated in operation 709 to the external device 70. The external device 70 may directly authenticate the user by using the received signature. In operation 717, the external device 70 may send the received signature to the authentication server 50 to determine whether the identity information included in the signature has been forged or modified. When the identity information is verified, in operation 719, the external device 70 may perform a transaction based on the verified identity information.

[0072] In various embodiments, the authentication server 50 may directly transmit identity information about the user of the electronic device 100 to the external device 70. In this case, the electronic device 100 may generate a signature including only parameters corresponding to the identity information to be transmitted, and may transmit the signature to the authentication server 50. After verifying the forgery / modification of the received signature, the authentication server 50 may transmit the identity information corresponding to the parameters included in the corresponding signature to the external device 70.

[0073] In an embodiment, the electronic device 100 may display a list of identity information sent to the external device 70 through the execution screen of the first application 122. The electronic device 100 may display a UI for requesting the user to agree to the list of identity information. When the user's consent input is received in association with the UI, the electronic device 100 may send a message indicating that the user's consent has been received to the authentication server 50. The authentication server 50 may send the identity information to the external device 70 in response to receiving the message.

[0074] In various embodiments, the external device 70 may have at least a portion of the identity information of a user registered in the identity authentication service. In this case, at least a portion of the user identity information may be provided by the external device 70. The electronic device 100 may send signature information to the external device 70. The external device 70 may send the signature information to the authentication server 50, and the signature information may be authenticated. When the signature information is authenticated by the authentication server 50, the external device 70 may search for identity information corresponding to the parameters included in the corresponding signature information, and may perform a subsequent transaction process. In various embodiments, the external device 70 may provide the above-mentioned services through a display and an output device of the external device 70.

[0075] In an embodiment, specific identity information of a user regarding an identity authentication service may be compulsorily provided according to the authority of the external device 70 used in the offline store. Alternatively, a UI for recommending identity information necessary for an operation performed by the external device 70 may be provided.

[0076] For example, identity information necessary for processing a specific service provided by a public institution may be predetermined. In this case, the external device 70 operated by the public institution may be used to perform the specific service and may have authority over the predetermined identity information. For example, the external device 70 in the public institution may obtain necessary identity information from the authentication server 70 or the electronic device 100 without user consent.

[0077] In various embodiments, when the authentication server 50 obtains the user's consent in advance during the registration process of the identity authentication service, the identity information about the user can be automatically provided to the electronic device 100 and / or the external device 70 that has been registered in the identity authentication service. For example, when someone subscribes to an insurance service, the insurance agent's external device 70 (e.g., a tablet PC or PC) can receive the insurance subscriber's identity information through the identity authentication service. For example, the external device 70 can obtain the identity information necessary for subscribing to the insurance service through the insurance subscriber's electronic device 100 or the authentication server 50.

[0078] Figure 8 is a signal flow of a method for performing identity authentication in an external device according to various embodiments Figure 5 .

[0079] In various embodiments, at operation 801, Figure 3 The signature information generated in the authentication server 50 is sent to the external device 70. The external device 70 may determine whether the received signature information is valid. In operation 803, the external device 70 may send the received signature information to the authentication server 50, and the authentication server 50 may determine whether the corresponding signature information is forged or modified. When the authentication server 50 authenticates the electronic device 100 (e.g., Figure 1 The electronic device 100 or Fig. 9 When the user of the electronic device 901) and the external device 70 is not forged or modified, in operation 805, the authentication server 50 can send the information required by the external device 70.

[0080] The external device 70 may reprocess the received identity information. For example, the external device 70 may generate a UI including the identity information, and may output the UI through a display provided in the external device 70. A clerk in a store may recognize the UI. In another embodiment, when the external device 70 performs a member registration function, the external device 70 may receive the identity information required for membership registration from the authentication server 50. The external device 70 may automatically perform the member registration function based on the received identity information.

[0081] Fig. 9 FIG. 1 is a diagram illustrating a network environment 900 (eg, Figure 1 The electronic device 901 (eg, Figure 1 100) is a block diagram of an electronic device 100. Fig. 9, the electronic device 901 in the network environment 900 may communicate with the electronic device 902 via the first network 998 (e.g., a short-range wireless communication network), or communicate with the electronic device 904 or the server 908 via the second network 999 (e.g., a long-range wireless communication network). According to an embodiment, the electronic device 901 may communicate with the electronic device 904 via the server 908. According to an embodiment, the electronic device 901 may include a processor 920 (e.g., Figure 1 processor 110), memory 930 (e.g., Figure 1 Memory 120), input device 950, sound output device 955, display device 960 (for example, Figure 1 , a display 140 ), an audio module 970 , a sensor module 976 , an interface 977 , a haptic module 979 , a camera module 980 , a power management module 988 , a battery 989 , a communication module 990 (eg, Figure 1 990 ), a user identification module (SIM) 996, or an antenna module 997. In some embodiments, at least one of the components (e.g., the display device 960 or the camera module 980) may be omitted from the electronic device 901, or one or more other components may be added to the electronic device 901. In some embodiments, some of the components may be implemented as a single integrated circuit. For example, the sensor module 976 (e.g., a fingerprint sensor, an iris sensor, or an illumination sensor) may be implemented as embedded in the display device 960 (e.g., a display).

[0082] The processor 920 may run, for example, software (e.g., program 940) to control at least one other component (e.g., hardware component or software component) of the electronic device 901 connected to the processor 920, and may perform various data processing or calculations. According to one embodiment, as at least part of the data processing or calculation, the processor 920 may load a command or data received from another component (e.g., sensor module 976 or communication module 990) into the volatile memory 932, process the command or data stored in the volatile memory 932, and store the result data in the non-volatile memory 934. According to an embodiment, the processor 920 may include a main processor 921 (e.g., a central processing unit (CPU) or an application processor (AP)) and an auxiliary processor 923 (e.g., a graphics processing unit (GPU), an image signal processor (ISP), a sensor hub processor, or a communication processor (CP)) that is independent of or combined with the main processor 921 in operation. Additionally or alternatively, the auxiliary processor 923 may be adapted to consume less power than the main processor 921, or adapted to be specifically used for a specified function. The auxiliary processor 923 may be implemented separately from the main processor 921 , or as part of the main processor 921 .

[0083] When the main processor 921 is in an inactive (e.g., sleep) state, the auxiliary processor 923 may control at least some of the functions or states related to at least one component (e.g., display device 960, sensor module 976, or communication module 990) among the components of the electronic device 901 (not the main processor 921), or when the main processor 921 is in an active state (e.g., running an application), the auxiliary processor 123 may control at least some of the functions or states related to at least one component (e.g., display device 160, sensor module 176, or communication module 190) among the components of the electronic device 101 together with the main processor 921. According to an embodiment, the auxiliary processor 923 (e.g., an image signal processor or a communication processor) may be implemented as part of another component (e.g., camera module 980 or communication module 990) that is functionally related to the auxiliary processor 923.

[0084] The memory 930 may store various data used by at least one component of the electronic device 901 (e.g., the processor 920 or the sensor module 976). The various data may include, for example, software (e.g., the program 940) and input data or output data for commands related thereto. The memory 930 may include a volatile memory 932 or a nonvolatile memory 934.

[0085] The program 940 may be stored as software in the memory 930 , and may include, for example, an operating system (OS) 942 , middleware 944 , or an application 946 .

[0086] The input device 950 may receive commands or data to be used by other components (eg, the processor 920) of the electronic device 901 from outside the electronic device 901 (eg, a user). The input device 950 may include, for example, a microphone, a mouse, or a keyboard.

[0087] The sound output device 955 can output a sound signal to the outside of the electronic device 901. The sound output device 955 may include, for example, a speaker or a receiver. The speaker can be used for general purposes such as playing multimedia or playing records, and the receiver can be used for incoming calls. Depending on the embodiment, the receiver can be implemented as a separate part from the speaker, or as a part of the speaker.

[0088] The display device 960 may visually provide information to the outside of the electronic device 901 (e.g., a user). The display device 960 may include, for example, a display, a holographic device, or a projector, and a control circuit for controlling a corresponding one of the display, the holographic device, and the projector. According to an embodiment, the display device 960 may include a touch circuit adapted to detect a touch or a sensor circuit (e.g., a pressure sensor) adapted to measure the strength of a force caused by a touch.

[0089] The audio module 970 may convert sound into an electrical signal, or vice versa. According to an embodiment, the audio module 970 may obtain sound via the input device 950, or output sound via the sound output device 955 or an earphone of an external electronic device (e.g., electronic device 902) directly (e.g., wired) or wirelessly connected to the electronic device 901.

[0090] The sensor module 976 may detect an operating state (e.g., power or temperature) of the electronic device 901 or an environmental state (e.g., a state of a user) outside the electronic device 901, and then generate an electrical signal or data value corresponding to the detected state. According to an embodiment, the sensor module 976 may include, for example, a gesture sensor, a gyroscope sensor, an atmospheric pressure sensor, a magnetic sensor, an acceleration sensor, a grip sensor, a proximity sensor, a color sensor, an infrared (IR) sensor, a biometric sensor, a temperature sensor, a humidity sensor, or an illumination sensor.

[0091] The interface 977 may support one or more specific protocols to be used to connect the electronic device 901 directly (e.g., wired) or wirelessly to an external electronic device (e.g., the electronic device 902). According to an embodiment, the interface 977 may include, for example, a high-definition multimedia interface (HDMI), a universal serial bus (USB) interface, a secure digital (SD) card interface, or an audio interface.

[0092] The connection end 978 may include a connector, wherein the electronic device 901 can be physically connected to an external electronic device (e.g., the electronic device 902) via the connector. According to an embodiment, the connection end 978 may include, for example, an HDMI connector, a USB connector, an SD card connector, or an audio connector (e.g., a headphone connector).

[0093] The haptic module 979 may convert the electrical signal into mechanical stimulation (eg, vibration or motion) or electrical stimulation that can be recognized by the user via his sense of touch or kinesthetic sense. According to an embodiment, the haptic module 979 may include, for example, a motor, a piezoelectric element, or an electrical stimulator.

[0094] The camera module 980 may capture a still image or a moving image. According to an embodiment, the camera module 980 may include one or more lenses, an image sensor, an image signal processor, or a flash.

[0095] The power management module 988 may manage power supply to the electronic device 901. According to an embodiment, the power management module 988 may be implemented as, for example, at least a part of a power management integrated circuit (PMIC).

[0096] The battery 989 may power at least one component of the electronic device 901. According to an embodiment, the battery 989 may include, for example, a non-rechargeable primary battery, a rechargeable secondary battery, or a fuel cell.

[0097] The communication module 990 may support establishing a direct (e.g., wired) communication channel or a wireless communication channel between the electronic device 901 and an external electronic device (e.g., electronic device 902, electronic device 904, or server 908), and perform communication via the established communication channel. The communication module 990 may include one or more communication processors capable of operating independently from the processor 920 (e.g., an application processor (AP)) and supporting direct (e.g., wired) communication or wireless communication. According to an embodiment, the communication module 990 may include a wireless communication module 992 (e.g., a cellular communication module, a short-range wireless communication module, or a global navigation satellite system (GNSS) communication module) or a wired communication module 994 (e.g., a local area network (LAN) communication module or a power line communication (PLC) module). A corresponding one of these communication modules can communicate with an external electronic device via a first network 998 (e.g., a short-range communication network such as Bluetooth, Wireless Fidelity (Wi-Fi) Direct, or Infrared Data Association (IrDA)) or a second network 999 (e.g., a long-range communication network such as a cellular network, the Internet, or a computer network (e.g., a LAN or a wide area network (WAN))). These various types of communication modules can be implemented as a single component (e.g., a single chip), or these various types of communication modules can be implemented as multiple components separated from each other (e.g., multiple chips). The wireless communication module 992 can identify and authenticate the electronic device 901 in a communication network (such as the first network 998 or the second network 999) using user information (e.g., an International Mobile Subscriber Identity (IMSI)) stored in the user identification module 996.

[0098] The antenna module 997 may transmit or receive a signal or power to or from the outside of the electronic device 901 (e.g., an external electronic device). According to one embodiment, the antenna module 997 may include one or more antennas, and from them, at least one antenna suitable for a communication scheme used in a communication network, for example, by the communication module 990 (e.g., the wireless communication module 992), such as the first network 998 or the second network 999, may be selected. A signal or power may then be transmitted or received between the communication module 990 and the external electronic device via the selected at least one antenna.

[0099] At least some of the above components may be connected to each other via an inter-peripheral communication scheme (e.g., a bus, general purpose input output (GPIO), serial peripheral interface (SPI), or mobile industry processor interface (MIPI)) and communicatively transmit signals (e.g., commands or data) therebetween.

[0100] According to an embodiment, a command or data may be sent or received between the electronic device 901 and the external electronic device 904 via the server 908 connected to the second network 999. Each of the electronic device 902 and the electronic device 904 may be a device of the same type as the electronic device 901, or a device of a different type from the electronic device 901. According to an embodiment, all or some operations to be executed in the electronic device 901 may be executed in one or more of the external electronic device 902, the external electronic device 904, or the server 908. For example, if the electronic device 901 should automatically execute a function or service or should execute a function or service in response to a request from a user or another device, the electronic device 901 may request the one or more external electronic devices to execute at least part of the function or service instead of executing the function or service, or the electronic device 901 may request the one or more external electronic devices to execute at least part of the function or service in addition to executing the function or service. The one or more external electronic devices that receive the request may execute the requested at least part of the function or service, or execute another function or another service related to the request, and transmit the result of the execution to the electronic device 901. The electronic device 901 may provide the result as at least a partial reply to the request with or without further processing the result. To this end, for example, cloud computing technology, distributed computing technology, or client-server computing technology may be used.

[0101] The electronic device according to various embodiments may be one of various types of electronic devices. The electronic device may include, for example, a portable communication device (e.g., a smart phone), a computer device, a portable multimedia device, a portable medical device, a camera, a wearable device, or a household appliance. According to an embodiment of the present disclosure, the electronic device is not limited to those electronic devices described above.

[0102] It should be understood that the various embodiments of the present disclosure and the terms used therein are not intended to limit the technical features set forth herein to specific embodiments, but include various changes, equivalent forms or alternative forms for corresponding embodiments. For the description of the accompanying drawings, similar reference numerals may be used to refer to similar or related elements. It will be understood that the nouns in the singular form corresponding to the term may include one or more things unless the relevant context clearly indicates otherwise. As used herein, each of the phrases such as "A or B", "at least one of A and B", "at least one of A or B", "A, B or C", "at least one of A, B and C" and "at least one of A, B or C" may include any one or all possible combinations of the items listed together with the corresponding one of the multiple phrases. As used herein, terms such as "1st" and "2nd" or "first" and "second" may be used to simply distinguish the corresponding component from another component, and do not limit the component in other aspects (e.g., importance or order). It will be understood that if an element (e.g., a first element) is referred to as being “combined with another element (e.g., the second element)”, “combined to another element (e.g., the second element)”, “connected with another element (e.g., the second element)”, or “connected to another element (e.g., the second element)” when the terms “operably” or “communicatively” are used or when the terms “operably” or “communicatively” are not used, it means that the element may be directly (e.g., wired) connected to the other element, wirelessly connected to the other element, or connected to the other element via a third element.

[0103] As used herein, the term "module" may include units implemented in hardware, software, or firmware, and may be used interchangeably with other terms (e.g., "logic," "logic block," "portion," or "circuit"). A module may be a single integrated component adapted to perform one or more functions or a minimum unit or portion of the single integrated component. For example, according to an embodiment, a module may be implemented in the form of an application specific integrated circuit (ASIC).

[0104] The various embodiments described herein may be implemented as software (e.g., program 940) including one or more instructions stored in a storage medium (e.g., internal memory 936 or external memory 938) that can be read by a machine (e.g., electronic device 901). For example, under the control of a processor, a processor (e.g., processor 920) of the machine (e.g., electronic device 901) may call at least one of the one or more instructions stored in the storage medium and execute the at least one instruction with or without the use of one or more other components. This enables the machine to operate to perform at least one function according to the at least one instruction called. The one or more instructions may include code generated by a compiler or code that can be run by an interpreter. A machine-readable storage medium may be provided in the form of a non-transitory storage medium. Among them, the term "non-transitory" only means that the storage medium is a tangible device and does not include a signal (e.g., an electromagnetic wave), but the term does not distinguish between data being semi-permanently stored in a storage medium and data being temporarily stored in a storage medium.

[0105] According to an embodiment, the method according to various embodiments of the present disclosure may be included and provided in a computer program product. The computer program product may be traded between a seller and a buyer as a product. The computer program product may be released in the form of a machine-readable storage medium (e.g., a compact disk read-only memory (CD-ROM)), or may be downloaded via an application store (e.g., Play Store TM ) The computer program product may be published (e.g., downloaded or uploaded) online, or the computer program product may be distributed (e.g., downloaded or uploaded) directly between two user devices (e.g., smart phones). If published online, at least part of the computer program product may be temporarily generated, or at least part of the computer program product may be at least temporarily stored in a machine-readable storage medium (such as a memory of a manufacturer's server, an application store's server, or a forwarding server).

[0106] According to various embodiments, each component (e.g., module or program) in the above-mentioned components may include a single entity or multiple entities. According to various embodiments, one or more components in the above-mentioned components may be omitted, or one or more other components may be added. Alternatively or additionally, multiple components (e.g., module or program) may be integrated into a single component. In this case, according to various embodiments, the integrated component may still perform the one or more functions of each component in the multiple components in the same or similar manner as a corresponding component in the multiple components before integration. According to various embodiments, the operations performed by a module, program or another component may be performed sequentially, in parallel, repeatedly or in a heuristic manner, or one or more operations in the operations may be run or omitted in different orders, or one or more other operations may be added.

Claims

1. An electronic device, comprising: a communication circuit configured to communicate with at least one authentication server providing identity authentication services; monitor; at least one memory configured to store identity information associated with a user registered in the identity authentication service, wherein the identity information includes a plurality of items and values ​​respectively corresponding to the plurality of items; and A processor, wherein the processor is configured to: Acquire first identification information corresponding to the object to which the identity information is to be provided; sending the first identification information and second identification information corresponding to the electronic device to the at least one authentication server; receiving, from the at least one authentication server, a parameter corresponding to a first item required by the object among the plurality of items of the identity information, the parameter being determined based at least in part on the first identification information and the second identification information; Performing user authentication on the user; and In response to success of the user authentication, information corresponding to a first value corresponding to a first item of the plurality of items of the identity information is displayed through the display.

2. The electronic device according to claim 1, wherein: The at least one memory stores a first application for providing the identity authentication service, and Wherein, the processor is configured to: executing the first application; and Information corresponding to the first value is displayed on the display through an execution screen of the first application.

3. The electronic device according to claim 2, wherein: The processor is configured to: receiving a selection input of a second item of the plurality of items that is different from the first item; and In response to the selection input, information corresponding to a second value corresponding to the second item is displayed on the display through the execution screen.

4. The electronic device according to claim 3, wherein: The processor is configured to: displaying at least some of the plurality of items on the display through the execution screen; and A selection input for the second item included in the partial items is received.

5. The electronic device according to claim 2, wherein: The processor is configured to: displaying, through the execution screen, an interface for requesting the user authentication; and In response to displaying the interface, authentication information of the user is obtained.

6. The electronic device according to claim 5, wherein: The processor is configured to: At least one of the biometric information and the password of the user is obtained as the authentication information.

7. The electronic device according to claim 2, wherein: The processor is configured to: generating a first UI based on the first value; and The first UI is displayed on the display through the execution screen as information corresponding to the first value.

8. The electronic device according to claim 1, wherein: The identity information is stored in a secure element in the at least one memory.

9. The electronic device according to claim 1, wherein: The processor is configured to: The first identification information is acquired from an external device corresponding to a subject to which the identity information is to be provided through the communication circuit.

10. The electronic device according to claim 9, wherein: The first identification information includes an object ID associated with the external device and a function ID associated with a function executed by the external device.

11. The electronic device according to claim 9, wherein: The processor is configured to: The first value is sent to the external device.

12. The electronic device according to claim 1, wherein: The processor is configured to: The first value is displayed via the display.

13. The electronic device according to claim 12, wherein: The processor is configured to: determining a second value obtained by omitting at least a portion of the first value; and The second value is displayed via the display.

14. The electronic device according to claim 12, wherein: The processor is configured to: receiving a selection input of a second item of the plurality of items that is different from the first item; and In response to the selection input, information corresponding to a second value is displayed through the display, the second value corresponding to the second item.

Images