User authentication system, user authentication apparatus, smart card, and user authentication method for ubiquitous authentication management

1. user authorization system for ubiquitous authorization management, comprising:

a public key infrastructure (PKI) certificate issuing server configured to issue a PKI certificate matching at least one biometric signature of a subscriber, wherein the PKI certificate includes at least one coded biometric information that is encoded from a subscriber's biometric information, the subscriber's biometric information includes at least two biometric patterns, one for an intended authorization of the subscriber and another for a forced authorization of the subscriber;

a sensing means for recognizing a biometric pattern from a user;

a smart card configured to store the at least one biometric signature and the PKI certificate and verify the user by comparing the user's biometric pattern with the at least one biometric signature, wherein the at least one biometric signature contains the subscriber's biometric information encrypted based on the PKI certificate;

a service server configured to identify, authenticate and authorize the smart card based on an authorization information derived from the PKI certificate, wherein the authorization information includes the subscriber's coded biometric information; and

a terminal, connected to the smart card by way of a wired or a wireless communication, configured to establish a virtual private network (VPN) between the smart card and the service server in response to a tunneling start signal received from the smart card,

wherein the smart card is further configured to transmit the tunneling start signal to the terminal if the user's biometric pattern matches with the at least one biometric signature, and to transmit an authorization information derived from the PKI certificate to the service server through the VPN.

2. The user authorization system according to claim 1 , wherein the sensing means is consolidated into either the smart card or the terminal.

3. A user authorization apparatus for ubiquitous authorization management, comprising:

a sensing means for recognizing a biometric pattern from a user;

smart card configured to store at least one biometric signature of a subscriber and a public key infrastructure (PKI) certificate matching the biometric signature, verify the user by comparing the user's biometric pattern with the at least one biometric signature and generate a tunneling start signal if the user's biometric pattern matches with the at least one biometric signature; and

a terminal, connected to the smart card by way of a wired or wireless communication, configured to establish a virtual private network (VPN) between the smart card and a uniform resource locator (URL) corresponding to the tunneling start signal received from the smart card, wherein

the smart card is further configured to transmit an authorization information derived from the PKI certificate to the URL through the VPN,

the PKI certificate includes at least one coded biometric information that is encoded from a subscriber's biometric information, the subscriber's biometric information includes at least two biometric patterns, one for an intended authorization of the subscriber and another a forced authorization of the subscriber;

the authorization information includes the subcriber's coded biometric information, and the subscriber's biometric signature contains the subscriber's biometric information encrypted based on the PKI certificate.

4. The user authorization apparatus according to claim 3 , wherein the smart card is one among a card type, a dongle type and a USB type.

5. The user authorization apparatus according to claim 3 , wherein the terminal is one among a PDA, a cell phone, a laptop computer, a desktop computer, an ATM, a KIOSK and an IPTV set-top box.

6. The user authorization apparatus according to claim 3 , wherein the sensing means is consolidated into either the smart card or the terminal.

7. A smart card for ubiquitous authentication management, comprising:

a storage section for storing at least one biometric signature of a subscriber and a public key infrastructure (PKI) certificate matching the at least one biometric signature;

a biometric signature matching section for comparing a user's biometric pattern with the at least one biometric signature;

a signal transmission section for requesting that a target terminal establish a communication tunnel to a service server if the user's biometric pattern matches with the at least one biometric signature; and

an authorization execution section for authorizing the user by transmitting an authentication information derived from the PKI certificate to the service server through the communication tunnel,

wherein the PKI certificate includes at least one coded biometric information that is encoded from a subscriber's biometric information, the subscriber's biometric information includes at least two kinds of biometric patterns, one for an intended authorization of the subscriber and another for a forced authorization of the subscriber, the authorization information includes the at least one coded biometric information, and the biometric signature contains the subscriber's biometric information encrypted based on the PKI certificate.

8. The smart card according to claim 7 , wherein the biometric information includes at least one among a fingerprint pattern, a vascular pattern, a voice pattern, a iris pattern and a palm pattern.

9. The smart card according to claim 7 , further comprising a biometric sensor for recognizing a biometric pattern from the user.

10. The smart card according to claim 7 , wherein the user's biometric pattern is received from the target terminal.

11. The smart card according to claim 7 , further comprising a software based one-time password (OTP) generator for generating an OTP, wherein the authentication information includes the OTP and the PKI certificate.

12. A user authorization method in a smart card for ubiquitous authentication management, comprising:

comparing a user's biometric pattern with at least one biometric signature of a subscriber stored in the smart card;

requesting that a target terminal establish a communication tunnel with a service server if the user's biometric pattern matches with the at least one biometric signature; and

transmitting, to the target terminal, an authentication information derived from the PKI certificate when the communication tunnel is established with the service server,

wherein the PKI certificate includes at least one coded biometric information and is matching the subscriber's biometric signature, the subscriber's biometric signature contains the subscriber's biometric information encrypted based on the PKI certificate, the subscriber's biometric information includes at least two biometric patterns, one for an intended authorization of the subscriber and another for a forced authorization of the subscriber, and the authentication information includes the subscriber's coded biometric information.

13. The user authorization method according to claim 12 , further comprising recognizing a biometric pattern from the user.

14. The user authorization method according to claim 12 , further comprising receiving the user's biometric pattern from the target terminal.