Patent Description:
Identity information may be verified offline with, for example, a plastic card, and thus a user needs to carry an identity card in person. Nowadays, with the activation of a payment service using an electronic device, a mobile identity card (e.g., a student ID or an employee ID) capable of replacing a physical card is being used. For example, a mobile identity card may be supported through an application installed in the electronic device. Document <CIT> is considered to be a relevant prior art document in the field of securing mobile identity cards.

An electronic device may output a mobile identity card on a display. The mobile identity card may include various pieces of personal information (e.g., a name, a resident registration number, and an address). A user is reluctant to expose the various pieces of personal information to other people through the screen. Information to be necessarily provided may be different depending on various situations in each of which the mobile identity card is used. Various embodiments disclosed in this specification are intended to provide a portable electronic device capable of providing only necessary identity information depending on a situation.

The invention is disclosed in independent claim <NUM>. According to an embodiment disclosed in this specification, an electronic device may include a communication circuit communicating with at least one authentication server providing an identity verification service, a display, at least one memory storing identity information associated with a user registered in the identity verification service, and the identity information including a plurality of items and values respectively corresponding to the plurality of items, and a processor. The processor may be configured to obtain first identification information corresponding to an object to be provided with the identity information, to transmit the first identification information and second identification information corresponding to the electronic device to the at least one authentication server, to receive information on a first item, which is determined based at least partly on the first identification information and the second identification information, from among a plurality of items of the identity information from the at least one authentication server, to perform user authentication on the user, and to display information corresponding to a first value corresponding to the first item among the plurality of items of the identity information through the display in response to a success of the user authentication.

Furthermore, according to an embodiment disclosed in this specification, a system providing an identity verification service may include the at least one authentication server providing the identity verification service, an electronic device of a user registered in the identity verification service and including identity information of the user including a plurality of items and values respectively corresponding to the plurality of items, and an external device registered in the identity verification service. The external device may transmit first identification information associated with the external device to the electronic device. The electronic device may transmit the first identification information and second identification information corresponding to the electronic device to the at least one authentication server. The at least one authentication server may transmit information on a first item, which is determined based on the first identification information and the second identification information, from among the plurality of items to the electronic device. The electronic device may perform user authentication on the user, and may display information associated with a first value corresponding to the first item through the electronic device or the external device in response to a success of the user authentication.

According to embodiments disclosed in this specification, an electronic device may differentially provide identity information depending on a situation. Besides, a variety of effects directly or indirectly understood through the specification may be provided.

With regard to description of drawings, the same or similar components will be marked by the same or similar reference signs.

Hereinafter, various embodiments of the disclosure may be described with reference to accompanying drawings. However, it should be understood that this is not intended to limit the disclosure to specific implementation forms and includes various modifications, equivalents, and/or alternatives of embodiments of the disclosure.

<FIG> illustrates an identity verification system and a block diagram of an electronic device according to an embodiment.

According to an embodiment, an identity verification system <NUM> may provide an identity verification service for a user registered in the identity verification service. The identity verification system <NUM> may include an electronic device <NUM> (e.g., an electronic device <NUM> of <FIG>), an authentication server <NUM>, and an external device <NUM>.

For example, the authentication server <NUM> may provide the identity verification service. The electronic device <NUM> and the external device <NUM> may provide the identity verification service by communicating with the authentication server <NUM>. The identity verification system <NUM> may include a plurality of authentication servers. However, the identity verification system <NUM> composed of the single authentication server <NUM> is disclosed by way of an example below. The electronic device <NUM> may exchange identity information and information associated with the identity information between the authentication server <NUM> and the external device <NUM>.

For example, it may be understood that the electronic device <NUM> is a portable electronic device such as a smartphone or a tablet PC. Alternatively, the electronic device <NUM> may be a wearable device worn on a part of the user's body. It may be understood that the electronic device <NUM> is an electronic device owned by the user registered in the identity verification service. The electronic device <NUM> may store identity information associated with the user.

For example, it may be understood that the external device <NUM> is a device installed in an offline object (e.g., a store or an institution). For example, the external device <NUM> may be a point-of-service (POS) machine. The external device <NUM> may have a unique identity (ID) (hereinafter referred to as an 'object ID') for each device or for each offline object. The external device <NUM> may perform a specific function (e.g., a transaction or membership registration) that requires the user's identity information. Each specific function may have an ID (hereinafter referred to as a `function ID') for each function. In various embodiments, the external device <NUM> may receive identity information necessary to perform the specific function from the electronic device <NUM> and/or the authentication server <NUM>.

For example, the authentication server <NUM> may have information on an item (hereinafter referred to as a `necessary item') of identity information necessary for the external device <NUM> to perform a specific function. The authentication server <NUM> may transmit information on the necessary item to the electronic device <NUM>. The electronic device <NUM> may operate identity information on the user of the electronic device <NUM> based on the received information. In various embodiments, the authentication server <NUM> may store, in advance, whether the electronic device <NUM> or the external server <NUM> has an access right to identity information stored in the electronic device <NUM>. Accordingly, the authentication server <NUM> may include an item having the access right in the necessary item. In an embodiment, the electronic device <NUM> may include a processor <NUM> (e.g., a processor <NUM> of <FIG>), a memory <NUM> (e.g., a memory <NUM> of <FIG>), a communication circuit <NUM> (e.g., a communication module <NUM> of <FIG>), and a display <NUM> (e.g., a display device <NUM> of <FIG>). The processor <NUM> may control overall operations of the electronic device <NUM>. The electronic device <NUM> may transmit and receive data with the authentication server <NUM> and the external device <NUM> through the communication circuit <NUM>.

In an embodiment, the memory <NUM> may store identity information associated with the user registered in the identity verification service. For example, the identity information may include a plurality of items and values respectively corresponding to the plurality of items. For example, when the item is a date of birth, the value may be stored as data in a numeric form of year-month-day. In an embodiment, the memory <NUM> may store a first application <NUM> for providing the identity verification service. In various embodiments, the electronic device <NUM> may launch the first application <NUM> and may output an execution screen of the first application <NUM> through the display <NUM>. The execution screen may include a user interface (hereinafter referred to as a 'UI') including the identity information of the user in at least a part of the execution screen. In various embodiments, the UI may be implemented in various forms depending on a type of identity information to be displayed. Examples of the UI will be described later with reference to <FIG> and <FIG>.

In various embodiments, the electronic device <NUM> may include a secure element (SE) <NUM>. The secure element <NUM> may store identity information <NUM>. For example, the secure element <NUM> may have restrictions in direct communication with an external device such as the authentication server <NUM> or the external device <NUM>. In this case, the secure element <NUM> may store a second application that is directly installed therein. In this case, the second application may relay data transmission/reception between the secure element <NUM> and the authentication server <NUM> or the external device <NUM>. In another example, the authentication server <NUM> or the external device <NUM> may communicate with the secure element <NUM> through short-range wireless communication.

<FIG> is a flowchart <NUM> illustrating how an electronic device provides identity information according to an embodiment.

Referring to <FIG>, an identity information providing method according to an embodiment may include operation <NUM> to operation <NUM>. For example, operation <NUM> to operation <NUM> may be performed by the electronic device <NUM> illustrated in <FIG>. For example, operation <NUM> to operation <NUM> may be respectively implemented with instructions capable of being performed (or executed) by the processor <NUM> of the electronic device <NUM>. The instructions may be stored in, for example, a computer-readable recording medium or the memory <NUM> of the electronic device <NUM> illustrated in <FIG>. Hereinafter, in descriptions associated with operation <NUM> to operation <NUM>, a description that is the same as the description given with reference to <FIG> may not be repeated here.

In operation <NUM>, the electronic device <NUM> may obtain first identification information corresponding to an object to be provided with identity information. For example, the electronic device <NUM> may obtain the first identification information through the communication circuit <NUM> from the external device <NUM> corresponding to an object to be provided with the identity information <NUM>. For example, the first identification information may include an object ID for an object associated with the external device <NUM>, and a function ID for a function (e.g., a transaction or membership registration) performed by the external device <NUM>.

In operation <NUM>, the electronic device <NUM> may transmit the first identification information and second identification information corresponding to the electronic device to the authentication server <NUM>. For example, the second identification information may include a user ID registered in an identity verification service. It may be understood that the second identification information refers to information necessary for the authentication server <NUM> to identify or authenticate a user of the electronic device <NUM>.

In operation <NUM>, the electronic device <NUM> may receive information on a first item among a plurality of items of the identity information <NUM>, which is determined based on the first identification information and the second identification information, from the authentication server <NUM>. For example, it may be understood that the first item is the `necessary item' described above in <FIG>. The authentication server <NUM> may select information on an item necessary for the external device <NUM> to perform a specific function among identity information stored in the electronic device <NUM> or the authentication server <NUM>. For example, the necessary item may be mapped onto the function ID or the object ID and then may be stored.

In operation <NUM>, the electronic device <NUM> may perform user authentication on the user. In various embodiments, the electronic device <NUM> may display a UI for requesting the user authentication through an execution screen of the first application <NUM>. The electronic device <NUM> may obtain the user's authentication information in response to the display on a UI. For example, the authentication information may include at least part of a password and biometric information (e.g., fingerprint information, iris information, or face information).

In operation <NUM>, the electronic device <NUM> may display information corresponding to a first value corresponding to the first item among a plurality of items of the identity information <NUM> through the display <NUM> in response to the success of the user authentication.

In an embodiment, the electronic device <NUM> may display the first value through the display <NUM>. For example, when a value corresponding to an item of a date of birth is '<NUM>-<NUM>-<NUM>', the electronic device <NUM> may display '<NUM>-<NUM>-<NUM>' or `January <NUM>, <NUM>' on the display <NUM>. The user who has subscribed to the identity verification service may perform identity authentication required by an offline object by presenting identity information displayed on the electronic device <NUM> to the offline object.

In various embodiments, the electronic device <NUM> may generate a second value obtained by omitting at least part of the first value, and may display the second value through the display <NUM>. For example, when `whether you are an adult' is information required by the offline object, the electronic device <NUM> may display only information about `year' in the date of birth on the display <NUM>. In various embodiments, the electronic device <NUM> may generate a specific UI based on the first value. The electronic device <NUM> may display the generated UI on the display <NUM> through the execution screen of the first application <NUM>. For example, when `whether you are an adult' is information required by the offline object, the electronic device <NUM> may display a UI including a phrase of "I am an adult" and "I am over <NUM> years old" on the display <NUM>. The related embodiment will be described with reference to <FIG>.

In various embodiments, the electronic device <NUM> may transmit the first value to the external device <NUM>. In this case, the external device <NUM> may perform a specific function by using the received first value. For example, when receiving a true value associated with `whether you are an adult', the external device <NUM> may make a payment for alcoholic beverages and cigarettes based the true value. For another example, the external device <NUM> may receive values respectively associated with a plurality of items necessary for membership registration, and may perform a member registration function on the user by using the values.

<FIG> is a signal flowchart <NUM> of a method of providing identity information according to an embodiment. <FIG> is a signal flowchart <NUM> of a method of changing a UI including identity information according to an embodiment.

Hereinafter, specific examples of operations performed through the identity verification system <NUM> will be described with reference to <FIG>. In various embodiments, a user ID registered in an identity verification service may be referred to as a "server ID". For example, a user who has subscribed to the identity verification service may receive the server ID. The electronic device <NUM> may store the corresponding server ID in the memory <NUM>.

It may be understood that the authentication server <NUM> is one or more servers providing the above-described identity verification service. In various embodiments, it may be assumed that at least part of the server ID and at least part of identity information on a user of the electronic device <NUM> (e.g., the electronic device <NUM> of <FIG> or the electronic device <NUM> of <FIG>) are stored in storage of the authentication server <NUM> in advance. In some embodiments, information on the electronic device <NUM> registered in association with the server ID may be further stored in the storage of the authentication server <NUM>. The authentication server <NUM> may include at least part of the server ID corresponding to each of users subscribed to the identity verification service, information on the electronic device <NUM>, or identity information on a user. The electronic device <NUM> may map the server ID to the first application <NUM> and may store the mapped result in the memory <NUM>. For example, it may be understood that the external device <NUM> is an electronic device installed in an offline object (e.g., a store or an institution). Hereinafter, a store among offline objects is described by way of an example. The authentication server <NUM> may store information on a store ID (e.g., an object ID in <FIG>) corresponding to each of stores subscribed to the identity verification service, a transaction ID (e.g., a function ID of <FIG>) for a transaction made by the corresponding store, and what identity information required by the corresponding store is. It may be understood that the store ID is a unique ID for identifying a specific store. For example, the identity information required in a store may be a parameter, and may be mapped and stored onto the store ID.

In an embodiment, in operation <NUM>, the electronic device <NUM> may make a request for store information to the external device <NUM>. For example, the electronic device <NUM> may request store information by reading a barcode/QR code output by the external device <NUM> provided in an offline store. For example, the first application <NUM> of the electronic device <NUM> may provide a menu for requesting the store information. For another example, the electronic device <NUM> may make a request for the store information to the external device <NUM> through short range wireless communication, Bluetooth communication, or Wi-Fi communication. In operation <NUM>, the external device <NUM> may transmit store information and a transaction ID to the electronic device <NUM> in response to a request of the electronic device <NUM>. In operation <NUM>, the electronic device <NUM> may transmit the received store information to the authentication server <NUM>. In operation <NUM>, the authentication server <NUM> may search for store information stored in the authentication server <NUM> and may transmit a parameter corresponding to identity information requested by the corresponding store to a terminal, in response to receiving the store information. For example, the authentication server <NUM> may search for data stored after being mapped onto the received store ID. For example, each of items of the user's identity information may be parameterized and stored in the authentication server <NUM>. The authentication server <NUM> may deliver information on the above-described `necessary item' to the electronic device <NUM> or the external device <NUM> through the parameter. For example, the parameters may include a date of birth, a name, and an image such as a user's ID photo.

In various embodiments, it may be understood that parameters stored after being mapped onto the store information and/or transaction ID are pieces of minimum identity information required for the corresponding store and/or transaction. The authentication server <NUM> may restrict the transmitted or received parameter such that only the minimum identity information is used depending on a type of a store and/or transaction.

In various embodiments, when the authentication server <NUM> transmits the parameters to the electronic device <NUM>, the electronic device <NUM> may select items to be used for identity verification from the stored identity information <NUM> to output or transmit the selected items to the external device <NUM>.

In operation <NUM>, the electronic device <NUM> may transmit a server ID stored in advance in the identity information <NUM> to the authentication server <NUM>. In operation <NUM>, the authentication server <NUM> may transmit a key ID stored after being mapped onto the received server ID and a nonce value of 'r' to be used for subsequent authentication, to the electronic device <NUM>. For example, the key ID may be a public key corresponding to the electronic device <NUM>. A pair of encryption keys including the public key may be generated by the secure element <NUM> when the electronic device <NUM> is registered in the authentication server <NUM>. According to various embodiments, in operation <NUM>, the electronic device <NUM> may transmit a first application ID for identifying a first application together with a server ID. For example, when the authentication server <NUM> supports a plurality of applications according to types of services, the authentication server <NUM> may identify services that are different depending on each application ID.

In various embodiments, in operation <NUM>, the electronic device <NUM> may receive authentication information from the user of the electronic device <NUM>. For example, the authentication information may include the user's biometric information. In one example, the electronic device <NUM> may output an interface for requesting fingerprint authentication for user authentication through an execution screen of the first application <NUM> and may obtain fingerprint information from the user. For example, the fingerprint information having an identifier different for each finger of the user may be obtained.

In various embodiments, the electronic device <NUM> may include a second application <NUM>-<NUM> and a third application <NUM>-<NUM> installed in the secure element <NUM>. For example, it may be understood that the second application <NUM>-<NUM> and the third application <NUM>-<NUM> are applets for transmitting and receiving data between the secure element <NUM> and external devices, or performing a specific function using pieces of data stored in the secure element <NUM>. In another embodiment, the second application <NUM>-<NUM> and the third application <NUM>-<NUM> in the secure element <NUM> may be composed of one applet. In operation <NUM>, the electronic device <NUM> may deliver the obtained authentication information and a key ID to the second application <NUM> (e.g., the second application <NUM> in <FIG>) and may determine whether the identity verification service is registered. For example, when authentication information is fingerprint information, the electronic device <NUM> may compare the fingerprint information with pre-stored fingerprint information through the second application <NUM>. When pieces of fingerprint information having identifiers different for each finger of the user are stored, the electronic device <NUM> may compare a pattern with the received identifier of the fingerprint information.

In operation <NUM>, the electronic device <NUM> may deliver authentication information, a key ID, a transaction ID, and a parameter, to the secure element <NUM>. In operation <NUM>, the electronic device <NUM> may generate signature information, by using the data transmitted in operation <NUM> and the data stored in the identity information <NUM>. For example, operation <NUM> and operation <NUM> may be performed through the third application <NUM>-<NUM> installed in the secure element <NUM>.

In operation <NUM>, the electronic device <NUM> may generate a UI by using the generated signature information. The UI may be displayed through the execution screen of the first application <NUM>.

In an embodiment, the UI may include identity information. For example, a mobile identity card may be output through the corresponding UI. The mobile identity card may be generated based on the parameter received from the authentication server <NUM>. For example, when a mobile identity card is displayed, only necessary items may be displayed depending on a transaction with a store, and the remaining items may be omitted. For example, items corresponding to the received parameter may be displayed, and other items that do not correspond to the received parameter may not be displayed.

In various embodiments, in operation <NUM>, the electronic device <NUM> may transmit the generated signature information to the external device <NUM>. The external device <NUM> may directly perform identity authentication based on the received signature information. At this time, the external device <NUM> may transmit the received signature information to the authentication server <NUM>, and may receive identity information of the user of the electronic device <NUM> from the authentication server <NUM>. In operation <NUM>, the external device <NUM> may directly perform identity verification on a user by using the received identity information. In operation <NUM>, the external device <NUM> may make a transaction to be performed based on the authenticated identity information. For example, the external device <NUM> may make a payment for items such as alcoholic beverages and cigarettes that are sold to people over the age of <NUM>.

The user registered in the identity verification service and an offline store registered in the identity verification service may perform identity verification by using the electronic device <NUM> and the external device <NUM>, through operations shown in <FIG>. When the user authentication service according to an embodiment of the disclosure is provided, the electronic device <NUM> may generate a signature by using only necessary information required for identity verification. The UI output through the electronic device <NUM> may display only necessary identity information, and thus all pieces of identity information associated with the user may not be exposed.

In various embodiments, the electronic device <NUM> may change the UI of the mobile identity card displayed on the electronic device <NUM>. As described above in <FIG>, the electronic device <NUM> may generate a signature and an identity card UI by using the minimum information required in the offline store. At this time, the user may select the identity information of an item to be additionally provided among items that are not displayed. In various embodiments, in a situation where specific information is presented to an employee in a store when the user faces the employee in the offline store, the user may selectively provide additional information by changing a UI. In an embodiment, in operation <NUM>, a UI including identity information may be displayed through the display <NUM> of the electronic device <NUM>. For example, the UI may be generated based on at least part of the parameters received through operation <NUM> in <FIG>. The UI may include at least part of identity information corresponding to the parameters. In various embodiments, the electronic device <NUM> may display a list of parameters, which are not displayed, through the UI or another UI (or another region of the display <NUM> where the UI is not displayed).

In various embodiments, in operation <NUM>, the electronic device <NUM> may receive a selection input for a parameter to be displayed from the user. For example, it may be understood that the selected parameter is a parameter that is not currently displayed on the UI. In another embodiment, the electronic device <NUM> may receive an input to change a region in which identity information is to be displayed. In operation <NUM>, the electronic device <NUM> may additionally display identity information corresponding to the selected parameter through the display <NUM> in response to the selection input. For example, a changed UI may be displayed to include identity information corresponding to the selected parameter. Operation <NUM>, operation <NUM>, and operation <NUM> in <FIG> may correspond to operation <NUM>, operation <NUM>, and operation <NUM> in <FIG>, respectively.

<FIG> is examples of a mobile identity card including identity information that varies depending on a situation in various embodiments.

Referring to <FIG>, a mobile identity card according to various embodiments is illustrated. For example, it may be assumed that identity information required by an offline store is `whether you are an adult'. In this case, a transaction may be `a payment requiring adult certification for alcoholic beverages and cigarettes'. A necessary parameter corresponding to the corresponding store and the corresponding transaction may be `date of birth'.

A first UI <NUM> is an example of a mobile identity card including all pieces of identity information. A second UI <NUM> is an example of a mobile identity card including only name information and information about a date of birth. For example, identity information (e.g., a photo or an address) may be blurred, not the necessary identity information. A third UI <NUM> is an example of a mobile identity card including the additional information with the name information and the information about a date of birth. For example, the third UI <NUM> may include additional information <NUM> displaying `whether you are an adult' that is necessary information required by an offline store.

A fourth UI <NUM> is an example of a mobile identity card that includes only information about `whether you are an adult' that is necessary information required by the offline store, without including the information about a date of birth. A user may perform identity verification by providing only information <NUM> about `whether you are an adult' to the offline store.

<FIG> is an example of mobile identity cards providing identity information that varies depending on a user's selection, in various embodiments.

In various embodiments, the electronic device <NUM> (e.g., the electronic device <NUM> of <FIG> or the electronic device <NUM> of <FIG>) may change a UI depending on a selection input. For example, the electronic device <NUM> may receive a selection input to a second item different from a first item, which is already displayed, from among a plurality of items included in the identity information <NUM>. The electronic device <NUM> may display information corresponding to a second value corresponding to the second item on the display <NUM> through an execution screen of the first application <NUM>, in response to the corresponding selection input. The electronic device <NUM> may display at least part of the remaining items other than the first item, which is already displayed, from among the plurality of items included in the identity information <NUM> as a selection item on the display <NUM>. For example, when the second item displayed as the selection item is selected by a user, the electronic device <NUM> may display information corresponding to a second value corresponding to the second item on the display <NUM>.

For example, when a touch input is received in a specific region where the specific identity information of the mobile identity card output through the display <NUM> is displayed, the electronic device <NUM> may change whether to display the specific identity information.

Referring to a fifth UI <NUM>, when a touch input <NUM> is received in a region where a photo is displayed, the electronic device <NUM> may control the display <NUM> such that the photo is displayed or the photo is not displayed. For example, in a situation where a photo is not displayed on the mobile identity card, when a user desires to additionally display photo information, the user may touch a region where a photo is to be displayed. When the electronic device <NUM> receives the touch input, the electronic device <NUM> may obtain a parameter corresponding to photo information from the authentication server <NUM> (or may use a parameter that is received in advance), and may output the photo information through the display <NUM> based on the parameter.

In various embodiments, the electronic device <NUM> may display items of identity information capable of being additionally provided, through the display <NUM>. The electronic device <NUM> may additionally display items selected from the items through the display <NUM>. For example, items of the identity information may correspond to parameters previously received from the authentication server <NUM>.

Referring to a sixth UI <NUM>, a selection interface <NUM> for additional items is illustrated. The selection interface <NUM> may include the items (a resident registration number, a photo, and an address) of the identity information capable of being additionally provided. For example, when a selection input <NUM> to a photo item among items included in the selection interface <NUM> is received, the electronic device <NUM> may further display the photo item. For example, when all items included in the selection interface <NUM> are selected, all pieces of identity information included in the mobile identity card may be displayed through the display <NUM> as illustrated in a seventh UI <NUM>.

In various embodiments, the electronic device <NUM> may display identity information in various forms, not a form of the above-described mobile identity card. For example, when a user desires to purchase alcoholic beverages from an offline store and to ship the alcoholic beverages to his/her house, the electronic device <NUM> may output a UI including only `whether you are an adult' and an 'address'. For example, a user may provide a store with address information in addition to adult certification as a type of required information to be displayed, using a mobile identity card. In various embodiments, when generating signature information, the electronic device <NUM> may additionally receive a parameter from the user and may generate a signature by using the parameter.

<FIG> is a signal flowchart <NUM> of a method of providing identity information according to various embodiments.

In operation <NUM>, the electronic device <NUM> (e.g., the electronic device <NUM> of <FIG> or the electronic device <NUM> of <FIG>) may display a UI through the display <NUM>. At this time, the electronic device <NUM> may display the UI including parameters received from the authentication server <NUM>.

In operation <NUM>, the electronic device <NUM> may receive a selection input for a parameter to be displayed among parameters that are not displayed. In another embodiment, the electronic device <NUM> may receive a change input to change a region where a parameter is to be displayed. For example, the selection input or the change input may be received through an execution screen of the first application <NUM> that provides an identity verification service. For another example, the selection input or the change input may be received through another menu button disposed in a region (e.g., a region where a mobile identity card is displayed) other than a region where identity information is displayed. Hereinafter, a parameter added by a user input is described as a 'selected parameter'.

In operation <NUM>, the electronic device <NUM> may transmit information on the selected parameter to the authentication server <NUM>. In operation <NUM>, the electronic device <NUM> may receive a nonce value 'r' from the authentication server <NUM>.

In operation <NUM>, the electronic device <NUM> may deliver pieces of data necessary to generate signature information to a third application. For example, operation <NUM> may correspond to operation <NUM> of <FIG>. In operation <NUM>, the electronic device <NUM> may generate a signature by using the received information and pieces of data stored in the secure element <NUM>. For example, the electronic device <NUM> may generate a signature based on both a parameter received from the authentication server <NUM> and a parameter selected by a user. For example, the parameter may be information about a date of birth. The selected parameter may be address information selected by the user. In various embodiments, in operation <NUM>, the signature generated by the third application <NUM>-<NUM> may be delivered to the first application <NUM> and may be used. In operation <NUM>, the electronic device <NUM> may output a UI including both the parameter and the received parameter.

In various embodiments, in operation <NUM>, the electronic device <NUM> may transmit the signature generated in operation <NUM> to the external device <NUM>. The external device <NUM> may directly authenticate the user by using the received signature. In operation <NUM>, the external device <NUM> may transmit the received signature to the authentication server <NUM> to determine whether identity information included in the signature has been forged or modified. When the identity information is verified, in operation <NUM>, the external device <NUM> may perform a transaction according to the verified identity information.

In various embodiments, the authentication server <NUM> may directly transmit identity information on a user of the electronic device <NUM> to the external device <NUM>. In this case, the electronic device <NUM> may generate a signature including only parameters corresponding to identity information to be transmitted, and may transmit the signature to the authentication server <NUM>. After verifying forgery/modification of the received signature, the authentication server <NUM> may transmit identity information corresponding to a parameter included in the corresponding signature to the external device <NUM>.

In the embodiment, the electronic device <NUM> may display a list of identity information transmitted to the external device <NUM>, through an execution screen of the first application <NUM>. The electronic device <NUM> may display a UI for requesting a user's consent to the list of the identity information. When the user's consent input is received in association with a UI, the electronic device <NUM> may transmit a message indicating that the user's consent has been received, to the authentication server <NUM>. The authentication server <NUM> may transmit the identity information to the external device <NUM> in response to receiving the message.

In various embodiments, the external device <NUM> may have at least part of the identity information of the user registered in the identity verification service. In this case, at least part of the user's identity information may be provided through the external device <NUM>. The electronic device <NUM> may transmit signature information to the external device <NUM>. The external device <NUM> may transmit the signature information to the authentication server <NUM> and may authenticate the signature information. When the signature information is authenticated by the authentication server <NUM>, the external device <NUM> may search for identity information corresponding to a parameter included in the corresponding signature information and may perform a subsequent transaction procedure. In various embodiments, the external device <NUM> may provide the above-described service through a display and an output device of the external device <NUM>.

In the embodiment, specific identity information on a user of the identity verification service may be forcibly provided depending on the authority of the external device <NUM> used in the offline store. Alternatively, a UI for recommending identity information necessary for operations performed by the external device <NUM> may be provided.

For example, identity information necessary to process a specific service provided by a public institution may be determined in advance. In this case, the external device <NUM> operated by the public institution may be required for a specific service and may have authority for predetermined identity information. For example, the external device <NUM> in the public institution may obtain necessary identity information from the authentication server <NUM> or the electronic device <NUM> without the consent of the user.

In various embodiments, when the authentication server <NUM> obtains the user's consent in advance in the registration process of the identity verification service, the identity information on the user may be automatically provided to the electronic device <NUM> and/or the external device <NUM>, which is registered in the identity verification service. For example, while someone subscribes to an insurance service, the external device <NUM> (e.g., a tablet PC or PC) of an insurance agent may receive identity information of an insurance subscriber through the identity verification service. For example, the external device <NUM> may obtain identity information necessary to subscribe to an insurance service through the electronic device <NUM> of the insurance subscriber or the authentication server <NUM>.

<FIG> is a signal flowchart <NUM> of a method of performing identity verification in an external device according to various embodiments.

In various embodiments, in operation <NUM>, signature information generated in <FIG> may be transmitted to the external device <NUM>. The external device <NUM> may determine whether the received signature information is valid. In operation <NUM>, the external device <NUM> may transmit the received signature information to the authentication server <NUM>, and the authentication server <NUM> may determine whether the corresponding signature information is forged or modified. When the authentication server <NUM> authenticates users of the electronic device <NUM> (e.g., the electronic device <NUM> of <FIG> or the electronic device <NUM> of <FIG>) and the external device <NUM> and there is no forgery or modification, in operation <NUM>, the authentication server <NUM> may transmit information required by the external device <NUM>.

The external device <NUM> may re-process the received identity information. For example, the external device <NUM> may generate a UI including identity information, and may output the UI through a display provided in the external device <NUM>. A clerk in a store may identify the UI. In still another embodiment, when the external device <NUM> performs a member registration function, the external device <NUM> may receive identity information necessary for membership registration from the authentication server <NUM>. The external device <NUM> may automatically perform a member registration function based on the received identity information.

<FIG> is a block diagram illustrating an electronic device <NUM> (e.g., the electronic device <NUM> of <FIG>) in a network environment <NUM> (e.g., the identity verification system <NUM> of <FIG>) according to various embodiments. According to an embodiment, the electronic device <NUM> may include a processor <NUM><NUM> (e.g., the processor <NUM> of <FIG>), memory <NUM> (e.g., the memory <NUM> of <FIG>), an input device <NUM>, a sound output device <NUM>, a display device <NUM> (e.g., the display <NUM> of <FIG>), an audio module <NUM>, a sensor module <NUM>, an interface <NUM>, a haptic module <NUM>, a camera module <NUM>, a power management module <NUM>, a battery <NUM>, a communication module <NUM> (e.g., the communication circuit <NUM> of <FIG>), a subscriber identification module (SIM) <NUM>, or an antenna module <NUM>.

The processor 920may execute, for example, software (e.g., a program <NUM>) to control at least one other component (e.g., a hardware or software component) of the electronic device <NUM> coupled with the processor <NUM>, and may perform various data processing or computation.

According to an embodiment, the connecting terminal <NUM> may include, for example, a HDMI connector, a USB connector, a SD card connector, or an audio connector (e.g., a headphone connector),.

Claim 1:
An electronic device comprising:
a communication circuit configured to communicate with at least one authentication server providing an identity verification service;
a display;
at least one memory configured to store identity information associated with a user registered in the identity verification service, wherein the identity information includes a plurality of items and values respectively corresponding to the plurality of items; and
a processor, wherein the processor is configured to:
obtain first identification information corresponding to an object to be provided with information corresponding to a value corresponding to at least one item of the identity information;
transmit the first identification information and second identification information corresponding to the electronic device to the at least one authentication server;
receive a parameter corresponding to a first item among the plurality of items of the identity information required by the object from the at least one authentication server, wherein the parameter is determined based at least partly on the first identification information and the second identification information, from among the plurality of items of the identity information;
perform user authentication of the user; and
display information corresponding to a first value corresponding to the first item selected among the plurality of items of the identity information based on the parameter through the display, in response to a success of the user authentication.