Biometric authentication security module
We built a biometric security library that lets people go from sign-in all the way to an account transfer in a banking app with a single fingerprint check, without loading a certificate or typing a password. Fingerprint sensors were just arriving in smartphones, so most of the work was reading the international standard and the researchers' reference code, porting it for the app, and meeting the bank's acceptance requirements. This is an authentication component, so one step out of place could let someone other than the account holder pass. The library was designed as pure logic with no screens so several banking services could adopt it, and it was aligned to run the same standard flow as the version for the other platform.
Sign-in and transfers opened with a fingerprint instead of a password
Biometric authentication in a banking app means going from sign-in to approving an account transfer with a single fingerprint check, without loading a certificate or typing a password. Fingerprint sensors were only just appearing in smartphones, so what each device and platform supported, and how it failed, differed. We checked that support and those exceptions one by one and concentrated on keeping the authentication flow steady.
An authentication flow that checks keys and never stores fingerprints
The biometric security library never stores biometric data such as fingerprints directly. Fingerprint matching finishes inside the smartphone, and only the authentication result, never the fingerprint, travels to the bank. That result is verified with asymmetric encryption using a public and private key pair, and one-way hashing is added to complete the security flow. The core of this design is that identity is confirmed by a key, not by the fingerprint itself.
The standard and the reference code, implemented to fit a banking app
The biometric flow follows the order set by an international standard. We analysed the reference code supplied by researchers, ported it into a library for the app, and reconciled implementation differences so it runs the same standard flow alongside the version for the other platform. Interpretation of the standard was checked together with the doctoral researchers and the bank's staff, and the constraints and acceptance requirements for a live banking service were built in.
A screenless security component that fits any banking service
The biometric library has no screens; it is made of logic, and more than 99% of the code is authentication processing. So it could be carried into several banking services, the interface that callers use was designed separately from the internal processing flow. Each service keeps its own screens and hands only the authentication to this library.
Highlights
Biometric authentication that checks keys, never stores fingerprints
A verification flow built on public and private key encryption and one-way hashing
A screenless security library that plugs into several banking services
Insights
GA4 client_storage: 'none'은 정말 쿠키를 막을까?
두 달 전 이 블로그에 「GA4 쿠키 없이 쓰기」라는 글을 썼습니다. clientstorage: 'none' 으로 쿠키 저장을 끄고, 자체 분석이 쓰던 익명 ID 를 clientid 로 넘기면 쿠키 0개로 GA4 를 쓸 수 있다는 내…
GA4 Measurement Protocol: gtag.js 없이 서버에서 이벤트 보내기
랜딩 페이지의 전송량을 파일 단위로 쪼개 보다가, 가장 큰 파일이 우리 코드가 아니라는 것을 알았습니다. Google Analytics 의 gtag.js 였고, 방문 한 번에 176KB 를 받고 있었습니다. 페이지 전체가 1,094K…
중소 제조업 AI 도입 순서: DX를 먼저 끝내야 할까?
공장을 가진 중소·중견 제조기업 16만여 곳 가운데 스마트공장을 도입한 곳은 19.5%입니다. 회사가 작을수록 이 비율은 더 떨어집니다. 중소벤처기업부가 2025년 4월에 낸 제1차 스마트제조혁신 실태조사 결과입니다. 그림: 기업 규…
Next.js loading.tsx와 404: 버튼이 화면보다 먼저 살아나게 하기
관리 화면 왼쪽 위에 사이드바를 접고 펴는 ☰ 버튼이 있습니다. 폭 하나 바꾸는 버튼인데, 대시보드에서 누르면 2초 넘게 아무 반응이 없었습니다. 레이아웃만 바꾸는 일이 왜 이렇게 오래 걸리는지부터 들여다봤습니다. Next.js 16…