KR100392792B1 - User authentication system and method using a second channel - Google Patents

Abstract

PURPOSE: A user authentication system using a second connection path and an authenticating method thereof are provided to enhance the reliability of an authentication process by using the second connection path instead of the first connection path for service. CONSTITUTION: A user authentication system using a second connection path includes a service provider system(20), a second user terminal(12), a communication connection/management system(30), a second connection path, and a connection management system(32). The service provider system(20) processes a request of a first user terminal(11) within a predetermined range and performs a user authentication process if the request of the first user terminal exceeds the predetermined range. The second user terminal(12) is registered by the genuine user. The communication connection/management system(30) is connected to the second user terminal(12) in order to require the authentication information and transfer the authentication information to the service provider system. The second connection path is used for connecting the communication connection/management system to the second user terminal. The connection management system(32) records and manages a communication history.

Description

User authentication system and method using a second channel

The present invention relates to a user authentication system using a second connection path, and in particular, an existing user by performing a final user authentication through a second connection path (telephone communication network) different from the first path where the user connects to the system. The present invention relates to a user authentication system and a user authentication method that guarantee reliability and stability superior to an authentication system.

In general, the user authentication system receives an ID and a password for accessing a specific service system from a user through a single access path, and compares it with those of a corresponding user previously stored in the system. User authentication is performed. Further, in order to prevent hacking of personal credit information or transmission data on the access path, data (ID, password, or contents) transmitted between the user terminal and the service providing system may be further encrypted and decrypted using a predetermined encryption algorithm ( Or scrambling and descrambling).

Meanwhile, with the rapid development and dissemination of the Internet, e-commerce, home banking, and telecommuting are increasing, and the related information industry is developing. In this information industry, various security systems and user authentication systems have been developed to prevent leakage and damage of personal credit information and important information from hackers with highly specialized hacking capabilities. Among them, the password encryption system has the limitations of the fundamental technology, and despite the development of security system (firewall, etc.), it is in a state of no help for the hacking techniques of advanced hackers.

In particular, if hackers with advanced hacking techniques intercept the transmission data (ID, password) on the connection path and decrypt it, the service providing system provides user authentication to an unjust user despite the existence of a perfect firewall. There is no choice but to do it. Therefore, the technical limitations of the existing user authentication system and the advanced hacking techniques and the increasing risk of hacking are provoking a vague anxiety for general users' use of e-commerce services, which is a great obstacle to the development of related industries. It is becoming.

An object of the present invention for solving the above problems, in the user authentication system, to prevent the interception of the user information for authentication by the hacker on the general access path, even in such a case, only distinguishing the right user with certainty By providing a user authentication system, the reliability and stability are significantly improved.

1 is a block diagram showing a user authentication system using a second connection path according to an embodiment of the present invention,

2 is a flowchart illustrating a user authentication method of the system of FIG.

<Description of the code | symbol about the principal part of drawing>

10: user interface means 11: the first user terminal

12: second user terminal 20: service provider system

21: User authentication and service provision means 22: Existing authentication DB

23: DB for telephone authentication 30: communication connection and management system

31: Communication connection system (ARS) 32: Connection management system

40: RESOURCE

A user authentication system of the present invention for achieving the above object, in a user authentication system having a first connection path with a user, processing the user's request through the first connection path within a predetermined range, When the request out of the predetermined range is requested, the technical feature is that the user authentication is performed by using the second connection path. In addition, the above-described second connection path is preferably implemented by a telephone communication network and a communication system thereof.

In addition, when the existing authentication method and the authentication method according to the present invention are organically combined, authentication through the existing first access path is a primary authentication that allows access to the system to handle user requests within a predetermined range. In addition, the authentication through the second connection path proposed according to the present invention is preferably applied to the final user authentication to allow access or update to important information outside the above-described predetermined range. The primary and secondary authentication schemes in this case are clearly different from the technical configuration and effects of the simple two-factor authentication scheme for authenticating a user twice through the same connection path, which is obvious to those skilled in the art.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 shows a user authentication system using a second access path according to an embodiment of the present invention. In particular, the user authentication system shown in FIG. 1 is a preferred implementation in the case where the existing primary authentication method using the first connection path is organically combined with the secondary authentication method using the second connection path (specifically, a telephone communication network). An example is shown and this invention is not limited to this.

The main configuration of FIG. 1 includes a user interface means 10 having two user terminals 11 and 12 individually connected to different connection paths, and a request from a user through the first connection path within a predetermined range. The service provider system 20, and the user interface means 10 and the service provider to perform the user authentication and provide the service according to the second process, when the request is processed and the request out of the predetermined range is requested. Located on the second connection path between the systems 20, if the end user authentication is required, call the second user terminal 12 connected to the user's phone number to request the user authentication information and the user authentication that is responded therefrom. It consists of a communication connection and management system 30 for delivering information to the service provider system 20. When the user authentication is finally performed by the user authentication and service providing means 21, the resource RESOURCE 40 indicates a resource object that requires a legitimate user's access or updates of the information. . Here, resource objects requiring final user authentication correspond to all objects requiring user-specific authentication procedures such as general data files, DB tables, bank accounts, and directory services.

Specifically, the first user terminal 11 of the user interface means 10 is connected to the service provider system 20 through the first connection path, and is a user interface for the user to request and receive a predetermined service. The second user terminal 12 is connected to the service provider system 20 through the second connection path and the communication connection and management system 30, and the request of the service provider system 20 and the communication connection and management system 30. By means of the user interface means for inputting the final user authentication information into the aforementioned systems. Here, each connection path is implemented in various modified forms according to the type of service provided by the system. For example, it may be a public telephone network (PSTN), an integrated data network (ISDN), a long-distance network (WAN), a local area network (LAN), a wireless communication network for mobile communication, and a Bluetooth device, which is a near direct communication network. Each user terminal connected to each connection path includes a telephone, a PC, an ATM terminal, a mobile phone (cellular phone, PCS), a terminal equipped with Bluetooth for one-to-one wireless communication, and the like according to the aforementioned connection path. This can be

The service provider system 20 includes a user authentication and service providing means 21, an authentication database 22, and a telephone authentication database 23 using a telephone network. The service provider system 20 provides a service having a different level for each predetermined authentication step. do. Here, the provided services can be provided in various modified service forms. For example, it may be a predetermined paid service such as an internet e-commerce service, an internet stock trading service, a phone banking service, a bank transaction service using an ATM terminal, an internet mud game service, an internet on-demand audio service, an internet on-demand video service, and a predetermined program use service. The present invention is not limited thereto.

The authentication database 22 stores and manages user IDs and first passwords, and the user connects to the service provider system 20 through the first user terminal 11 and the first access path. It is used to allow service usage within a predetermined range. The telephone authentication database 23 stores and manages user IDs, telephone numbers, second passwords, and the like, and when a request outside the preset range is requested to the system 20, the user is justified. It is used to finally authenticate whether the user has rights. Here, the secondary password may be set in advance, or may be temporarily assigned by the system or user whenever the final authentication described above is required. In addition, the phone number of the user may be used as a user ID. In this case, the processing out of the range preset in the system refers to access and update of important information that should not be leaked to an unjust user out of a simple level of reading of information, and a paid service. The important information may be the resource object 40 shown in FIG. 1. When the user authentication and service providing means 21 inputs the user's ID and the first password from the first user terminal 11 through the first access path, the user authentication and service providing means 21 compares them with those of the corresponding user stored in the authentication database 22. do. If the comparison results match each other, the user's request within the preset range is processed. The user authentication and service providing means 21 transmits the telephone number of the corresponding user stored in the telephone authentication database 23 to the communication connection system (ARS) 31 when a request out of the above-described preset range is requested from the user. do. The communication connection system 31 receives the user authentication information (second password) from the user by dialing the user's telephone number through the second access path and accessing the user to receive the user authentication information (second password). 21). The user authentication and service providing means 21 compares the user authentication information (second password) received from the communication connection system 31 with that stored in the telephone authentication database 23. If the result of the comparison coincides with each other, the corresponding user is finally authenticated as the user with the right and finally the service is provided accordingly.

The communication connection and management system 30 basically includes a communication connection system 31 having an ARS processing function, and may further include a connection management system 32. The communication connection and management system 30 may be installed inside the service provider system 20 or may be installed in a communication service company (for example, a general telephone base station or a mobile communication base station) located outside the service provider system 20. have. The connection management system 32 is a means for checking the user's connection history for end-user authentication and service use. The connection management system 32 uses usage information (e.g., a phone number and a second user terminal 12) related to a phone number for which end-user authentication is performed. ) Unique number, number of times of input, connection time, secondary password of wrong user input) and / or user authentication details related to the use of a predetermined paid service. In this way, when an unjust user copies the second user terminal 12 illegally and performs user authentication, it is tracked and used as information for charging a fee related to the use of a paid service.

In addition, the user authentication system according to the present invention operates in an application layer, which is the highest layer among network protocols, and uses any layered protocol (TCP / IP, OSI, SNA, DNA, etc.) used in all communication between each part. It works on). It also works with any encryption technique (SSL, PCT, Cerberus, etc.) and virtual private network services (VPNs) at other lower layers. Furthermore, whether the MULTI-TIER is provided through a firewall for increasing the security level that can be installed between each part of the whole system, clustering executed for stable operation of the server, load balancing, and middleware, according to the present invention. It does not affect the operation of the authentication system.

In the user authentication system of FIG. 1 having the above-described configuration, a preferred method of performing final user authentication using the second connection path will be described with reference to FIG.

Referring to FIG. 2, first, a user operates a first user terminal 11 to access a service provider system 20 through a first connection path, and works within a preset range set in the service provider system 20. (Step 10). At this time, the user authentication and service providing means 21 compares the ID and the first password of the user input through the first access path with those of the corresponding user stored in the authentication DB 22 to perform the first user authentication. Do it. Such primary user authentication is preferably used for user authentication to a predetermined service where security is not highly required. For example, the first user authentication may be used for a user to access a homepage on a network and to view publicly known information other than the basic service history, important personal information of an individual, or a paid service.

If the above-described system access is primarily permitted, the user authentication and service providing means 21 determines whether final user authentication is necessary (step 20). That is, if the user's request through the first connection path does not deviate from the preset allowable range in the system, the work within the preset allowable range can be continued. However, if the user's request corresponds to access or renewal of important information outside the preset range of the system, it is determined that final user authentication is required.

In step 20, if the above end user authentication is required, the user authentication and service providing means 21 requests to temporarily input the secondary password to the first user terminal 11 via the first access path (step 21). If a user-determined secondary password is input to the user authentication and service providing means 21 through the first access path (step 22), the user authentication and service providing means 21 calls the user's second password. Temporarily stored and managed in the record of the user of the authentication database 23 (step 23).

The secondary password setting process consisting of steps 21 to 23 provides a stronger level of security by temporarily inputting and storing a second password randomly generated by the user through the first access path whenever final user authentication is required. Enable improvement. The technical features of the present invention are not limited thereto. That is, the secondary password of the user stored in the telephone authentication DB 23 for final user authentication may be preset and notified to the user arbitrarily by the system. In addition, it may be input from the user through the second connection path and the second user terminal 12. In addition, although the second password may be set in the same manner as the above-described first password, it is more preferable that the second password be arbitrarily assigned as the level of security requirements of the site increases. Particularly, although the second password transmitted to the system on the first access path may be encrypted based on a predetermined encryption algorithm, the end-user authentication method of the present invention does not necessarily need to perform the above encryption. Have This is because the confirmation of the secondary password for the final user authentication is performed through the second user terminal 12 having the second access path and the telephone number of the user stored in the system. Even if the hacker intercepts the secondary password transmitted to the system through the first access path, the hacker must infiltrate the service provider system 20 to find out the user's telephone number. In addition, the hacker must have duplicated the second user terminal 12 having the telephone number or have the second user terminal 12 with the telephone number set therein to enable illegal end user authentication.

If the secondary password of the user is temporarily set in the phone authentication DB 23 according to steps 21 to 23, the user authentication and service providing means 21 is the phone number of the user stored in the phone authentication DB 23. Is read and transmitted to the communication connection system 31 (step 24). Accordingly, the communication connection system 31 capable of ARS (voice answering system) processing dials the second user authentication terminal through the second access path and inputs the second password using the received user's phone number. (Step 25). At this time, when the mobile phone and the wireless Internet phone number of the user is stored in the phone authentication DB 23, the communication connection system 31, as well as ARS SMS (Short Message Service) and wireless Internet {WAP (Wireless Application Protocol) ), ME (Mobile Explorer, etc.) can be sent to the user to enter a secondary password. In particular, in the case of a wireless Internet phone, the communication connection system 31 may transmit a signal capable of automatically activating the wireless Internet browser. Thus, the user can access the wireless Internet server (not shown) and check the message immediately without separately activating the wireless Internet browser. The user who receives the message can operate the second user terminal 12 to access the secondary password of the user. Is input to the communication connection system 31 via the second connection path (step 26). Here, when the secondary password stored in the telephone authentication DB 23 is predetermined, the secondary password of the user is set in advance in the memory of the second user terminal 12, and the communication connection system 21 selects the secondary password. Reading information automatically is convenient for use. Here, the encrypted transmission of the user information (secondary password, etc.) through the second connection path is an optional and not an essential condition as in the first connection path described above.

The communication connection system 31 transmits the secondary password input from the second user terminal 12 to the user authentication and service providing means 21 via the second connection path (step 27). In addition, the connection management system 32 connected to the communication connection system 31 stores and manages the above-described communication history through the telephone number, and thus is used as basic data of charge tracking related to monitoring and tracking of illegal users. Make it. Specifically, the above-described work related to communication details and / or user authentication is monitored and recorded by the access management system 32 for recording security information. Such monitoring details include data related to the unique number, the number of times of input, the connection time, the incorrectly input secondary password, etc. of the corresponding second user terminal 12 which is automatically transmitted with the telephone number from the second user terminal 12 to the database. It can be stored to track illegal users in the future. The database is also the basis for the service provider to assign a transaction fee to the customer's telephone number, allowing the phone company to accept the price of the product in addition to the fee. Therefore, in order to use such a surrogate method, a separate access management and accounting system should be established in a telephone service provider (general telephone base station, mobile communication base station), and on a system capable of reliable connection and monitoring.

The user authentication and service providing means 21 compares the secondary password of the user transmitted through the second access path with the secondary password of the user temporarily stored through the first access path (step 28). As a result of the comparison, if the user currently connected to the system through the first access path is finally authenticated as a user having a right, the user authentication and service providing means 21 provides the service requested by the user to the user. (Step 29). For example, the user who has been finally authenticated by step 29 may be allowed to access the resource object 40 or update its information. Here, the resource object 40 that is allowed to access or update according to the final user authentication may be important data about personal credit card information, bank account, product transaction history, and personal privacy. On the other hand, in step 28, if the comparison results do not coincide with each other, processing according to a separately defined rule or rollback of the existing transaction of the user on the system (step 30). In addition, if the response time from the second user terminal 12 exceeds the specified time, it may be processed as in step 30.

As described above, in the user authentication system using the second connection path according to the present invention, the reliability of the user authentication is improved by performing the user authentication through a different connection path than the first connection path used when using the service. Furthermore, in the user authentication system using the second access path according to the present invention, even if a hacker intercepts all the user information transmitted on both access paths, the telephone number of the legitimate user and the second user terminal 12 connected to the phone number 12 Must have Therefore, the security level, reliability and stability of the user authentication system are greatly improved compared to the existing ones.

In addition, the second password of the legitimate user is given by the user or by the service provider system 20 arbitrarily, so that each time a user authentication is required, a different password is given to the second password intercepted by the hacker at the previous user authentication. Makes pointless

In another preferred embodiment of the present invention, the second user terminal 12 shown in FIG. 1 is implemented as a multi-telephone-number system having at least two telephone numbers. In this case, the telephone authentication DB 23 stores the authentication-only phone number in the multi-phone number system for use. This method does not comply with the authentication request when the user requires a unique number when requesting authentication, and performs authentication by connecting with the unique number only when requesting the authentication-only phone number. Therefore, even in the worst case, that is, even when a user who does not have a right has a copy and owns a second user terminal 12 having a unique phone number of a user having a right, the present invention is linked to a multi-phone number system. The user authentication system can communicate with a terminal having a unique number only when the second access path for end user authentication uses a dedicated phone number other than the unique number. This provides the best security system, and thus provides a further improved security effect and reliability than before. Another modified embodiment according to the present invention is user authentication information using the above-described second access path (i.e. , Secondary password) may be used the user's red eye information or fingerprint information. In this case, the second user terminal should be implemented as a terminal capable of recognizing a user's red eye or fingerprint, and corresponding authentication information should be set in the system.

When the user authentication system according to the present invention is applied, even if a person borrows his or her own cash card or credit card, the rightful owner of the card uses the second user terminal 12 (for example, a mobile phone) to deal with the transaction. By verifying and completing the transaction, you can always do credit with confidence.

On the other hand, a number of modified embodiments that are not mentioned in the technical scope according to the spirit of the present invention will be apparent to those skilled in the art to understand the spirit of the present invention and the embodiments described above.

As described above, the user authentication system according to the present invention provides a significantly improved security effect and reliability compared to the existing system by performing user authentication through a second access path different from the first access path used for service use. .

In addition, if the user authentication method of the present invention is more organically combined with the existing user authentication method, hacking is performed by performing a final user authentication using a second password different from the first password for user authentication. Minimize risks and enable reliable communication transactions. In this case, even if the hacker intercepts the first password, the transaction can be completed only by a second user terminal having a right holder's telephone number set, thus providing a stronger security effect.

In addition, when using the user authentication system of the present invention in conjunction with a multi-phone number system, the stability and reliability of the user authentication system can be more remarkably guaranteed.

The wide spread and use of the user authentication system according to the present invention further ensures the reliability and stability of electronic commerce using a communication network, thereby greatly reducing the anxiety of the general user, thereby further providing an effect of promoting the development of related industries. .

Claims (11)

An authentication system for authenticating a user of a first user terminal connected through a first connection path, A service provider system for processing a request from the first user terminal through the first connection path within a preset range and performing user authentication when a request outside the preset range is requested; A second user terminal registered by a true user of an ID used to access the service provider system; A communication connection and management system that connects to the second user terminal according to the user authentication of the service provider system, requests authentication information for user authentication, and transmits the user authentication information from the service provider system to the service provider system; And A second connection path connecting the communication connection and management system with the second user terminal period, The communication connection and management system includes a connection management system that records and manages the communication history through the second connection path for charging of charges related to service use according to user authentication and illegal user tracking. User Authentication System. delete The system of claim 1, wherein the service provider system is An authentication database for storing data for user authentication; When a user requests a request that is out of a set range, the user authenticates the user through the communication connection and management system connected to the second connection path. User authentication and service providing means for obtaining user information and performing user authentication; And And a telephone authentication database for storing authentication information of the user through the second connection path. The system of claim 1, wherein the communication connection and management system is A communication connection system connected to the second connection path and communicating with a communication terminal of a user connected to the second connection path according to performing user authentication of a service provider system to obtain user authentication information and provide the same to the service provider system. User authentication system, characterized in that. delete 2. The user authentication system according to claim 1, wherein the second user terminal is a multi-phone number terminal having at least two phone numbers. The system of claim 1, wherein the second user terminal is a mobile phone. In the method for authenticating a user connected by the first connection path, (1) storing user information including a second user terminal number of the user accessible by a second connection path; (2) processing a request of the first user terminal of the user connected through the first connection path within a preset range; (3) calling the second user terminal through the second connection path when a request outside the preset range is requested from the user terminal in step (2); (4) receiving authentication information for user authentication from the second user terminal; (5) recording and managing the communication history through the second access path to charge the service related to the use of the service according to the user authentication and to track the unjust user; And (6) A user authentication method comprising comparing the authentication information of step (4) with the previously stored user information. 9. The method of claim 8, wherein step (2) is performed after authenticating a user using an ID of each user and a primary primary password through the first user terminal connected through the first access path. User Authentication Method. 9. The user authentication method according to claim 8, wherein steps (3) and (4) call the second user terminal using an ARS processing function and receive authentication information from the second user terminal. The method according to claim 8, wherein if the unique number of the second user terminal and the user authentication phone number are stored in step (1), step (2) is performed according to the user's selection. User authentication method characterized in that the telephone call to any one.