KR100814561B1 - One Time Password Authentication Using A Mobile Phone - Google Patents

Abstract

The present invention relates to a user authentication method using a one time password (OTP) method using a mobile communication terminal, wherein a user's identification information (ID / Password) is input to an authentication server of a site to be used through a login process. A second step of transmitting an SMS so that a mobile OTP module can be executed to a registered mobile communication terminal when a user corresponding to the identification information input from the authentication server joins the site; A third step of executing a mobile OTP module of a mobile communication terminal; A fourth step of generating an OTP by inputting a user's PIN through the mobile communication terminal; A fifth step of transmitting the OTP generated by the user's mobile terminal to the authentication server; And a sixth step of user authentication of the site using the transmitted OTP. In another aspect, the present invention may further include the step of transmitting a warning SMS when the authentication server of the site compares the IP band of the system where the user has recently logged in with the location of the user's current mobile communication terminal and is not in the same area. Accordingly, convenience and security of the user can be enhanced in the one-time password type user authentication method.

Mobile terminal, one-time password, OTP

Description

One-Time Password Authentication Using A Mobile Phone}

1 is a block diagram of a user authentication system using a wireless communication terminal according to the prior art.

2 is a flow chart of a user authentication method using a wireless communication terminal according to the prior art.

3 is a flowchart illustrating a one-time password type user authentication method using a mobile communication terminal according to an embodiment of the present invention.

4 is a flowchart illustrating a one-time password type user authentication method using a mobile communication terminal according to another embodiment of the present invention.

5 is a block diagram of a one-time password type user authentication system using a mobile communication terminal according to an embodiment of the present invention.

6 is a flowchart illustrating a one-time password type user authentication method using a mobile communication terminal according to another embodiment of the present invention.

The present invention relates to a one-time password type user authentication method, and more particularly, to a method for generating and authenticating one time password (OTP) using a mobile communication terminal.

Recently, as various security threats increase, security incidents frequently occur due to the leakage of IDs and passwords and illegal theft, and various cyber crimes and property damages are caused by the leakage of personal information online. Such leaks and thefts of IDs and passwords are usually caused by hacking or infection of malicious code such as viruses and worms. In order to prevent damages of such malicious codes or hacking, anti-virus, anti-spyware / adware (adware) and online firewall solutions are provided, but such a conventional security service is a reality that cannot be a fundamental alternative for preventing the leakage of personal information because continuous pattern update and security management by users are required. .

In addition, most user authentication on the Internet still follows a single user authentication method performed by ID and password only. Thus, a user authentication method that relies on known information has a high risk of leakage. Therefore, in order to secure this, two factor authentication method that combines biometrics, one-time password (OTP), PKI, etc. in addition to ID and password has appeared. Among them, the biometric method has a high incidence of recognition error and has a limitation on mobility, and thus, one-time password method has been used in recent years.

The one-time password method is a method of generating and entering a different password each time, rather than a fixed password. Since the password cannot be reused, it is a useful authentication solution that can reduce the exposure of the password and the theft of the user account. The one-time password method is used as a two factor method in financial sites because of its excellent security and mobility. In the past, a one-time password had to be carried separately with a hardware token or a software token (mobile OTP) generator. In particular, in the case of a hardware token, there was a problem of paying a fee when it was issued or lost. In addition, authentication errors frequently occur due to inconvenience and time delay or input error that the generated one-time password must be input to the terminal connected to the network for user authentication, and procedures for verifying the identity between the OTP owner and the user account owner are provided. There was an inadequate problem.

Korean Patent Publication No. 1999-37751 (published May 25, 1999) includes a password generation unit that has a password generation function to generate a response value as a one-time password from a challenge value including a time received from a communication module from a server. A mobile communication terminal device is disclosed. However, it is expensive to manufacture a mobile communication terminal having a password generation unit, and requires a separate input to obtain a challenger value. Thus, a complicated password generation procedure is required and a communication with an authentication server is required to obtain a password. there was.

In addition, Korean Patent Publication No. 2000-17997 (published on April 6, 2000) discloses a system for receiving a one-time password using a wireless communication terminal. Since it is used passively only as a means of receiving, the user had to communicate with a separate terminal that can be connected to the authentication server in order to execute the one-time password for authentication.

Figure 1 shows a user authentication system using a wireless communication terminal according to the prior art. The conventional system is installed on the service provider side, and processes and stores various information associated with the electronic commerce, computer server 10 having a database for the user, and a plurality of user terminals connected to the server 10 via the Internet 20, the Internet network 30 connecting the computer server 10 and the terminal 20, the wireless communication terminal 25 owned by the user, and the computer server 10 connected to the wireless communication terminal 25. It consists of a wireless communication network (40).

2 is a flow chart of a user authentication method using a wireless communication terminal according to the prior art. First, the user accesses the computer authentication server 10 through the terminal (S100). The next user is already registered in the authentication server 10 and requests user authentication by inputting an ID and a password which is a user identification number assigned to the user (S110). Upon receiving the authentication request, the server 10 determines whether the ID and password input by the user are the same as the ID and password of the user identification database (S120). If the input identification number is the same as the ID and password stored in the server 10, the server 10 transmits the one-time password to the wireless communication terminal 25 registered by the user corresponding to the input ID (S130). When the user inputs the one-time password received by the wireless communication terminal 25 to the server 10 (S140), the server 10 determines whether the one-time password transmitted to the wireless communication terminal 25 and the received one-time password match. (S150). If the two data match the user authentication is completed (S160).

The present invention provides a one-time password (OTP) user authentication method using a mobile communication terminal to prevent exposure of user IDs or passwords that may occur online and to prevent leakage of personal information or online security incidents. It aims to provide.

Another object of the present invention is to provide a one-time password type user authentication method using a mobile communication terminal, which is very simple and secure, and the convenience of the user is one-time password generation and authentication.

Another object of the present invention is to use the mobile communication terminal not only for the one-time password generation and authentication, but also to compare the location tracking of the user's mobile terminal with the IP band of the logged-in system. It is to provide a more secure user authentication method characterized in that the authentication is made.

Another object of the present invention is that if the site where the user tries to authenticate is subscribed to the Trusted Network, if the location of the mobile communication terminal and the IP band of the user's login system are different, The present invention provides a method for authenticating a user, wherein a temporary lock function is performed for all accounts of a user.

A one-time password type user authentication method using a mobile communication terminal according to the present invention comprises a first step of inputting identification information (ID / Password) of a user to an authentication server of a site to be used through a login process; A second step of transmitting an SMS so that the mobile OTP module can be executed to the mobile communication terminal registered when the user corresponding to the identification information input from the authentication server joins the site; A third step of executing a mobile OTP module of a mobile communication terminal; A fourth step of generating an OTP by inputting a user's PIN through the mobile communication terminal; A fifth step of transmitting the OTP generated by the user's mobile terminal to the authentication server; And a sixth step of user authentication of the site using the transmitted OTP.

In the present invention, the SMS transmitted for executing the OTP module is transmitted only when the mobile terminal registered when the user joins the site is owned by the user. The sent SMS also preferably includes a username, login site name, time, and options to run the mobile OTP module.

In addition, the present invention after the step of transmitting the OTP generated in the user's mobile terminal to the authentication server, the authentication server of the site is the same by comparing the location of the user's current mobile terminal with the IP band of the system that the user recently logged in If it is not a region may further comprise the step of sending a warning SMS.

At this time, the IP band of the system where the user logs in is a public IP provided by the Internet line provider, and the provider providing the Internet line allocates IP to the system and manages the IP band. You can see where the is located. In addition, the location of the mobile communication terminal is confirmed through a mobile phone location tracking service. The warning SMS sent when the user is not in the same area by comparing the IP band of the system where the user recently logged in with the location of the user's current mobile terminal includes the user's information such as login time and site information, user account lock, and user password change. It is preferable that an optional countermeasure of.

On the other hand, in the present invention, if the site attempting to log in is subscribed to the Trusted Network, a warning SMS is sent and a temporary lock is performed on all accounts of the users subscribed to the Trusted Network network. Trusted network network is composed by providing the domain name and IP address information of the site to the trusted network network in order to prevent the spread of security incidents and to ensure the secure and reliable site for various application providers, wired, wireless and online. Trusted DNS is established using In this way, the present invention can be more effectively used for authentication of sites subscribed to the trusted network.

Hereinafter, embodiments of the present invention will be described with reference to the drawings.

3 is a flow chart of a one-time password user authentication method using a mobile communication terminal according to an embodiment of the present invention. The user authentication method of the present invention largely consists of a user login step, an OTP execution and generation step, and a user authentication step.

The first step (S310) is a step of logging in by inputting an ID and password at a site that a user wants to use. The login step S310 is performed by a login method of a typical Internet site, and the authentication server of the corresponding site primarily authenticates the user using the input ID and password.

The second step (S320) is a step of transmitting an SMS so that the OTP module can be executed from the authentication server to the user's mobile communication terminal. The authentication server transmits an SMS so that the mobile OTP module can be executed to the mobile communication terminal number registered when the user corresponding to the input ID and password is registered. At this time, the authentication server manages information on whether the mobile terminal number entered when the user subscribes is a terminal owned by the subscriber. If an attempt is made to log in by stealing an account other than the user, the OTP module Can not receive SMS to run.

In addition, if the site is a phishing site, even if the user's ID and password are entered, the user cannot send an SMS requesting the mobile OTP, so the user can easily determine whether the site is a phishing site. Phishing is a compound word of personal information and fishing. It creates a fake homepage of a famous company and sends out e-mails to an unspecified number of e-mail users to deceive personal information by accessing the fake homepage. Say. The present invention can block the access to the phishing site by not being able to send an SMS requesting a mobile OTP when accessing such a phishing site.

The third step S330 is a step in which OTP is executed. The SMS transmitted in the second step S320 includes a user name, a login site name and a time, and an option for driving the mobile OTP module. The mobile OTP module can be executed by pressing the driving confirmation in the received SMS. If the OTP module is already installed in the user's mobile communication terminal, the user may be directly executed.

The fourth step S340 is a step in which a user inputs a PIN to generate an OTP. The input of the PIN is a method of confirming that the owner of the mobile OTP is possible, and even if the mobile communication terminal is lost, the OTP can be prevented from being generated by another person.

The fifth step S350 is a step in which the generated OTP is transmitted to the authentication server of the corresponding site. In the executed mobile OTP module, the user inputs a PIN to generate an OTP (S340), and when the user selects OK, the OTP generated by the mobile communication terminal is directly transmitted to the authentication server (S350). As such, when the OTP generated by the mobile OTP is transmitted to the authentication server by using a mobile communication terminal such as a mobile phone, the user does not need to directly input the received OTP in order to access the corresponding site and receive an input time delay or Authentication errors that can occur due to input errors can be reduced.

The sixth step S360 is a final step of authenticating the user using the OTP transmitted from the authentication server. The authentication server authenticates the user by checking whether the user is a legitimate user with the ID and password entered by the user in the site and the OTP generated and transmitted by the mobile OTP.

4 is a flow chart of a user authentication method using a mobile communication terminal according to another embodiment of the present invention, a method of authenticating a user with enhanced security combined with a method of analyzing and comparing a location of a user together with mobile OTP authentication; Shows. Specifically, after the step of transmitting the OTP generated by the user's mobile terminal to the authentication server (S450), the authentication server of the site compares the location of the user's current mobile terminal with the IP band of the system where the user recently logged in. If not in the same area (S480) further comprises the step of transmitting a warning SMS (S491).

In the present invention, the IP band of the logged-in system means a public IP assigned by a company that provides an Internet line, such as KT or Dacom. Since the Internet line provider manages such an IP band, a user who uses the Internet You can check if you are located in the area. For example, one of the services provided by the Internet portal site may provide weather information at the current location of the user, and this service uses IP band information managed by the Internet line provider.

In one embodiment of the present invention through the login process, the user's identification information (ID / Password) is input to the authentication server of the site to be used (S410), and the SMS is transmitted so that the mobile OTP module can be executed to the mobile communication terminal ( S420), the mobile OTP module of the mobile communication terminal is executed (S430), and a user's PIN is input through the mobile communication terminal to generate an OTP (S440), and then the generated OTP is transmitted to the authentication server (S450). The process is the same as the embodiment according to FIG. 3 illustrated above.

However, the present embodiment further includes a step (S480) of comparing and analyzing the location information of the user. The OTP authentication server compares the IP band of the system to which the user who attempts to log in recently with the IP band of the currently logged-in system to identify whether the ID / Password is leaked or stolen. In addition, at the time of login, the location of the mobile communication terminal is determined using the mobile phone location tracking service (S460), and the IP band of the logged-in system is compared and analyzed through the ISP information. Analyze whether the location of the mobile communication terminal of the user and the IP band of the logged-in system are the same location.

The last step is to perform authentication using the location analysis result (S490) and to correspond to the user account leakage (S491). If the location of the user's mobile terminal and the IP band of the logged-in system are not the same, a notification SMS is sent to the user.

5 is an overall configuration diagram of a one-time password type authentication system combined with the location analysis of the mobile communication terminal according to an embodiment of the present invention.

The user goes through a dual authentication process in order to be authenticated at the site 50 to use. Attempt login by inputting ID and password. At this time, the login IP band that attempted to log in is transmitted to the OTP authentication server 55. The OTP is input by inputting a PIN using the OTP generation module received from the mobile communication terminal (53). When transmitting, the location tracking 54 of the mobile communication terminal is performed, and the location information is transmitted to the OTP authentication server 55 to compare the two location information.

6 is a flowchart illustrating a countermeasure when an illegal attempt is detected in a user authentication process according to an embodiment of the present invention. If the attempt to steal the account is confirmed (S610), an SMS is sent to the user (S620). The notification SMS sent contains the login attempt time and site information, and includes an optional countermeasure by the user such as user account lockout or password change, which enables real-time processing to detect leaks or theft of user accounts. If so, you can respond urgently.

In particular, if the site you are trying to log in to is joined to the Trusted Network, there is an error in the PIN number through the mobile terminal, or the IP band of your login system is either the latest IP band or the current mobile terminal. If the user's location analysis is different from the result of the analysis, the system sends a notification SMS and temporarily locks the accounts of all the users in the trusted network, thereby preventing the leakage of user accounts from affecting other sites. It can prevent the expansion of security incidents.

According to the user authentication method of the One Time Password (OTP) method using the mobile communication terminal according to the present invention, by receiving the OTP module to the mobile communication terminal directly enters the PIN directly to the mobile terminal very simple and secure Can be generated and used for authentication. In addition, the authentication method according to the present invention is configured to perform user authentication only in the same region by comparing and analyzing the location tracking of the user's mobile communication terminal with the IP band of the logged-in system, and in particular, the user If the site attempting authentication is joined to the Trusted Network, the temporary lock function for all accounts of the users subscribed to the Trusted Network Network if the location of the mobile terminal and the IP band of the user's login system are different. And the like, so that the user account can be effectively countered.

Claims (8)

As a one-time password (OTP) user authentication method using a mobile communication terminal, A first step of inputting identification information (ID / Password) of a user to an authentication server of a site to be used through a login process; A second step of sending an SMS from the authentication server to the mobile communication terminal registered when the user corresponding to the input identification information joins the site so that the mobile OTP module can be executed; A third step of executing a mobile OTP module of the mobile communication terminal; A fourth step of generating an OTP by inputting a user's PIN through the mobile communication terminal; A fifth step of transmitting the OTP generated by the user's mobile communication terminal to the authentication server; And a sixth step of user authentication of the site using the transmitted OTP. In claim 1, In the second step, the SMS is a user authentication method, characterized in that only when the mobile terminal registered when the user subscribes to the service owned by the user. The method of claim 1 or 2, The transmitted SMS includes a user name, a login site name, a time, and an option for driving the mobile OTP module. In claim 1, After the fifth step in which the OTP generated by the user's mobile terminal is transmitted to the authentication server, the authentication server of the site determines the IP band of the system where the user recently logged in and the location of the user's current mobile terminal. And comparing the step of transmitting a warning SMS when the mobile communication terminal is located in a different area from the system. In claim 4, The IP band of the system is a user authentication method, characterized in that the public IP managed by the Internet circuit provider. In claim 4, The location of the mobile communication terminal is a user authentication method, characterized in that confirmed through the mobile phone location tracking service. In claim 4, The alert SMS includes a login attempt time, site information, user account lock selection, or user password change selection. In claim 4, If the site attempting to log in is subscribed to the Trusted Network, the alert SMS is sent and at the same time, a temporary lock is applied to all accounts of the users subscribed to the Trusted Network. User authentication method.

Images