KR100838488B1 - The method and apparatus for protecting identification data using one-time and altered identification data generation mechanism, need not to install the program for preventing keystroke hacking on user computer - Google Patents

Abstract

A method and a device for protecting information with an altered one-time ID data generation mechanism not installing a keystroke hacking prevention program to a user computer are provided to protect keystroke data by generating an altered virtual keyboard image and allowing a user to input the ID data for authentication through the altered virtual keyboard image. An ID data input/display unit(103) receives ID data for user authentication of a connected website. A real/virtual key-array image set generator(104) generates an ID data input window and a real/virtual key-array image set for the connected website. A database storing part(105) stores virtual key-array string data and virtual key-array string UIDs(Unique ID). An input interface(102) receives virtual ID data string matched with each character of a real ID data string of a user. A virtual ID data comparator(106) extracts the real ID data string by comparing the virtual ID data string and the virtual ID data string UID received from a user computer(100) with the virtual ID data string and the virtual ID data string UID stored in the database. A user authenticator(107) authenticates the user by receiving the extracted real ID data string from the virtual ID data comparator.

Description

Method and Apparatus for Protecting Identification Data using One-time and Altered Identification Data Generation Mechanism, need Not to install the Program for Preventing Keystroke Hacking on User Computer}

1 is a configuration diagram of an information security apparatus using a modulated one-time authentication data generation method that does not require installation of a keystroke hacking security program on a user computer of the present invention;

2 is a flowchart illustrating an operation flow between a user computer and a web server using an information security method using a modified one-time authentication data generation method that does not require installation of a keystroke hacking security program on the user computer.

3 is a flowchart illustrating a user authentication process according to an embodiment of the present invention;

4 is a real / virtual key array image according to an embodiment of the present invention.

<Description of the symbols for the main parts of the drawings>

(100): Your computer (101): Web server

102: input interface 103 authentication data input port

(104): real / virtual key array image set generator

105: database storage unit 106: virtual authentication data comparison unit

(107): user authentication unit 400: real / virtual key array image

The present invention provides a keystroke hacking security method and apparatus for a user computer, wherein a keystroke hacking security program is installed by generating a modulated virtual keyboard image when inputting authentication data for authentication and inputting authentication data by the generated image. An information security method and apparatus that enables keystroke security using a modulated one-time keyboard image without the need for an electronic device.

Today, computer users use e-commerce sites such as Internet shopping malls and open markets, financial transaction sites such as internet banking and stock trading, entertainment sites such as music, movies, and games, and various convenience service sites such as lectures, medical services, and travel. Many web-based services and solutions on the network, including portals, messengers, e-mail, and specific intranet sites, are authenticated to require user identification at the Web site where the application is delivered.

By the way, this user authentication, which usually goes through several times a day, is invaluable only when the essential element of authentication security plays its role. In addition, as the current IT environment paradigm is gradually transforming into a ubiquitous environment, the importance of information sharing and collaboration is increasing day by day, so the necessity of authentication process for user identification and the importance of authentication security need not be mentioned separately. .

In addition, due to the recent advances in computer technology, hacking technologies such as keylogging, sniffing, and phishing have become more advanced, such as keystroke hacking security programs, firewalls, and intrusion detection systems. Individual use of network security products is not easy to eliminate the risk of leaking authentication information, and personal and non-authentication information, as well as authentication information, is leaking, causing a lot of economic and social damage. Authentication information is like a key to personal information leakage and is the most basic and very important thing in security.

In general, various methods are applied to protect authentication data information.

First, the most common form is to directly input authentication data information through the input interface and transmit the authentication data information to the authentication server without processing. However, this method poses a risk of information leakage by exposing authentication data information during keystroke hacking or network transmission on a user's computer.

Secondly, when the user directly inputs authentication data information through an input interface, the data is encrypted and transmitted to the authentication server. However, even in such a method, there is a risk of keystroke hacking on the user's computer, and there is no risk of leaking depending on the encryption level and method during network transmission.

Third, a keystroke hacking security program is installed on the user's computer, encrypted, and transmitted to the authentication server. The keystroke hacking security program prevents the leakage of authentication data information related to the input interface on the user's computer and prevents the leakage of information by using encryption techniques during network transmission. However, each hacking security program provided differently for each site must be installed at least once on the user's computer, and if the user wants to use the site for security, the user has to bear the inconvenience. In addition, the integrity of the hacking security program itself or the installation on the user's computer must be further ensured.

Fourthly, in view of user usage in parallel with the above-described conventional technology, more complicated combinations of letters, numbers, special symbols, etc. of authentication data, more than a certain number of digits, restrictions on the use of authentication data information registered once, etc. It may also require authentication data information. This can increase authentication security somewhat but results in relatively low user convenience. In general, most users tend to use authentication data information that has a specific meaning or is simple and easy to remember while maintaining satisfaction with security.

The present invention was created to solve the above-mentioned conventional problems. Unlike the hacking security program focused on preventing the leakage of authentication data information in the prior art, numerous web-based services and solutions on the network, and the web To prevent users from recognizing accurate authentication data even if they are keystroke hacked in applications that require user authentication, such as login authentication or electronic payment authentication on Internet websites, or when the authentication data information is exposed during network transmission. When the user authentication screen is reloaded, it generates authentication data that is changed every time, and there is no need to install a program for keystroke hacking security on the user's computer, and it is easy to remember and secure even using simple authentication data information. Castle In order to avoid sacrificing air, and the authentication data information security method and apparatus using the authentication security and modulated one-time authentication data generation method which can consider the user's convenience at the same time for the purpose of providing.

In order to achieve the above object, an embodiment of the present invention will be described based on the accompanying drawings.

1 is a block diagram of an information security apparatus using a modified one-time authentication data generation method that does not require installation of a keystroke hacking security program on a user computer.

As shown in the drawings, the present invention for achieving the above object is an information security device using a modified one-time authentication data generation method that does not require the installation of a keystroke hacking security program on a user computer, the user of the various sites provided through the network Web server 101 for connecting the user computer 100 to the desired site, authentication data input display unit 103 for inputting authentication data for user authentication of the connected site, authentication data input window of the connected site and actual A real / virtual key-array image set generator 104 of the web server 101 on which a virtual key array image set is generated, and a real / virtual key array image of the web server 101 Virtual key array string information and virtual key array string UID (Unique IDentifier) information among the actual / virtual key array image sets generated by the set generator 104. A database storage unit 105 for storing the data, an input interface 102 for inputting a virtual authentication data string matched with each character (including numbers and special symbols) of the user's actual authentication data string, and the user computer 100. Web server 101 extracts the actual authentication data string by comparing the virtual authentication data string and the virtual authentication data string UID information received from the server with the virtual key array string information and the virtual key array string UID information stored in the database storage 105. User authentication unit of the web server 101 which performs user authentication by exclusively receiving the actual authentication data string extracted from the virtual authentication data comparison unit 106 of the web server 101 and the virtual authentication data comparison unit 106 of the web server 101 107).

2 is a flowchart illustrating an operation flow between a user computer and a web server using an information security method using a modulated one-time authentication data generation method that does not require installation of a keystroke hacking security program on a user computer of the present invention. In a flow chart illustrating a user authentication process according to an embodiment of the present invention, in the information security method using a modified one-time authentication data generation method that does not require the installation of a keystroke hacking security program on the user computer,

Connecting through the user computer 100 to the authentication data input display unit 103 of the site desired by the user among various sites provided through the network from the web server 101 (200, 201, 300, 301);

Generating (202) an authentication data input window and a real / virtual key array image set of the site in the real / virtual key-array image set generation unit 104 of the web server 101;

The virtual key array string information and the virtual key array string UID (unique identifier) information among the real / virtual key array image set generated by the real / virtual key array image set generating unit 104 of the web server 101 are stored in a database. Storing (203) in the storage unit 105;

The real / virtual key array image 400 and the real / virtual key among the authentication data input window and the real / virtual key array image set of the site generated by the real / virtual key array image set generating unit 104 of the web server 101. Transmitting (204) the UID information of the array image to the authentication data input display unit 103 of the user computer 100;

The real / virtual key array image 400 of the authentication data input window and the real / virtual key array image set of the corresponding site generated by the real / virtual key array image set generating unit 104 of the web server 101 may be used. Displaying (205, 302) on the authentication data input display unit (103) through;

Receiving (206, 304) a virtual authentication data string matching each character (including numbers and special symbols) of the user's actual authentication data string from the user through the input interface 102 of the user computer 100;

Transmitting (207) the virtual authentication data string and the virtual authentication data string UID information received from the user to the virtual authentication data comparison unit 106 of the web server 101;

The virtual authentication data string and the virtual authentication data string UID information transmitted from the user computer 100 by the virtual authentication data comparison unit 106 of the web server 101 are stored in the database storage unit 105. Extracting (208, 209, 210, 306) the actual authentication data string by comparison with the key array string UID information;

A step 211 of transmitting the actual authentication data string extracted from the virtual authentication data comparison unit 106 of the web server 101 to the user authentication unit 107 of the web server 101 is provided.

In step (200, 201, 300, 301) of connecting through the user computer 100 to the authentication data input display unit 103 of the site desired by the user among the various sites provided through the network from the web server 101, The authentication data input display unit 103 of the site includes a web page or various types of authentication data input windows (for example, a login authentication window and an electronic payment authentication window) implemented as a web-based service, solution, or application. Preferably, when the authentication data input display unit 103 of the site is connected, the authentication data input window and the actual / virtual key array image set generation are generated in the real / virtual key array image set generating unit 104 of the web server 101. It is characterized in that the request (201, 301).

In step 202, the real / virtual key array image set generation unit 104 of the web server 101 generates an authentication data input window and a real / virtual key array image set of the site. Is preferably composed of a real / virtual key array image 400, UID information of the real / virtual key array image, and virtual key array string information, where the real / virtual key array image 400 is in accordance with the present invention. According to an embodiment, the virtual key arrays are shuffled at random to generate an image that is 1: 1 matched with the actual key arrays.

Further, according to another embodiment of the present invention, the actual / virtual key array image 400 may be generated according to the authentication data valid conditions (for example, only numbers, valid letters, and special symbols) of the corresponding site. Can be limited (for example, only numbers, only letters, or mixed letters and numbers).

In addition, the UID of the real / virtual key array image may be 1: 1 matched with the real / virtual key array image 400 as a unique identifier of the generated real / virtual key array image 400.

In addition, the virtual key array string information is information representing a virtual key array matched 1: 1 with the real key array in the real / virtual key array image 400, and extracts the actual authentication data string from the virtual authentication data string received from the user. This is necessary information.

In addition, according to another embodiment of the present invention, the actual / virtual key array image set may include time information (eg, creation time, input limit time, valid time, etc.), and the time information may be inputted by the corresponding site. It may be additionally generated for the automatic update timer function of the authentication data input display unit 103 requiring a time limit, and when the automatic update is performed, the actual / virtual key array image set generation unit 104 of the web server 101 may be generated. The actual / virtual key array image set is reproduced and displayed on the authentication data input display unit 103 via the user computer 100. (305)

In addition, when the user or the system reloads the authentication data input display unit 103 of the site (for example, update or reopen, reopen, reconnect due to communication failure, etc.), the web server ( In the real / virtual key array image set generating unit 104 of 101, the real / virtual key array image set is regenerated and displayed on the authentication data input display unit 103 through the user computer 100. (303)

Storing virtual key array string information and UID information among the real / virtual key array image set generated by the real / virtual key array image set generating unit 104 of the web server 101 in the database storage unit 105 ( In 203, when time information is included in the real / virtual key array image set, the time information is also stored in the database storage unit 105.

The authentication data input display unit 103 of the user computer 100 displays the authentication data input window and the actual / virtual key array image set of the site generated by the real / virtual key array image set generating unit 104 of the web server 101. In step 204, the UID information of the real / virtual key array image 400 and its real / virtual key array image may be leaked even if exposed during transmission, but the network transmission encryption / decryption of the site is performed. If a security method is used, it can be applied to improve security.

The real / virtual key array image 400 of the authentication data input window and the real / virtual key array image set of the site generated by the real / virtual key array image set generating unit 104 of the web server 101 may be used. In steps 205 and 302 of displaying on the authentication data input display 103 through 100, the authentication data input display 103 is freely movable according to another embodiment according to the present invention in addition to the fixed type included in the web page. It is characterized in that it also includes the input window form of the removable, pop-up window.

In step (206, 304) of receiving a virtual authentication data string matched with each letter (including numbers and special symbols) of the actual authentication data string of the user through the input interface 102 of the user computer 100, The user reports the actual / virtual key array image 400 in the virtual authentication data string matched with the actual authentication data string in the authentication data input window in order.

Here, the actual authentication data is information stored by the user as authentication data (for example, a login password, an electronic payment authentication password, etc.) registered in the site.

In addition, even though the virtual authentication data string input by the user is exposed to keylogging by a keystroke hacking program, it is difficult to identify the actual authentication data string because it is a modulated authentication data string instead of the actual authentication data string.

In addition, the input interface 102 of the user computer 100 includes not only a keyboard but also an interface such as a mouse, a keypad, etc. according to another embodiment of the present invention, and is not limited to a computer system, such as a PDA or a mobile phone. And an input interface 102 in the portable terminal.

In step 207 of transmitting the UID information of the virtual authentication data string and the virtual authentication data string received from the user to the virtual authentication data comparison unit 106 of the web server 101, the virtual authentication data string and the virtual authentication data string. Although UID information may be exposed during transmission, authentication information may be leaked. However, if a network transmission encryption / decryption security method of the corresponding site is used, the security may be increased by applying it.

The virtual authentication data string and the virtual authentication data string UID information transmitted from the user computer 100 by the virtual authentication data comparison unit 106 of the web server 101 stores the virtual key sequence string information stored in the database storage unit 105 and In operation 208, 209, 210, and 306 extracting the actual authentication data string by comparing the virtual key array string UID information, the same UID as the virtual authentication data string UID information received from the user computer 100 is stored in the database storage unit ( Query 208 to obtain the corresponding virtual key array string information, compare the virtual authentication data string with the virtual key array string information (209), and then display each character of the virtual authentication data string (including numbers and special symbols). And extracting an actual authentication data string that matches 1: 1.

In step 211, the actual authentication data string extracted by the virtual authentication data comparison unit 106 of the web server 101 is transmitted to the user authentication unit 107 of the web server 101. Is transmitted to the user authentication unit 107 for user authentication (for example, authentication for login approval or rejection, authentication for electronic payment approval or rejection, etc.) 212, 213, 307, and 308. .

Here, in addition to using the user authentication unit 107 already provided in the site, the user authentication unit 107 may be configured to newly configure the user authentication unit 107 according to another embodiment according to the present invention. It is done.

In order to achieve the above object, in applying the above-described embodiment of the present invention, a modulated authentication data generation method may be defined and expressed as a function as follows.

y = x

That is, the actual authentication data string x is modulated by matching 1: 1 with the virtual authentication data string y.

In addition, according to an embodiment according to the application of another function according to the present invention can be defined as a function as follows.

y = shift (x, +1)

y = shift (x, -1)

That is, the virtual authentication data string y is changed to +1 or -1 by the application of a shift when the virtual authentication data string y is 1: 1 matched and modulated in the actual authentication data string x.

The present invention is not limited to the above-described specific preferred embodiments, and various modifications can be made by those skilled in the art without departing from the gist of the present invention as claimed in the claims. Of course, such changes will fall within the scope of the claims.

The effects of the present invention that can be expected by the configuration and action as described above are as follows.

Unlike the conventional keystroke hacking security program focused on preventing the leakage of authentication data information due to keystroke hacking, the authentication data generation scheme modulated even when the keystroke hacking or the authentication data information is exposed during network transmission. By inputting and transmitting the virtual authentication data information so as not to recognize the correct authentication data information by using the keystroke hacking security and prevents information leakage during network transmission.

In addition, the present invention provides a more effective security by applying a method of generating one-time authentication data that is changed every time when the user authentication screen is reloaded.

In addition, the present invention, the conventional keystroke hacking security program must be installed on the user computer to obtain a hacking security effect, this also occurs when the integrity is not guaranteed during the installation process on the hacking security program itself or the user computer. Contrary to this, the user does not need to install a program for keystroke hacking security on the user's computer. Therefore, if the user is skeptical of installing a different hacking security program for each site to use, it prevents such a risk. It also provides more user convenience.

In addition, the present invention, virtual authentication data is generated and transmitted even in the case of using simple authentication data in consideration of general user tendency to use authentication data information that is easy to remember and simple or has given a specific meaning, so as not to impair security. It also provides the effect.

As described above, the authentication security and user convenience can be considered at the same time through the application of the information security method and apparatus using the modulated one-time authentication data generation method that does not require the installation of a keystroke hacking security program on the user computer.

Claims (2)

An information security apparatus using a modified one-time authentication data generation method that does not require installation of a keystroke hacking security program on a user computer. A web server 101 for connecting the user computer 100 to a desired site among various sites provided through a network, An authentication data input display unit 103 for inputting authentication data for user authentication of a connected site; A real / virtual key-array image set generating unit 104 of the web server 101 in which the authentication data input window of the connected site and the real / virtual key array image set are generated; The virtual key array string information and the virtual key array string UID (unique identifier) information of the real / virtual key array image set generated by the real / virtual key array image set generating unit 104 of the web server 101 Database storage unit 105 for storing, An input interface 102 for inputting a virtual authentication data string that matches each character (including numbers and special symbols) of the user's actual authentication data string; The virtual authentication data string and the virtual authentication data string UID information received from the user computer 100 are compared with the virtual key array string information and the virtual key array string UID information stored in the database storage unit 105 to extract the actual authentication data string. The virtual authentication data comparison unit 106 of the web server 101, A user computer comprising a user authentication unit 107 of a web server 101 for authenticating a user by receiving the actual authentication data string extracted from the virtual authentication data comparison unit 106 of the web server 101. An information security device using a modified one-time authentication data generation method that does not require installation of a keystroke hacking security program. An information security method using a modified one-time authentication data generation method that does not require installation of a keystroke hacking security program on a user computer, Connecting through the user computer 100 to the authentication data input display unit 103 of the site desired by the user among various sites provided through the network from the web server 101 (200, 201, 300, 301); Generating (202) an authentication data input window and a real / virtual key array image set of the site in the real / virtual key-array image set generation unit 104 of the web server 101; The virtual key array string information and the virtual key array string UID information of the real / virtual key array image set generated by the real / virtual key array image set generating unit 104 of the web server 101 are stored in a database. Storing (203) in the storage unit 105; The real / virtual key array image 400 and the real / virtual key among the authentication data input window and the real / virtual key array image set of the site generated by the real / virtual key array image set generating unit 104 of the web server 101. Transmitting the array image UID information to the authentication data input display unit 103 of the user computer 100 (204); The real / virtual key array image 400 of the authentication data input window and the real / virtual key array image set of the corresponding site generated by the real / virtual key array image set generating unit 104 of the web server 101 may be used. Displaying (205, 302) on the authentication data input display unit (103) through; Receiving (206, 304) a virtual authentication data string matching each character (including numbers and special symbols) of the user's actual authentication data string through the input interface 102 of the user computer 100; Transmitting (207) the virtual authentication data string and the phase authentication data string UID information received from the user to the virtual authentication data comparison unit 106 of the web server 101; The virtual authentication data string and the virtual authentication data string UID information transmitted from the user computer 100 by the virtual authentication data comparison unit 106 of the web server 101 are stored in the database storage unit 105. Extracting (208, 209, 210, 306) the actual authentication data string by comparison with the key array string UID information; User computer, characterized in that the step of transmitting the actual authentication data string extracted from the virtual authentication data comparison unit 106 of the web server 101 to the user authentication unit 107 of the web server 101 (211). Information security method using modulated one-time authentication data generation method that does not require installation of keystroke hacking security program.

Images