KR100844195B1 - A user authentication method of having used graphic OTP - Google Patents

Abstract

The present invention relates to a user authentication device and method for preventing illegal access by authenticating a user when accessing a web server through the Internet. More particularly, the present invention provides a server when a user passes through ID & password authentication. The present invention relates to a user authentication device and a user authentication method using a graphic OTP which can receive a user input from a plurality of images to move a key selected by a user to a designated hole.

In the user authentication method using the graphic OTP of the present invention, in the server operating method for authenticating a user using the graphic OTP, generating a synchronization code for the arrangement of the image group stored by the user and the synchronization code And transmitting the image group stored by the user to the terminal of the user, calculating a deviation of the first coordinate shift value in the image screen arranged using the synchronization code and the image group stored by the user. Receiving a deviation of the second coordinate shift value transmitted from the user's terminal, and determining whether to authenticate the user by comparing the deviation of the first coordinate shift value and the deviation of the second coordinate shift value.

GOTP, authentication, one-time password, phishing, pharming

Description

A user authentication method of having used graphic OTP}

1 is a flowchart illustrating a user authentication step according to the present invention;

2 is a flowchart showing a first authentication step according to the present invention;

3 is a flowchart illustrating a second authentication step according to the present invention;

4 is a flowchart showing a step of setting an image group according to the present invention;

5 is a flowchart illustrating an authentication step of a graphic OTP according to the present invention;

6 is a flowchart illustrating an execution step of a user terminal for performing a graphic OTP according to the present invention;

7 is an overall configuration diagram showing a user authentication system according to the present invention;

8 is a screen configuration diagram for the first authentication and the second authentication, according to the present invention;

9 is a conceptual diagram for selecting an image group according to the present invention;

10 is a conceptual diagram for arranging image groups according to an embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

110: user terminal 120: proxy server

130: GOTP authentication server 140: Web server

150: Web server with GOTP authentication server 160: FOD

The present invention relates to a user authentication device and method for preventing illegal access by authenticating a user when accessing a web server through the Internet. More particularly, the present invention provides a server when a user passes through ID & password authentication. The present invention relates to a user authentication device and a user authentication method using a graphic OTP that can authenticate a user by receiving coordinates for moving a key selected by a user to a designated hole among a plurality of images.

In general, a Graphic OTP (GOTP: Graphic One Time Password (GOTP)) transmits one or more graphic images to a user terminal, and the user checks the transmitted images and coordinates for virtually moving a predetermined matching image. Is being input via the keyboard.

In this case, when hooking, phishing, and pharming an image and a keyboard input transmitted to a hacker who attempts an illegal hacking, there is a problem of inferring a predetermined image from a user.

That is, the user selects one or more images corresponding to his key and stores one or more images corresponding to the selected images on the server. Subsequently, in the case where the GOTP is performed for user authentication, the server transmits to the user's terminal an image set in which an image stored by the user and an additional image different from the stored image are arranged at a predetermined position. The user checks the image set displayed on the terminal and inputs a coordinate shift value for matching the image selected by the user with the image using the keyboard.

The matched value is transmitted to the server to check whether the coordinate shift value is correct. If the input coordinate shift value is correct, the corresponding user is authenticated.

Therefore, if a set of images transmitted from the server for GOTP authentication is already arranged in a predetermined arrangement on the server and is transmitted to the user terminal, the user is hooked to the set of images and coordinate shift values arranged in the predetermined arrangement. There is a problem that one or more images selected and stored are stolen.

The present invention is to solve the problems of the prior art, when transmitting the image of the GOTP from the server to the user terminal, and transmits the image and the synchronization code to select the array function for the image arrangement separately, the corresponding synchronization code in the user terminal To provide a user authentication method using GOTP that selects an array function corresponding to, so that images transmitted by the selected array function can be arranged so that the image array of GOTP is not exposed through network hooking, phishing, and pharming. There is a purpose.

In addition, the present invention uses a GOTP that can prevent the exposure of the coordinate shift value through keyboard hooking by inputting by clicking the direction button displayed on the screen of the user terminal with a mouse to input the coordinate shift value of the GOTP. The purpose is to provide a user authentication system.

According to another aspect of the present invention, there is provided a server operating method for authenticating a user using a graphic OTP, comprising: generating a synchronization code for arranging an image group stored by the user, and storing the synchronization code and the user Transmitting an image group to the user's terminal, calculating a deviation of a first coordinate shift value in an image screen arranged by using the synchronization code and the image group stored by the user, and transmitting from the user's terminal Receiving a deviation of the second coordinate shift value and comparing the deviation of the first coordinate shift value with the deviation of the second coordinate shift value to determine whether to authenticate the user.

In addition, another object of the present invention is a terminal operating method for authenticating a user using a graphic OTP, selecting an image group stored by the user and an array function for arranging the image group to authenticate the user Receiving a synchronization code for transmitting from the server and an array function corresponding to the synchronization code is selected and one or more images in the image group is arranged according to the arrangement function and displayed on the screen and one or more displayed on the screen Inputting through selection of a direction button displayed on the screen to match a private key image to a hole image, and generating and transmitting a second coordinate movement value using the input movement coordinate to the server. .

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Prior to this, terms or words used in the specification and claims should not be construed as having a conventional or dictionary meaning, and the inventors should properly explain the concept of terms in order to best explain their own invention. Based on the principles that can be defined, it should be interpreted as meanings and concepts corresponding to the technical spirit of the present invention.

1 is a flowchart illustrating a user authentication step according to the present invention. As shown in FIG. 1, the user authentication is based on the first authentication S100 and the second authentication by the coordinate shift value for shifting the image stored and selected by the user according to the stored ID and password. It is made of (S200).

In step S100, which is the first authentication, the user ID and password are compared with the user ID and password stored in the server and matched with the user. If the ID and password entered by the user do not match the stored ID and password, the server does not authenticate the user.

In step S200, which is the second authentication, the position shift coordinates that are moved to position the user's private key image in the hall image among the image group displayed on the user's terminal are received, compared with the position shift coordinates checked by the server, and matched. If the step is to authenticate the user.

At this time, as a method for moving the private key image, the direction button displayed on the screen is clicked and moved with a mouse. However, when the direction button is clicked, the image displayed on the screen does not move, only the shifted position shift value is stored, and the stored coordinate shift value is encrypted and transmitted to the server.

Referring to FIG. 8, (a) is a screen displayed on the user terminal to receive an ID and password of the first authentication, and (b) is a private key image of the image group using GOTP, which is the second authentication. This is a screen displayed on the user terminal to receive a coordinate shift value.

2 is a flowchart illustrating a first authentication step according to the present invention. As shown in FIG. 2, in the first authentication corresponding to step S100 illustrated in FIG. 1, when a user accesses a server through a user terminal, the first authentication is performed to determine whether the user is an existing member (S110). If the user is not a member of a service provided by the server, the user performs a step for subscribing as a member of the server (S120).

If the user is a member subscribed to the server, the first authentication is performed by inputting and transmitting the user's ID and password in a window for inputting the ID and password transmitted from the server and displayed on the screen (S130).

In this case, when the authentication is completed (S140), the user performs the step S200 shown in FIG. 1, and when the authentication fails (S140), the user may select a step for performing the first authentication again. (S150).

3 is a flowchart illustrating a second authentication step according to the present invention. As shown in FIG. 3, the server checks the user ID and password of the user terminal that has passed the first authentication and recognizes the corresponding user (S210). At this time, if the user is not a member for performing the GOTP authentication on the confirmed ID and password (S220), performs the step of setting an image group for performing the GOTP authentication (S230), the user performs the GOTP authentication If the member can (S220), performs the GOTP authentication step (S240).

At this time, if the user fails the GOTP authentication (S240), it is possible to select a step for re-executing the second authentication GOTP authentication (S250), if the user passes the GOTP authentication (S240), The user can use services provided by the server.

4 is a flowchart illustrating a step of setting an image group according to the present invention. As shown in FIG. 4, the user selects one or more images from one or more images transmitted from the server and displayed on the screen of the user terminal to be used as the user's private key image, and one or more images for matching with the selected private key image. The hole image is selected (S231).

Thereafter, the background image to be filled in the image group displayed to the user is selected from the user and stored as the image group of the user together with the previously selected private key image and the hole image (S232).

Next, when the private key image or the hole image is lost, a text hint setting step for confirming the private key image and the hole image of the corresponding user is performed (S233).

The hint is a text input, which may be input by a user as a word or sentence that can be associated with the image according to the loss of the private key image and the hole image.

In addition, the image hint setting step is performed by the user's selection (S234). The image hint setting means that if the user loses the private key image or the hole image and the text key hint does not reveal the private key image or the hole image, the image hint setting selects one or more corresponding private key image or hole images selected and stored by the user. It is mixed with other selected images and output to the user terminal so that the user can infer the private key image or the hole image among the output images.

Therefore, the image hint setting step is to select one or more images output together with the user's private key image and hole image.

Referring to FIG. 9, in step S231, the user selects a private key image and a hole image to be used for GOTP authentication from one or more images displayed on the screen of the user terminal.

As shown in (b), the user stores the selected private key image and the hole image (b) on the server, and then selects a background image to be stored with the private key image and the hole image to the user's image group. Specify.

In this case, when the image group stored for performing the GOTP authentication is a 5 × 5 matrix, and there are three selected private key images and one hall key image, there are 21 background images to be selected.

If a group of images stored for performing GOTP authentication is a 7 × 7 matrix, and there are four selected private key images and one hall key image, there are 44 background images to be selected.

As shown in (c), in step S232, after the private key image and the hole image are selected by the user, the user selects 21 images to be used as the background image, and selects the selected private key image, the hole image and the background image. Can be saved as a group of images.

5 is a flowchart illustrating an authentication step of a graphic OTP according to the present invention. As shown in FIG. 5, the server generates a synchronization code for selecting an array function for arranging a group of images stored by a user in order to perform GOTP authentication with a corresponding user terminal (S241).

Since the synchronization code is generated according to the time for requesting to perform GOTP authentication, the probability of selecting the same synchronization code according to the number of synchronization codes and stored array functions may vary.

In addition, the array function is generated in the same number as the synchronization code and stored in the user terminal, and if the synchronization code generated according to the time that the server requests to perform GOTP authentication is transmitted to the user terminal, one or more of the array functions stored in the user terminal An array function corresponding to the transmitted synchronization code is selected.

The server transmits the generated synchronization code and the image group of the user to the terminal of the user (S242), using the transmitted synchronization code and the image group of the position movement coordinates of the user's private key image is moved to the hole image The deviation is calculated and the first coordinate shift value is calculated and stored (S243).

Thereafter, the second coordinate shift value transmitted from the user terminal and the first coordinate shift value calculated by the server are compared to compare whether the deviation of the position shift coordinates in which the private key image is moved to the hole image is matched (S244). If the deviations in match, complete the GOTP authentication.

If the first coordinate shift value calculated by the server and the second coordinate shift value transmitted from the user terminal do not match (S244), the server performs a selection step for re-executing GOTP authentication (S245).

If the GOTP authentication is performed again, starting from step S241 to regenerate the synchronization code. In this case, the data transmitted to the user terminal may transmit any one of the reproduced synchronization code or the reproduced synchronization code and the image group of the user.

Referring to FIG. 10, data transmitted from a server to a terminal of a corresponding user is a synchronization code and an image group selected and stored by the corresponding user as shown in (a). At this time, the transmitted image group is not transmitted in a specific order, but is transmitted in an arbitrary order so that the private key image and the hole image cannot be inferred from an illegal intruder.

6 is a flowchart illustrating an execution step of a user terminal for performing a graphic OTP according to the present invention. As shown in FIG. 6, the user terminal receives a synchronization code and an image group transmitted from a server, selects an array function corresponding to the corresponding synchronization code, and displays the image group on the screen of the terminal according to the array function ( S310).

In this case, the array function stores the same number as the number of synchronization codes generated according to a signal for requesting to perform GOTP authentication in the user terminal.

Subsequently, the user terminal receives a coordinate for moving the private key image to the hole image through the direction button displayed on the screen of the terminal from the user (S320), calculates a deviation of the input coordinate, and generates a second coordinate shift value. In operation S330, the generated second coordinate shift value is encrypted and encrypted.

The direction button may be provided as a vertical movement button up, down, left, or right to move the displayed image, and the direction button may be input using a pointing device such as a mouse connected to a terminal except for a keyboard.

If GOTP authentication passes in the server, the user terminal may complete the first authentication and the second authentication to use the service of the corresponding server.

Referring to FIG. 10, as shown in (b), the image group of the user is arranged on the screen of the user terminal by an arrangement function selected corresponding to the transmitted synchronization code.

The user moves the position by using the direction buttons shown in (b) of FIG. 8 to position one or more private key images selected by the user in the hole image among the group of images displayed on the screen. When the position movement is completed, the movement is completed by selecting the input button. When the private key image is further selected, the second private key image is moved in the same manner.

7 is an overall configuration diagram showing a user authentication system according to an embodiment of the present invention. As illustrated in (a), the GOTP authentication server 130 is connected to the proxy server 120 separately from the web server 140 providing the web service, and is connected to the user terminal 110. The first authentication of the ID and password authentication is performed in the web server 140, GOTP authentication is performed in the GOPT authentication server 130.

In addition, as shown in (b), the GOTP authentication server may be included in the web server 150, if the user terminal 110 completes the first authentication by the web server 150, The GOTP authentication server included in the server 150 may perform GOTP authentication.

In addition, as shown in (c), the GOTP authentication server 130 is connected to the FOD device 160 located before the web server 140, if the GOTP authentication server 130 is not activated, the user terminal ( 110 to be connected to the web server 140.

In each network configuration, the GOTP authentication server 130 may include a database 131. The web server may also include a database.

In addition, the network configuration is the most common configuration, the GOTP authentication server may be included in a separate network according to the network environment.

Although the present invention has been shown and described with reference to the preferred embodiments as described above, it is not limited to the above embodiments and those skilled in the art without departing from the spirit of the present invention. Various changes and modifications will be possible.

Therefore, the present invention transmits the selected array function and the image group to the user terminal separately to arrange the image group including the private key image, the hole image and the background image, so that an illegal intruder attacking the server and the user terminal for authentication. By attempting hooking, phishing and pharming, the array of images selected and stored by the user is not exposed, thereby preventing the illegal exploitation of GOTP.

In addition, when the user inputs the coordinate shift value of GOTP, the user can prevent the exposure of the coordinate shift value by keyboard hooking by clicking the direction button displayed on the user terminal with a mouse.

Claims (12)

In the server operating method for authenticating a user using a graphic OTP, (a) generating a synchronization code stored in the terminal of the user according to a time of request for generating a synchronization code for selecting an arrangement function for the arrangement of the image group stored by the user; (b) transmitting the synchronization code and the image group stored by the user to the user's terminal; (c) calculating a deviation of a first coordinate shift value, which is a coordinate deviation of a shift coordinate for shifting a private key image to the hole image in an image screen arranged using the synchronization code and the image group stored by the user; step; (d) receiving a deviation of a second coordinate shift value transmitted from the user's terminal; And (e) determining whether the user is authenticated by comparing the deviation of the first coordinate shift value and the deviation of the second coordinate shift value User authentication method using a graphic OTP including a. delete The method of claim 1, wherein in step (e) If the user authentication is to be re-executed, step (a) is performed again, step (b) is a user authentication method using a graphic OTP to retransmit the regenerated synchronization code and the image group together. The method of claim 1, wherein in step (e) If the user authentication is re-executed, step (a) is performed again, and step (b) is a user authentication method using a graphic OTP retransmitting the re-generated synchronization code. The method of claim 1, wherein the image group is One or more private key images of the user; One or more hole images for locating the private key image; And One or more background images selected by the user to be arranged with the private key image and the hole image by an array function corresponding to the synchronization code User authentication method using a graphic OTP, characterized in that it comprises a. delete The method of claim 1, The second coordinate movement value is a user authentication method using a graphic OTP, characterized in that for encrypting the coordinate deviation of the movement coordinates input from the user. In the terminal operating method for authenticating a user using a graphic OTP, (a) generating a synchronization code generated from a server according to a time for which the user requests creation to select an image group stored by the user and an array function stored in the terminal of the user for authenticating the user; Receiving; (b) an array function corresponding to the synchronization code is selected and one or more images in the image group are arranged and displayed on the screen according to the array function; (c) receiving at least one private key image displayed on the screen by selecting a direction button displayed on the screen to match the hole image; And (d) generating a second coordinate shift value by using the coordinate deviation of the shift coordinate for shifting the inputted private key image to the hole image and transmitting the second coordinate shift value to the server; User authentication method using a graphic OTP including a. The method of claim 8, wherein the image group is One or more private key images of the user; One or more hole images for locating the private key image; And One or more background images selected by the user to be arranged with the private key image and the hole image by an array function corresponding to the synchronization code User authentication method using a graphic OTP, characterized in that it comprises a. The method of claim 8, The second coordinate movement value is a user authentication method using a graphic OTP, characterized in that for encrypting the coordinate deviation of the movement coordinate. The method of claim 8, And the matching is to move the private key image to the hole image. The method of claim 8, The input of the direction button is a user authentication method using a graphic OTP, characterized in that the mouse input, not the keyboard input connected to the user terminal.

Images