KR101029851B1 - Open ID Authentication method using identity selector - Google Patents

Abstract

The present invention enables the user to perform the open ID access without entering the open ID URL in the log-in window for the authentication of the open ID, thereby simplifying the authentication process of the open ID, risk of phishing, and hacking. It relates to an open ID authentication processing method using an identity selector to reduce. To this end, the present invention is installed in a web browser and a terminal having a plurality of open IDs, and is performed by an identity selector for displaying identity information including a connection path of an authentication system for authenticating each open ID on the terminal, When the browser accesses the Open ID service module of the web site that supports the open ID, transmitting the identity information of the open ID selected by the user to the web site, and returning the web site to the access path of the authentication system through the web browser. Re-direction connection, and when the web site's open ID service module transmits the identity information to the authentication system and requests authentication, the authentication result of the identity information is opened through the web browser. Providing to the service module.

Open ID, Identity Selector, Re-Direction, Identity Information, Web Browser

Description

Open ID Authentication method using identity selector

The present invention relates to an open ID, in particular, to simplify the authentication process of the open ID by allowing the user to perform the open ID access without having to directly enter the open ID URL in the log-in window for authentication of the open ID. The present invention relates to an open identity authentication processing method using an identity selector that reduces the risk of security, phishing, and hacking.

The present invention is derived from the research conducted as part of the technology development project with the Ministry of Information and Communication and the Ministry of Information and Communication Research Promotion. [Task Management No. 2006-S-003-02, Title: Development of self-control enhanced electronic ID wallet system].

Recently, with the opening of the Open ID service in Korea, interest has increased. Open ID is a new type of authentication service that allows you to use a variety of Internet web site services "without signing up" with a single ID. Open ID refers to an open ID that allows a user to be authenticated using an open ID without registering for a specific site.

OpenID is a key separation of service and authentication, providing the ID authentication service common to all Web sites.

On the other hand, the open ID does not require an ID and password for each web site, but instead, enters a sentence in the form of a URL to connect to the authentication system and requires a process of authenticating the open ID through the authentication system. For example, the open ID may have a form such as "hongildong@myid.net", and the user ID and the connection path may be described together.

In other words, the user must enter a longer text than when performing a conventional ID and password login. In addition, the user should connect to the authentication system corresponding to myid.net using his terminal. After accessing the authentication system, the user must process the final authentication process using a password.

In addition, since the open ID accesses the authentication system through a URL-type access path, an arbitrary server for phishing or hacking may be disposed between the user and the authentication system, and there is a risk of intercepting the user's identity information.

Accordingly, an object of the present invention is to easily process authentication using an open ID by performing a process of writing an open ID URL in a login window of a web site for authentication of the open ID when performing authentication using the open ID. The present invention provides an open ID authentication method using an identity selector.

Another object of the present invention is to plant the identity information of the open ID, and the identity selector for managing the connection path of the authentication system in the user's terminal, by using the identity selector to directly perform authentication by the open ID by using external phishing , And reduce the risk of keyboard hacking.

In addition, another object of the present invention is to plant an identity selector in the user's web browser, or to the website to the identity selector to process the authentication for the open ID, the source code of the website required for use of the identity selector Minimize modifications. The existing Open ID protocol is used as it is without modification, and this also corresponds to the authentication system.

According to the present invention, the above object is installed in a web browser and a terminal having a plurality of open IDs, and an identity selector for displaying identification information including access paths of an authentication system for authenticating each open ID on the terminal. When the web browser installed in the terminal is connected to the service module of the web site that supports the open ID, transmitting the identity information of the user ID selected by the user to the web site, the web browser Re-directing a web site to an authentication system for authenticating the open ID; when the open ID service module of the web site transmits the identity information to the authentication system, and requests for authentication thereof, The authentication result for the open ID service through the web browser It is achieved by the steps of: providing a.

Further, according to the present invention, when accessing the service module of the web site that supports the open ID through the web browser, executing the identity selector in response to the request for open ID information of the web site; Requesting authentication by redirecting the selected identity information of the identity information of the plurality of open IDs to the identity selector server of the authentication system through the identity selector; Transmitting the identity information authenticated by the identity selector server to the website.

Therefore, the present invention does not require the terminal to access the open ID authentication system and perform password-based authentication in the login-in interface of the web site for the authentication of the open ID.

The present invention is very easy to open ID authentication because it provides the identity information directly to the open ID authentication system without using the access method of the open ID in the form of URL.

The present invention reduces the risk of phishing and hacking because it does not access the Open ID authentication system using the form of URL sentences.

The present invention minimizes the modification of the internal source code of the web site and authentication system supporting the open ID.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

1 is a view for explaining an open ID authentication processing method (hereinafter, referred to as an open ID authentication processing method) using an identity selector according to an embodiment of the present invention.

In this embodiment, the terminal 100 of the user includes a web browser 110 for accessing the Internet, a client identity selector 120 for securely managing the identity, and the web site 300 uses the client identity selector 120. And an identity selector drive module 330 for driving.

The client identity selector 120 has identity information for authenticating each of the plurality of open IDs held by the user. The identity information includes access URL information of an authentication system for authenticating an open ID, a user ID, a password, and a user's personal information, and can be easily selected by a user by implementing in the form of an icon. The client identity selector 120 may be installed as an add-on to a web browser or may be implemented as a separate application program. The terminal 100 of the user may access the website 300 and log as an open ID. When performing the authentication, the user may present a plurality of selectable open IDs (may be one of them) and provide the open ID selected by the user to the web site 300. Here, the client identity selector 120,

-Display the open ID in the form of an icon to the user, and when the user selects one of the displayed open IDs in the form of an icon, transmit it to the website 300, or

The client ID selector 120 may manage only the open ID by itself, and the web site 300 may drive the client ID selector 120 to display an interface for selecting an open ID on the terminal 100.

In this case, the identity selector driving module 330 requests the terminal 100 to drive the client identity selector 120 when the terminal 100 requests open ID authentication, and the client identity selector 120 responds thereto. A plurality of (or one) open IDs having an icon shape are displayed on the terminal 100. If the client identity selector 120 itself displays an icon for the open ID as the terminal 100 and receives one of the open IDs by the user, the identity selector driving module 330 of the website 300 side may be selected. It is not necessary.

At this time, the open ID identity information provided from the client identity selector 120 to the web site 300 is provided in the identity information storage module 130, and the identity selector driving module 330 of the web site 300 side is the client side, The identification selector 120 provides identification information to the authentication system 200 to determine whether the user is the correct user, and receives the result to finally authenticate the user. In this case, the web site 300 may be integrated into a web browser, or may be re-directed to the open ID authentication system 200 by a client identity selector 120 having a form of a separate application. The web site 300 accesses the open ID service server 210 through the web browser 110 of the terminal 100.

The authentication system 200 authenticates the user by using the identification information transmitted from the web site 300 through the web browser 110. The authentication system 200 includes an open ID service server 210, an identity selector server 220, and an identity management module 230.

The open ID service server 210 authenticates a user by comparing the identity information stored in the identity management module 230 when the website 300 provides the identity information through the web browser 110 of the terminal 100. .

The identity selector server 220 communicates with the client identity selector 120 of the terminal 100 and authenticates the identity information presented by the terminal 100 with reference to the identity information provided in the identity management module 230. . The identity selector server 220 grants the authentication session to the terminal 100 if the authentication for the terminal 100 succeeds.

The identity management module 230 may include identity information and login information input when the terminal 100 joins the authentication system 200, and may also maintain whether the current user has an authentication session.

Web site 300 is composed of an existing module Open ID service module 310, and a service module 320. The open ID service module 310 requests an authentication confirmation of the user to the authentication system 200 side and the open ID service server 210 via the user terminal 100. At this time, the web site 300 verifies the authentication confirmation information received via the web browser 110 of the user 100, and determines whether to provide a web service to the terminal 100 through this. When providing a service to the terminal 100, the web site 300 provides a service requested by the user 100 through the service module 320.

2 is a view for explaining an open ID authentication processing method according to another embodiment of the present invention.

The illustrated embodiment is similar to the open ID authentication processing method described above with reference to FIG. 1, except that the client identity selector 120 of FIG. 1 is coupled to the web browser 110 in the form of a toolbar and thereby the terminal 100. ) Can be driven only when performing the open ID login of the Web site (300).

The identity selector 120 of FIG. 2 is the source of the open ID service module 310 when the web browser 110 accesses the web site 300 and then accesses the open ID service module 310 of the web site 300. The code is analyzed to determine whether the terminal 100 logs in with the open ID. This will be described with reference to Table 1 together.

Table 1 shows an example of the source code of the open ID service module 310 of the website 300. As shown in Table 1,

When the web browser 110 of the terminal 100 accesses the open ID log-in window, the web browser 110 may inquire the source code constituting the open ID service module 310.

In the body of the source code constituting the open ID service module 310, there is a sentence (A) (openid_identifier) referring to the open ID. When the identity selector 120 is coupled to the web browser 110 in the form of a toolbar, the identity selector 120 in the form of a toolbar functions as part of a web browser and can query the source code of the Open ID service module 310. have. The identity selector 120 may determine whether the web browser 110 requires an open ID based authentication through source code inquiry of the open ID service module 310. If the web browser 110 requires open ID based authentication, the identity selector 120 redirects the open ID service module 310 to the authentication system 200. This will be described with reference to FIG. 5 together.

5 conceptually illustrates a process of the web site 300 re-directing to the authentication system 200 through the web browser 110.

The identity selector 120 is coupled to the web browser 110 in the form of a toolbar, requests authentication to the web site 300, and when the web site 300 requests an open ID URL, the identity information to the web site 300. To provide. At this time, the identity information provided to the web site 300 includes a connection path to the authentication system 200, and a re-directing command for the connection path, and the web site 300 is connected to the authentication system by the connection path. (200). Here, the identity selector 120 and the open ID service module 310 transmits the identity information of the terminal 100 to the authentication system 200 through re-direction, and the open ID service module 310 is the terminal 100. Although the final authentication is performed internally with the identity information, no interface screen of any type that the authentication system 200 requires authentication is displayed on the display device (for example, LCD) connected to the terminal 100.

That is, from the user's point of view, the user does not need to input a long open ID having a URL form by simply selecting the icon of the open ID identification information in the form of a mouse, and the authentication system 200 requests the access to the authentication system 200. There is no need to enter the password.

The service module 320 provides a variety of services provided by the web site 300 when a user wants to be authenticated by the open ID service module 310.

Meanwhile, in order to more conveniently use the open ID according to the present invention, the open ID server 210 may process the automatic login using the identity information.

First, Table 2 below shows a typical source code for processing the login of the open ID.

<form action = "https://www.myid.net/login/form" method = "get">
<div id = "openid" class = "LabelDisplay">
<label for = "userid" class = "userid"> Enter open ID </ label>
<input class = "type-text" id = "userid" name = "openid_identifier" type = "text" value = ""/>
<input type = "hidden" name = "returnUrl" value = ""/>
<input type = "image" src = "http://r.myid.net/v1/images/share/btn_login.gif" alt = "login" class = "type-image"/>
</ div>
</ form>

Table 2 shows the source code of the login window, located at the path "https://www.myid.net/login/form" method = "get" ", which lists the typical open IDs served by www.myid.net. Indicates the log in method.

When a user enters an open ID that is of type text and has the form of a URL, as described in "input class =" type-text "id =" userid "name =" openid_identifier "type =" text "value =" " The website (www.myid.net) receives the values you enter and uses them to log in.

On the other hand, if you want to handle automatic login using an open ID, the source code described in Table 3 below may be added.

<script language = "javascript">
function autoSubmit ()
{
Document.xxx.submit ();
return;
}

</ script>

</ head>

<body onLoad = "autoSubmit ();">

<form name = xxxx action = "https://www.myid.net/login/form" method = "get">

<div id = "openid" class = "LabelDisplay">
<label for = "userid" class = "userid"> Enter open ID </ label>
<input class = "type-text" id = "userid" name = "openid_identifier" type = "text" value = "http://abc.com"/>
<input type = "hidden" name = "returnUrl" value = ""/>
<input type = "image" src = "http://r.myid.net/v1/images/share/btn_login.gif" alt = "login" class = "type-image"/>
</ div>
</ form>

The underlined source code in Table 3 is provided by the applicant for automatic log-in, and shows an example in which the source code shown in Table 2 is modified. The source code of Table 3 uses the autosubmit () function of JavaScript to access the form statement and processes the commands included in the form statement.

Figure 3 shows an example of the interface provided by the identity selector to the user in the open ID authentication system according to the present invention.

The illustrated interface uses the terminal 100 to access a web site, and then, when the user wants to process authentication with an open ID in the web site 300, the interface 41 displayed on the display device of the terminal 100 is displayed. Indicates.

In the drawing, reference numeral 42 denotes an existing open ID input window.

In the figure, reference numeral 43 denotes a button for performing log-in.

In the drawing, reference numeral 30 denotes an open ID selection window for selecting an open ID displayed on the terminal 100 in the form of an icon by the identity selector 120. Each of the open IDs 31, 33, 34, and 35 is formed in the form of an icon, and when the user selects an input device such as a mouse, a detailed description 32 of the selected icon is displayed. The detailed description 32 includes identity information (user name, site name, ID, and card name) for the open ID, and may further include other additional descriptions.

The user only needs to select one of the open IDs displayed in the form of an icon in the selection window 30, and the identity selector 120 displays the selected open IDs 31, 33, 34, and 35 on the website 300. Open ID service module 310 is provided to the side, the open ID service module 310 is connected to the authentication system 200 through the web browser 110, the terminal 100 performs authentication.

The illustrated interface is displayed on the terminal 100 by the identity selector drive module 330 provided on the website 300 in the case of the embodiment of FIG. 1, and the toolbar on the web browser 110 in the embodiment of FIG. 2. It is indicated by the identity selector 120 coupled in form.

4 is a flowchart illustrating an open ID authentication processing method according to the present invention.

In the drawings, reference numerals 100, 200, and 300 added to the flowchart correspond to a terminal, an authentication system, and a web site, respectively.

First, when the terminal 100 requests a service to the web site 300, the web site 300 requests the open ID URL to the terminal 100. When the website 300 requests an open ID URL,

1) The terminal 100 selector 120 determines whether the web site 300 requests authentication based on the open ID through source code analysis of the web site 300, and the determination result according to the open ID. In the case of requesting authentication, the identification information storage module 130 calls the identification information of the open ID or displays it.

2) The identity selector driving module 330 on the web site 300 may drive the identity selector 120 on the terminal 100 to call and display the interface of FIG. 3.

Web site 300 requests the open ID URL to verify the user's identity.

The terminal 100 drives the identity selector in response to the request. At this time, the identity selector 120,

3) the terminal 100 selector 120 determines that the web site 300 requests authentication according to the open ID through source code analysis of the web site 300, and in the identity information storage module 130 Call the identification information of the open ID to display or

4) The identity selector driving module 330 on the website 300 may drive the identity selector 120 on the terminal 100 to call and display an interface of the type shown in FIG. 3.

Next, the terminal 100 displays the identity information of the open ID by driving the identity selector 120 by one of the methods 1) and 2). When the user selects one of the identification information of the displayed open ID and transmits the identification information selected by the user to the authentication system 300, the terminal 100 receives an authentication result (authentication response) from the authentication system 200.

The identity selector 120 transmits an authentication request message to the authentication system 200 corresponding to the open ID selected by the terminal 100.

The identity selector server 220 processes the authentication of the identity information in response to the authentication request message. The identity selector server 220 compares the identity information of the user stored in the identity management module 230 with the identity information transmitted by the web site 300 and returns a result of authentication verification. The authentication system 200 stores whether the user is authenticated in the identity management module 230 so that the user can reuse the service later. The user also allows the identity management module 130 to manage the authentication check result received from the authentication system 200 through the identity selector 120 so that it can be reused later when accessing the authentication system 200.

The identity selector 120 delivers the open ID URL to the web site 300. The open ID URL may be included in the authentication response information of the authentication system 200 or may be directly provided to the web site 300 by the identity selector 120.

The web site 300 moves the web browser 110 of the terminal 100 to the authentication system 200 using the identity selector 120 or the open ID URL included in the authentication response information, and the authentication system 200. Request authentication information about the identity information.

The authentication system 200 determines whether to issue the authentication information for the open ID in comparison with the authentication confirmation information managed by the identity management module 230. The authentication system 200 provides the open ID authentication information to the website 300 via the web browser 110 on the terminal 100 side, and the website 300 verifies this and then provides the service to the user 100. to provide.

1 is a view for explaining an open ID authentication processing method using an identity selector according to an embodiment of the present invention,

2 is a view for explaining an open ID authentication processing method according to another embodiment of the present invention;

3 is a view showing an example of an interface provided by the identity selector to the user in the open ID authentication system according to the present invention;

4 is a flowchart illustrating an open ID authentication processing method according to the present invention, and

5 conceptually illustrates an example of how a web site redirects to an authentication system via a web browser.

Claims (10)

A terminal having a web browser and a plurality of open IDs, and having an identity selector for displaying identity information including a connection path of an authentication system for authenticating each open ID, Executing the identity selector in response to a request for the open ID information of the web site when accessing the service module of the web site supporting the open ID through the web browser; Requesting authentication by redirecting the selected identity information of the identity information of the plurality of open IDs to the identity selector server of the authentication system through the identity selector;  Transmitting the identification information authenticated by the identification selector server to the website; Directing, by the web browser, the web site to an OpenID authentication server of an authentication system for authenticating the open ID; When the open ID service module of the web site transmits the identity information to the open ID authentication server of the authentication system, the authentication result of the identity selector server for the identity information is determined by the open ID through the web browser. Providing a service module; And Open ID authentication method using an identity selector comprising the step of providing the service of the website through the web browser. The method of claim 1, When the identity selector is executed, an icon for the plurality of open IDs is displayed, identity information corresponding to the selected icon is displayed on the terminal, and the authentication information is transmitted to the identity selector server to request authentication. Open ID authentication processing method using an identity selector. The method of claim 1, Determining whether the open ID service module is an open ID service module for the open ID by analyzing a source code of the open ID service module when the web browser accesses the open ID service module of the web site; More, If the open ID service module is an open ID service module for the open ID, an open ID service module using an identity selector, wherein an icon and an open ID service module for the icon are displayed on the terminal. The method of claim 3, And the terminal executes the identity selector only when the web browser accesses the open id open id service module of the web site through source code analysis of the web site. The method of claim 1, The identity selector, Open ID authentication method using an identity selector, characterized in that implemented in the form of a toolbar in the web browser. The method of claim 1, The identity selector, Installed in the terminal, Open ID authentication method using an identity selector, characterized in that implemented in the form of an independent application program. The method of claim 1, The website is When the identity information of the open ID is transmitted from the identity selector, the user's ID and password included in the identity information on behalf of the user automatically enters into a log-in window to perform a log-in Open ID authentication processing method using an identity selector. delete delete delete

Images