KR101190057B1 - System for user authentication using trust third party and method thereof - Google Patents

Abstract

The present invention provides a method for performing user registration with a service provider server using a portable terminal in a public terminal, the method comprising: receiving a user identity from a service provider server; Transmitting the user identity to the service provider server according to a request from the service provider server; Receiving and storing authentication information necessary for the user to perform user authentication from the service provider server from the service provider server; And transmitting the authentication information to the identity provider server. According to the present invention, since the personal information of the user to be provided to receive the Internet service is provided to the service provider through the portable terminal or the identity server, the personal information of many users can be conveniently managed and used safely.

Description

System for user authentication using identity provider server and method thereof {System for user authentication using trust third party and method

The present invention relates to a user authentication system and method using a portable terminal, and more particularly, to a system and method for performing user registration and authentication using an identity provider server and a portable terminal.

The present invention is derived from the research conducted as part of the IT new growth engine core technology development project of the Ministry of Knowledge Economy and the Ministry of Information and Telecommunication Research and Development. Wallet system development].

Currently, users use the Internet service through various Internet access tools. The use of the Internet using a portable terminal (eg, a mobile phone, a PDA, a WiBro terminal, etc.) as well as a personal computer of a user's home or company is exploding.

However, in order to receive a service provided by a service provider, a user may not only remember a site to which he subscribes, but also have to remember a user ID and password registered at the time of registration. This problem causes users to use the same ID and password for multiple sites. Using the same user ID and password just because it's easy to remember provides an excuse for easily stealing your personal information online. For example, if personal information is leaked from a specific site, the leaked personal information may be used on other sites, which may result in serious and unexpected damage to the user.

On the other hand, in the case of a public terminal (eg, an Internet cafe or a public computer in a public place), it is often used when high computing power and high resolution display are required in a public place. However, there are many security vulnerabilities in such public places, so when you use a public terminal to receive Internet services provided by a service provider, you can use phishing or There is a lot of room where the user's personal information can be leaked due to hacking.

In order to compensate for this disadvantage, a web browser automatically inputs a previously entered password, or when a user uses a public terminal, the user authenticates the user with an authentication code delivered by passing a temporary authentication code to the mobile terminal. How to do is presented. However, in the case of the method described above, it was difficult to fundamentally solve the above-described problems.

Another method is to store authentication information (eg, URL and password of a server) on a physical security medium such as a smart card to enable server access from various personal terminals, which requires additional hardware devices. In addition to the problem, the problem that the corresponding authentication information is exposed in the common terminal may occur in the same way.

Meanwhile, as the performance of 'Full Browsing', a service that allows users to view documents and videos in the same form as general Internet services, has been rapidly growing, the wireless Internet market using portable terminals has grown rapidly. have. However, conventional users had to perform user registration and authentication in a complicated manner in order to receive Internet service through a portable terminal. Accordingly, in order to activate and generalize a wireless Internet service using a portable terminal, there is a need for a method of performing user registration and authentication through a user-friendly interface using a portable terminal.

The present invention is designed to solve the above problems,

When performing user registration and authentication in order to receive Internet service from a public terminal, the user can be safely used without exposing the user's personal information through a trusted data transmission protocol between a trusted third party and a service provider using the portable terminal. It is an object of the present invention to provide a method and system for performing registration and authentication.

In addition, in the present invention, when performing user registration and authentication to use the Internet service provided by the service provider, the user registration and authentication can be performed by a simpler procedure than the existing user registration and authentication method in consideration of user convenience. It is an object of the present invention to provide a method and a system for providing the system.

In addition, an object of the present invention is to securely provide a user's personal information to a service provider anytime, anywhere using a trusted third party and a portable terminal.

According to an aspect of the present invention, there is provided a method of registering a user in a service provider server using a portable terminal in a public terminal, the method comprising: receiving a user identity from the service provider server; Transmitting a user identity to the service provider server in response to a request from the service provider server; Receiving and storing authentication information necessary for a user to perform user authentication on the service provider server from the service provider server; And transmitting the authentication information to an identity provider server.

And displaying the user identity details transmitted to the service provider server to the user.

The transmitting of the user identity to the service provider server may include displaying the user identity history requested by the service provider server to the user, receiving a user selection according to the request, and transmitting the selected user identity to the service provider server. It features.

The user identity transmitted to the service provider server may be any one of personal information directly written by a user, personal information issued from a trust authority, and false personal information.

According to an aspect of the present invention, there is provided a method of registering a user by a service provider server, the method comprising: receiving, by the service provider server, identification information of a portable terminal of a user from a common terminal; Requesting a user identity from a portable terminal having the identification information; Receiving a user identity from the portable terminal; And processing user registration, and transmitting authentication information necessary for the user to perform user authentication to the portable terminal.

The user identity received from the portable terminal may be any one of personal information directly created by a user, personal information issued from a trust authority, and false personal information.

The processing of the user registration may include verifying an identity of a user input from the portable terminal.

And receiving, storing and managing identification information of the portable terminal from the common terminal.

According to an aspect of the present invention, there is provided a method of registering a user by a service provider server, the method comprising: receiving, by the service provider server, identification information and user identification information of an identity provider server from a public terminal; Requesting an identity of a user having the user identification information to an identity provider server having the identification information; Receiving an identity of a user having the user identification information from the identity provider server; And processing the user registration, and transmitting the authentication information necessary for the user to perform the user authentication to the identity provider server.

Before receiving the identification information and the user identification information of the identity provider server from the public terminal, further comprising the step of requesting a user identity to the public terminal in response to a user registration request from the public terminal.

The processing of the user registration may include verifying an identity of a user received from the identity provider server.

According to an aspect of the present invention, there is provided a method of authenticating a user by a service provider server, the method comprising: receiving, by the service provider server, identification information and user identification information of an identity provider server from a public terminal; Requesting, by the identity provider server having the identification information, authentication information necessary for a user having the user identification information to perform user authentication; Receiving the authentication information from the identity provider server; And verifying the authentication information and processing user authentication.

The authentication information may be authentication information issued to the identity provider server by the service provider server when the user registers the user in the service provider server.

A method of providing a user identity according to the present invention is a method of providing a user identity registered in an identity provider server to a service provider server using a portable terminal, wherein the portable terminal requests the service provider server from the identity provider server. Receiving a user identity history; Displaying a user identity history requested by the service provider server; And receiving a user selection and processing the user identity registered in the identity provider server to be provided to the service provider server.

And receiving a report of the user identity usage history from the identity provider server.

A portable terminal according to the present invention is a portable terminal of a user authentication system using an identity provider server, comprising: an identity storage unit for storing an identity of a user; An authentication unit for transmitting the user's identity to the service provider server according to a request from a service provider server; A communication unit configured to receive authentication information necessary for performing user authentication from the service provider server and to transmit the authentication information to an identity provider server; An authentication information storage unit for storing the authentication information.

The identity storage unit is characterized in that for storing one or more of personal information directly created by the user, personal information issued from a trust authority, and false personal information.

The present invention has the following effects.

By using a portable terminal, a user can perform user registration and authentication without exposing the user's personal information through a trusted data transmission protocol between a third party and a service provider, thereby making it simpler than a conventional user registration and authentication method. The procedure enables secure user registration and authentication regardless of location and device. In addition, since the personal information of the user to be provided to receive the Internet service is provided to the service provider through a portable terminal or an identity server, there is an advantage that it is convenient to manage the personal information of many users and use it safely.

In addition, since the user can monitor the details of the personal information provided to the service provider in real time, the user's personal information can be prevented from being indiscriminately provided to the service provider.

In addition, since the personal information of the users provided to the plurality of service providers can be collectively changed by using the identity server or the portable terminal, it is not necessary to individually change the personal information of the users provided to the plurality of service providers.

In addition, by using a trusted third party and the portable terminal can provide the user's identity to the service provider anytime, anywhere safely, and can control and manage the user's identity is provided to the service provider server anytime, anywhere. Therefore, in the case of an unreliable service provider or a service provider who does not need to provide the user's identity permanently, the user's identity is securely managed by not providing the user's identity, providing a temporary user identity, or providing a fake identity. It is possible to.

The present invention will now be described in detail with reference to the accompanying drawings. Hereinafter, a repeated description, a known function that may obscure the gist of the present invention, and a detailed description of the configuration will be omitted. Embodiments of the present invention are provided to more fully describe the present invention to those skilled in the art. Accordingly, the shapes and sizes of the elements in the drawings and the like can be exaggerated for clarity.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a view for explaining the configuration of a user authentication system using a portable terminal according to an embodiment of the present invention, Figure 2 is a view for explaining the configuration of the portable terminal 100 of FIG. 3 is a view for explaining the configuration of the identity provider server 400 of FIG.

The user authentication system using the portable terminal of the present invention includes a portable terminal 100, a service provider server 200, a shared terminal 300, and an identity provider server 400.

The portable terminal 100 is a portable personal Internet access tool that can be carried by the user at any time and place without restriction, and can safely store personal information. For example, the portable terminal 100 may be a personal terminal capable of real time data communication such as a personal mobile phone, a PDA, a Wibro phone, or the like. The portable terminal 100 is connected to the service provider server 200 and the identity provider server 400 through a network, so that the user can perform user registration and authentication with the service provider server 200 in the common terminal 300. Support.

More specifically, the portable terminal 100 according to the present invention performs user authentication to the communication unit 110 and the service provider server 200 for communicating with the service provider server 200 and the identity provider server 400 via a network. Authentication unit 120 to perform, the interaction unit 130 for the user to input a command and check the screen, the terminal control unit 140 for controlling the portable terminal 100, and necessary to implement the present invention The storage unit 150 stores basic applications, data, and information necessary for user registration and authentication. In addition, the storage unit 150 stores the authentication information storage unit 152 and service provider server for storing authentication information ('site card') including login information necessary for performing user authentication in the service provider server 200 ( An identity storage unit 154 for storing an identity of a user required to perform user registration is provided at 200. Here, the identity is information representing characteristics owned by an individual, such as company address, home address, telephone number, user information issued or registered by an institution such as a government or a company such as family, education, hobby, religion, etc. (Unique) means personal information that can be distinguished. In this case, the user's identity stored in the identity storage unit 154 may be personal information directly written by the user, personal information issued from a trust authority, and false personal information. On the other hand, the authentication unit 120 of the portable terminal 100 performs user authentication to the service provider server 200 using the digital identity wallet (Digital Identity Wallet). The electronic ID wallet is called by the web application of the portable terminal 100. Here, the electronic ID wallet is a user's identity management tool, which is a logical wallet that creates, stores, and manages the user's identity as a logical template.

The service provider server 200 is a device of a service provider that provides an Internet service to a user using an internet access tool such as a mobile terminal, a desktop, or a laptop. For example, the service provider server 200 may be an internet portal service server, a game service server, a shopping service server, a game service server, a bank service server, or the like. The service provider server 200 supports a user to perform user registration and authentication on the common terminal 300 through the portable terminal 100 and the identity provider server 400. In addition, the service provider server 200 receives user information of the corresponding user from the portable terminal 100 to process user registration, and authentication information (hereinafter, 'site') for performing user authentication on the service provider server 200. Create a card ') and transmit it to the portable terminal 100.

In addition, the service provider server 200 receives a site card transmitted from the identity provider server 400 and verifies this to authenticate the user. In addition, the service provider server 200 provides an Internet service only for the verified user.

The common terminal 300 refers to a public internet access tool such as a desktop or a laptop provided in an internet cafe or a public place accessible to various people.

The identity provider server 400 is connected to the mobile terminal 100 and the service provider server 200 through a network, so that the user can perform user registration and authentication with the service provider server 200 from the public terminal 300. Support. The identity provider server 400 is a server that manages the user's personal information and site cards at the request of the user. The site card provided to the server 200 or required for user authentication is provided to the service provider server 200.

More specifically, the identity provider server 400 is a communication unit 405 for communicating with the mobile terminal 100 and the service provider server 200 via a network, a site issued from the user's identity and the service provider server 200. Authentication management unit 410 for managing and updating the card, control unit 420 for controlling the identity provider server 400, usage history report unit 430 for reporting the site card usage history to the portable terminal 100, service provider server An authentication DB 440 is provided at 200 to store information necessary for user registration and authentication. In addition, the authentication DB 440 may include an identity DB 442 storing an identity of a user required to register a user with the service provider server 200, and authentication information required to perform user authentication with the service provider server 200. Authentication information DB 445 for storing the " site card " On the other hand, the user's identity stored in the identity DB 442 may be personal information that the user directly created, personal information issued from a trust authority, and false personal information. In addition, the identity provider server 400 may use a messenger program as a preferred example of the authentication manager 410. In general, the messenger service can be used in both the mobile terminal 100 and the common terminal 300, and can maintain the same user environment anytime, anywhere by sending personal information to the messenger at the time of messenger login. In addition, since personal information is basically stored in a messenger server, it is also suitable for serving as an identity management program (IDP). In addition, the messenger has the advantage of real-time notification of the Internet service history used by the user. Moreover, it is a popular program that many users have used, and it is a client program that can be used by users. Accordingly, by implementing the present invention, the function of the authentication management unit 410 may be implemented by using a plug-in type or some function of the messenger in the messenger. In addition, it can be applied to all other client programs and can be implemented independently.

4 is a view for explaining in detail the process of performing a user registration in a public terminal using a portable terminal in the user authentication system according to the present invention.

More specifically, the user is anxious to input his or her identity (Identity) in order to receive the Internet service by using the common terminal 300, so that the user to the service provider server 200 using the portable terminal 100 It will be described the process of providing the identity of, and issuing authentication information (hereinafter, 'site card') to the portable terminal (100). Here, the site card includes login information for the user to perform user authentication on the service provider server 200, and the service provider server 200 authenticates the user through the site card, and only the authenticated user can access the Internet service. To provide.

The common terminal 300 requests a user registration from the service provider server 200 according to a request from the user (S21).

Next, when the service provider server 200 receives a user registration request from the common terminal 300, the service provider server 200 requests the identity of the user required for user registration from the common terminal 300 (S23). . Accordingly, the common terminal 300 receives identification information (eg, a phone number) of the portable terminal 100 that can provide an identity of the user instead of a request from the service provider server 200 from the service provider server ( 200) (S25). The service provider server 200 receives and registers the identification information of the portable terminal 100 transmitted from the common terminal 300 and requests the identity of the user from the portable terminal 100 having the identification information (S26). . Accordingly, the portable terminal 100 processes the identity to be shared with the service provider server 200 requesting the identity of the user so that user registration can be made (S28). In this case, the portable terminal 100 preferably displays the identity information requested by the service provider server 200 to the user, receives the user selection accordingly, and provides the selected user identity to the service provider server 200. . In this case, the user's identity provided to the service provider server 200, that is, the user's selected identity may be any one of personal information created by the user, personal information issued by a trust authority, and false personal information. Meanwhile, various methods may be applied to a method in which the mobile terminal 100 provides a user's identity to the service provider server 200 to perform user registration, but in the present invention, a service using an electronic ID wallet is provided. User authentication is performed on the provider server 200.

Next, the service provider server 200 verifies the user's identity received from the mobile terminal 100, approves the user registration when a predetermined condition is satisfied, and the user performs user authentication on the service provider server 200. Generate a site card (including login information) that can be transmitted to the portable terminal 100 (S30). In addition, the service provider server 200 reports that the user is normally registered to the common terminal 300 after performing step S30 (S32).

On the other hand, the portable terminal 100 receives and stores the site card received from the service provider server 200 in step S30 and manages it. In addition, the mobile terminal 100 transmits the site card received from the service provider server 200 to the identity provider server 400 so that the identity provider server 400 can update the site card list managed by the mobile terminal 100. (S34). In this case, the portable terminal 100 transmits identification information that can uniquely identify the user to the identity provider server 400 together with the site card, so that the identity provider server 400 manages the site card for each user. . Therefore, when a user needs authentication information to perform user authentication on the service provider server 200, the user can receive the authentication information not only in the portable terminal 100 but also in the identity provider server 400. do. According to this, when the user does not communicate properly with one side (eg, the portable terminal 100), the user authentication is performed to the service provider server 200 from the other side (eg, the identity provider server 400). Authentication information may be provided. Therefore, the user authentication to the service provider server 200 can be performed more reliably.

Next, the identity provider server 400 updates the site card list of the corresponding user by using the site card received from the portable terminal 100, and transmits the updated site card list to the common terminal 300 (S36). . The common terminal 300 receives the updated site card list from the identity provider server 400 and displays the updated site card list to the user through the display unit of the common terminal 300. Accordingly, the user may check the site card list displayed through the display unit of the common terminal 300, select a site card of the corresponding service provider server 200, and perform user authentication on the service provider server 200.

According to the above configuration, the user can perform user registration and authentication without exposing the user's personal information through a trusted data transmission protocol between the identity provider server and the service provider server using the portable terminal in the public terminal do. Therefore, the user can perform the user registration and authentication safely regardless of the location and device in a simpler procedure than the existing user registration and authentication method. In addition, since the personal information of the user to be provided to receive the Internet service is provided to the service provider through the portable terminal, there is an advantage that the user's personal information can be conveniently managed and used safely.

On the other hand, it has been described that step S21 and step S25 are performed separately in the above process, but is not limited thereto. When the common terminal 300 requests a user registration to the service provider server 200 in step S21, the identification information of the portable terminal 100 that can provide the user's identity instead is transmitted to the service provider server 200 together. Can also give

5 is a view for explaining in detail the process of performing a user registration in the public terminal using the identity provider server in the user authentication system according to the present invention.

More specifically, the user is anxious to input his or her identity to receive the Internet service using the public terminal 300, the identity provider to the service provider server 200 using the identity provider server 400 It will be described, and the process of receiving a site card from the service provider server 200 will be described.

The common terminal 300 requests a user registration from the service provider server 200 according to a request from the user (S50). The service provider server 200 receives a user registration request from the common terminal 300, and requests the public terminal 300 for an identity of a user required for user registration (S52). The common terminal 300 may provide identification information (eg, an IP address) and user identification information (eg, a messenger address) of the identity provider server 400, which may provide an identity of a user instead according to a request from the service provider server 200. Mobile phone number, etc.) is received from the user and transmitted to the service provider server 200 (S53). The service provider server 200 receives the identification information and the user identification information of the identity provider server 400 from the common terminal 300, and requests the identity of the user from the identity provider server 400 on the basis (S55).

In step S55, the identity provider server 400, which has received the user's identity from the service provider server 200, provides the user terminal's identity list to the common terminal 300 (S57). The common terminal 300 displays the user's identity list to the user through the display unit, and receives the user's selection accordingly (S59). The identity list of the user includes various types of user identities, and the user can select one of them. For example, various kinds of identities may include personal information written by a user, personal information issued by a trusting institution, and false personal information.

Next, the identity provider server 400 receives a user selection through the common terminal 300 and provides the selected user's identity to the service provider server 200 (S61). The service provider server 200 verifies the identity of the user input from the identity provider server 100, approves the user registration when a predetermined condition is satisfied, and the user performs user authentication on the service provider server 200. It generates a site card (including login information) that can be transmitted to the identity provider server 400 (S63). Next, the service provider server 200 reports that the user registration is completed to the common terminal 300.

The identity provider server 400 transmits the information on the user identity usage history and the site card update history to the portable terminal 100 (S67). The portable terminal 100 receives it and displays it to the user through the display unit. Accordingly, the user can easily grasp when and where his identity is used through his portable terminal 100, and it becomes possible to safely manage his identity. In addition, it is easy to identify the information on the service provider registered by the site card update information, that is, the accessible Internet service provider.

In addition, the site card received from the service provider server 200 is also transmitted to the user's portable terminal 100, so that the portable terminal 100 can update the site card list that it manages. Therefore, when a user needs authentication information to perform user authentication on the service provider server 200, the user can receive authentication information not only in the identity provider server 400 but also in the portable terminal 100. do. According to this, when the user does not communicate properly with one side (eg, the portable terminal 100), the user authentication is performed to the service provider server 200 from the other side (eg, the identity provider server 400). Authentication information may be provided. Therefore, the user authentication to the service provider server 200 can be performed more reliably.

According to the above configuration, the user can perform user registration and authentication without exposing the user's personal information through a trusted data transmission protocol between the identity provider server and the service provider server, which is a trusted third party in the public terminal. do. Therefore, the user can perform the user registration and authentication safely regardless of the location and device in a simpler procedure than the existing user registration and authentication method. In addition, since the user's personal information to be provided in order to receive the Internet service is provided to the service provider server through the identity provider server, the user can update the personal information by simply changing his or her identity in the identity provider server. It can be provided to the server 200, there is an advantage that can conveniently and securely manage the user's personal information.

Meanwhile, as described above with reference to FIG. 4, it has been described that step S50 and step S53 are performed separately in FIG. 5, but are not limited thereto. When the common terminal 300 requests a user registration to the service provider server 200 in step S50, the identification information of the identity provider server 400 and the identification information of the user, which can provide the user's identity on behalf of the service provider server ( 200).

6 is a view for explaining a user authentication method according to an embodiment of the present invention.

More specifically, the process of the user performing the user authentication to the service provider server 200 using the identity provider server 400 that stores the site card issued from the service provider server 200 in the common terminal 300 Will be described.

First, the common terminal 300 requests a site card list from the identity provider server 400 (S80). The identity provider server 400 transmits the site card list corresponding to the user to the common terminal 300 according to the site card list request from the common terminal 300 (S82). The common terminal 300 displays the site card list received from the identity provider server 400 to the user through the display unit, and receives the user's selection accordingly. Here, the site card list displayed to the user includes user identification information (for example, messenger address, mobile phone number, etc.) for identifying the user, and identification information (for example, IP address) for identifying the identity provider server 400. Is stored. In addition, only the identification information for identifying the Internet service provider is displayed on the site card list, and the identity card server 400 stores and manages the site card issued from the actual service provider server.

Next, the common terminal 300 receives a site card from the user and requests a user authentication from the service provider server 200 (S83). In this case, when the user selects a site card from the common terminal 100 and requests user authentication from the service provider server 200, the user identification information included in the site card list and the identification information of the identity provider server 400 are service providers. Is sent to the server 200.

The service provider server 200 accesses the identity provider server 400 based on the identification information of the identity provider server 400 received from the common terminal 300 and accesses the identification information of the user received from the common terminal 300. The card transmits and requests a site card for user authentication (S85). Accordingly, the identity provider server 400 transmits the site card to the service provider server 200 according to the request of the service provider server 200 (S87). In addition, the service provider server 200 receives the site card transmitted from the identity provider server 400 and verifies it, and if the verification result is a suitable site card, authenticates the user and provides the Internet service to the user (S89).

On the other hand, the identity provider server 400 reports the site card usage history to the user's portable terminal 100 after performing step S87. That is, the identity provider server 400 reports the details of the site card provided to the service provider server 200 to the user's portable terminal 100. As described above, the user monitors his / her personal information provided to the service provider server 200 in real time, that is, the site card usage history transmitted from the identity provider server 400 through his portable terminal 100. In this way, the personal information of the user can be prevented from being provided indiscriminately or abused, and the personal information of the user can be safely used and managed.

7 is a view for explaining a user authentication method according to another embodiment of the present invention.

First, the user requests user authentication from the common terminal 300 to the service provider server 200 in order to receive the Internet service provided by the service provider (S100). The service provider server 200 receives a user authentication request from the common terminal 300 and requests the common terminal 300 for a site card necessary for user authentication (S102). Next, the common terminal 300 receives identification information of the identity provider server 400 that can provide a site card instead of the user according to a request from the service provider server 200, and transmits the identification information to the service provider server 200. . At this time, the simple identification information for identifying the user is also transmitted to the service provider server 200 like the identification information of the identity provider server 400 (S104).

The service provider server 200 receives the identification information of the identity provider server 400 transmitted from the common terminal 300, and transmits the identification information of the user received in step S104 to the identity provider server 400 having the identification information. Transfer and request a site card (S106). Next, the identity provider server 400 has received a request for a site card for the user authentication from the service provider server 200 in step S106 requests the user terminal to the public terminal 300, the user to the public terminal 300 User authentication is performed to the identity provider server 400 through the user. In this case, various methods of authentication may be applied to a method of performing user authentication on the identity provider server 400 in the common terminal 300 without exposing user's personal information. For example, a user may perform user authentication on the identity provider server 400 using authentication information issued from the identity provider server 400. When the user authentication is completed, the identity provider server 400 transmits the user's site card list to the common terminal 300. Accordingly, the user can check the site card list displayed through the common terminal 300 and select a site card corresponding to the service provider server 200. On the other hand, only the identification information for identifying the Internet service provider is displayed on the site card list transmitted to the common terminal 300 in step S108, the identity card server 400 is the site card issued from the actual service provider server Store and manage The identity provider server 400 receives the site card from the user and transmits the selected site card to the service provider server 200 (S110 and S112). Accordingly, the service provider server 200 receives the site card transmitted from the identity provider server 400 and verifies it, and if the verification result is a suitable site card, authenticates the user and provides the Internet service to the user (S114).

On the other hand, after performing the step S112, the identity provider server 400 reports the site card usage history to the user's portable terminal (100) (S116). That is, the identity provider server 400 reports the details of the site card provided to the service provider server 200 to the user's portable terminal 100. Therefore, since the user can monitor his or her personal information history provided to the service provider server 200 in real time, the user's personal information can be prevented from being indiscriminately provided or abused, and his personal information is safely stored. Use and manage.

In FIG. 7, the steps S100 and S104 are described separately, but are not limited thereto. When the common terminal 300 requests user authentication to the service provider server 200 in step S100, the service provider server 200 provides identification information of the identity provider server 400 that can provide the user's identification information and a site card instead. You can also send

8 is a diagram illustrating a method of providing an identity of a user to a service provider server by an identity provider server in a user authentication system according to the present invention.

First, it is assumed that the user's identity is stored in the identity provider server 400 and the identification information of the identity provider server 400 that can provide his or her identity when registering a user in the service provider server 200 is registered. do.

If the service provider server 200 needs an additional identity for the user, the service provider server 200 transmits the identification information of the user to the pre-registered identity provider server 400 and requests an additional identity for the user (S120). When the identity provider server 400 receives a user identity request from the service provider server 200, the identity provider server 400 transmits the identity details of the user additionally requested by the service provider server 200 to the portable terminal 100. do. The portable terminal 100 displays the identity of the user requested by the service provider server 200 through the display unit, and requests the user to approve the use of the user identity. The user confirms the identity details requested by the provider server 200 through the portable terminal 100 and approves providing his identity to the service provider server 200 (S124).

Next, the identity provider server 400 provides the user identity approved by the user to the service provider server 200, and the service provider server 200 receives the identity of the user transmitted from the identity provider server 400. Update and register. In addition, the identity provider server 400 reports the user identity history, ie, user identity usage history, provided to the service provider server 200 to the portable terminal 100 (S128).

As described above, when the user wants to change the identity of the user registered in the service provider server 200, if the user only changes the identity of the user managed by the identity provider server 400, the user is provided to the identity provider server 400. Since the user's identity is provided with changed information, the user does not have to change his or her identity registered with the service provider. In addition, since the service provider server 200 may change the package by referring to the identity of the user registered in the identity provider server 400 at any time, it may be changed at any time, so that the user is registered with the service provider server. There is no need to modify your personal information. Therefore, the user can conveniently manage his or her personal information provided to the service provider server 200 through the trusted third party (identity provider server) and the portable terminal 100.

In addition, by using a trusted third party and a portable terminal can provide the user's identity to the service provider anytime, anywhere safely, and can control and manage the user's identity is provided to the service provider server safely anytime, anywhere. . Therefore, in the case of a service provider that is difficult to trust or a service provider that does not need to provide the user's identity permanently, it is not safe to manage the user's identity by providing the user's identity, providing a temporary user identity, or providing a fake identity. It is possible.

As described above, according to the present invention, since the user can perform user registration and authentication without exposing the user's personal information through a trusted data transmission protocol between the identity provider server and the service provider server using the portable terminal, Prevents personal information from being exposed due to phishing or hacking while the user enters his or her personal information in the public terminal.

In addition, the user does not have to remember and record the user ID and password in order to use the Internet service. As a result, users can block the pretext of easily stealing personal information online, which is caused by the trouble of using the same user ID and password on multiple sites.

The present invention can be embodied as computer-readable codes on a computer-readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored. Examples of computer-readable recording media may include ROM, RAM, CD-ROM, magnetic tape, floppy disk, and optical data storage. Also included are those implemented in the form of carrier waves (eg, transmission over the Internet). The computer readable recording medium can also be distributed over network coupled systems so that the computer readable code is stored and executed in a distributed fashion.

As described above, an optimal embodiment has been disclosed in the drawings and specification. Although specific terms have been employed herein, they are used for purposes of illustration only and are not intended to limit the scope of the invention as defined in the claims or the claims. Therefore, those skilled in the art will understand that various modifications and equivalent other embodiments are possible from this. Accordingly, the true scope of the present invention should be determined by the technical idea of the appended claims.

1 is a view for explaining the configuration of a user authentication system using a portable terminal according to an embodiment of the present invention.

2 is a view for explaining the configuration of the portable terminal of FIG.

FIG. 3 is a diagram for describing in detail the configuration of the identity provider server of FIG. 1.

4 is a view for explaining in detail the process of performing a user registration in a public terminal using a portable terminal in a user authentication system according to the present invention.

5 is a view for explaining in detail the process of performing a user registration in the public terminal using the identity provider server in the user authentication system according to the present invention.

6 is a view for explaining a user authentication method according to an embodiment of the present invention.

7 is a view for explaining a user authentication method according to another embodiment of the present invention.

8 is a diagram illustrating a method of providing an identity of a user to a service provider server by an identity provider server in a user authentication system according to the present invention.

Claims (17)

delete delete delete delete delete delete delete delete delete delete delete delete delete A method of providing a user identity registered with an identity provider server to a service provider server using a portable terminal, the portable terminal comprising: Receiving the user identity details requested by the service provider server from the identity provider server; Displaying a user identity history requested by the service provider server; And And receiving a user selection and processing the user identity registered in the identity provider server to be provided to the service provider server. The method according to claim 14, And reporting the user identity usage history from the identity provider server. delete delete

Images