KR101814078B1 - Method, device and mobile terminal for providing authentication service of non-repudiation - Google Patents

Abstract

The present invention is a method for providing an authentication service of non-repudiation, an authentication service device, and an authentication application. An authentication method is suggested. When user authentication for an online service is performed, the identification information of a user mobile terminal is additionally included in a signature result according to biometric authentication through the user mobile terminal. It is transmitted to an authentication service server. Based on it, the authentication service server not only verifies the signature result for the biometric authentication, but also verifies the identification and occupancy of the user for the user mobile terminal through association with a communication company server. So, it is possible to facilitate the convenience of biometric authentication and also prevent the repudiation of the user while at the same time.

Description

TECHNICAL FIELD [0001] The present invention relates to a method for providing a non-repudiation authentication service, an authentication service device, and an authentication application,

The present invention relates to a method for providing a non-repudiation authentication service, an authentication service apparatus, and an authentication application, and more particularly, to a method for providing a non- The authentication service server verifies the signature result on biometrics authentication based on the identification information of the terminal and transmits the authentication result to the authentication service server based on the identification information of the terminal. Authentication, and occupancy confirmation, thereby realizing convenient convenience of biometric authentication and at the same time preventing an unauthorized person.

With the development of ICT technology, the use of the Internet has increased dramatically from work to everyday life, and everyday life as well as business has been difficult without the online service using the Internet.

As online services have expanded into a wide range of fields, identification and authentication of users has become an important issue. Especially, in case of using online financial services, user authentication is essential to prevent financial damage of users.

Accordingly, authentication techniques for performing user authentication have been further strengthened. Various authentication techniques using mobile terminals have been proposed to facilitate authentication while enhancing security.

In recent years, in the case of an online financial service, the security is further enhanced through OTP or a security card when digitally signing with a user's authorized certificate. Furthermore, the mobile terminal requests authentication of the user, The ARS or the SMS-based authentication service is additionally applied.

However, in the conventional authentication technology, there is an inconvenience that the authentication process can be performed only when the authentication certificate is always carried. Also, in the case of the authentication technology using the ARS or the SMS method, It is judged whether or not the user has been authenticated. Therefore, when a third party intercepts the third party's authentication process by duplicating or taking over the third party's authentication certificate or the mobile terminal, or through a malicious code or the like, user authentication by a malicious third party is performed A problem arises.

In order to solve the inconvenience and security problems of such authentication technology, authentication methods using biometrics are spreading. The FIDO Alliance is leading an open technology standard for an authentication method using biometrics in online environment .

FIDO proposes a new standard for a new authentication system that allows authentication to be processed through a simple procedure, which can not be replaced by fingerprint recognition, iris recognition, face recognition, etc. instead of ID and password. FIG. 1 shows a UAF (Universal Authentification Framework) authentication scheme.

The UAF authentication method is an authentication (passwordless experience) method in which a password is not input, and the authenticator is implemented in the form of being included in the terminal device. When the terminal recognizes the user's own biometric information such as a fingerprint, Authentication is performed through the authentication information.

Such a biometric authentication method is advantageous in that authentication can be performed more conveniently and easily by removing an electronic signature or a password input through a public certificate during an authentication process. However, since the terminal itself performs authentication as an authenticator, If the third party has registered his or her own biometric information with the biometric information of another user, the third party can not confirm the identity of the third party, There is a problem that the malicious biometric authentication of the user may cause harm to other users.

The problem of such a biometric authentication method is that the application of biometric authentication is rapidly increased in the field of pin-tec technology, so that a third party is not limited to just the level of other users, but has a problem of causing a great economic damage.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problems of the prior art, and it is an object of the present invention to provide a biometric authentication method in which a user is authenticated as an authenticator, In order to solve the problem that there is no countermeasures to prevent the denial of the identity of the applicant,

In addition, when a third party registers his / her biometric information as biometric information of another user, the third party attempts to solve a problem that may cause harm to other users due to malicious biometric authentication of a third party.

According to another aspect of the present invention, there is provided a method of providing a non-repudiation authentication service, the method comprising: receiving an authentication request and an authentication request from an online service server; A signature result reception step of receiving, from the user mobile terminal, the signature result obtained by signing the identification information of the user mobile terminal according to the biometric authentication result for the user with the authentication key; A signature result verification step of the authentication service device verifying the signature result with a previously stored authentication key corresponding to the user; The authentication service apparatus requesting a communication company server to confirm the mobile terminal information including the identification information of the user mobile terminal and the user information according to the verification result; And an authentication result generating step of receiving authentication confirmation and occupancy confirmation of the user of the user mobile terminal based on the mobile terminal information from the communication company server and generating an authentication result based on the user identity verification and occupancy confirmation from the communication company server .

Preferably, the authentication request receiving step generates a challenge value according to an authentication request for the user and transmits the challenge value to the user mobile terminal, and the receiving the signature result includes receiving, from the user mobile terminal, And a signature result obtained by signing the combination information including the challenge value with an authentication key, wherein the signature result verification step verifies the challenge value included in the signature result with the previously held authentication key corresponding to the user have.

Preferably, the signature result reception step receives the signature result and the identification information of the user mobile terminal from the user mobile terminal, and the signature result verification step includes the challenge value and the identification information of the user mobile terminal Generating hash information for the verification information; And extracting the hash-processed join information from the signature result with the previously stored authentication key corresponding to the user, and verifying the hash-processed join information against the hash-processed verification information.

Preferably, the receiving of the authentication request may include transmitting a push message for activating an authentication application to a user mobile terminal corresponding to the user according to an authentication request for the user from the online service server.

Another embodiment of the method for providing a non-repudiation authentication service according to the present invention is a biometrics authentication process in which a user mobile terminal performs a biometrics authentication for a user according to user authentication for online service use, Generating a signature result in which the user mobile terminal signs the identification information of the user mobile terminal with an authentication key according to the biometric authentication result, and transmitting the signature result to the authentication service device; And receiving the authentication result of the user identification and occupancy confirmation of the user of the user mobile terminal through the communication company server from the authentication service device by the user mobile terminal.

Preferably, the biometrics authentication step receives a challenge value for performing user authentication from the authentication service device, and the signature result transmission step transmits the challenge value and the identification information of the user mobile terminal according to the biometrics authentication result And can generate a signature result signed with the authentication key included in the combination information.

Preferably, the biometrics authentication step includes a step in which the authentication application installed in the user mobile terminal requests the authentication device installed in the user mobile terminal to perform the user biometrics authentication, and transmits the biometrics authentication result according to the user biometrics authentication Can be delivered.

Preferably, the step of transmitting the signature result includes: generating authentication information including identification information of the user mobile terminal and the challenge value according to the biometric authentication result, by an authentication application installed in the user mobile terminal; The authentication application requesting an authentication device mounted on the user mobile terminal to sign the binding information; The authentication application hashes the binding information from the authentication device and receives a signature result signed with an authentication key; And transmitting, by the authentication application, the signature result to the authentication service apparatus, wherein the authentication result reception step includes a step in which the authentication application authenticates the user of the user mobile terminal from the authentication service apparatus, The authentication result of the confirmation can be received.

Preferably, the user mobile terminal further includes a step of receiving the activation message of the authentication application according to user authentication for online service use from the authentication service device and activating the authentication application installed in the user mobile terminal can do.

Preferably, the method further includes a step of activating an authentication application installed in the user mobile terminal according to a user authentication execution request for online service use from an online service application installed in the user mobile terminal for online service use.

Here, the identification information of the user mobile terminal may include at least one of a wicket identification number, a phone number of the mobile terminal, or a serial number of the mobile terminal.

Here, the authentication key may include a private key of the user mobile terminal and a public key of the authentication service device in a two-key manner of a private key and a public key.

In addition, the authentication service apparatus according to the present invention transmits a signature result obtained by signing the identification information of the user mobile terminal according to the biometric authentication result for the user from the user mobile terminal with the authentication key, and verifies the signature result using the stored authentication key. And generates and provides an authentication result based on user identification and occupancy confirmation of the user of the user mobile terminal through the communication company server.

Preferably, the authentication service device receives the authentication request and the user information from the online service server, receives the authentication information and the user information from the online service server, and signs the identification information of the user mobile terminal according to the biometric authentication result for the user from the user mobile terminal And a signature verification module for verifying the signature result with the authentication key stored in the authentication server, receiving the signature result, verifying the signature result with the authentication key, and transmitting the authentication result to the user of the user mobile terminal based on the mobile terminal information including the identification information of the user mobile terminal, An authentication service processing unit for generating and providing an authentication result by user identification and occupancy confirmation; And requesting a confirmation of the mobile terminal information to the communication company server in cooperation with the communication company server to which the user mobile terminal is subscribed, and transmitting the result of the user identity confirmation and occupancy confirmation to the user of the user mobile terminal from the communication company server And may include a communication company server linking section.

Preferably, the authentication service processing unit generates a challenge value according to an authentication request for a user from the online service server, and transmits the challenge value to the user mobile terminal. The identification information of the user mobile terminal and the challenge value And transmits the signature result signed with the authentication key to verify the signature result.

Preferably, the authentication service processing unit may transmit a push message for driving the authentication application to the user mobile terminal according to an authentication request for the user from the online service server.

Preferably, the authentication service device registers usage of the user's authentication service according to the authentication service use registration request from the user mobile terminal, receives the authentication key generated for the user's biometric authentication from the user mobile terminal, The authentication service registration unit may further include an authentication service registration unit.

In addition, the authentication application installed in the user mobile terminal according to the present invention may include a signature result obtained by signing the identification information of the user mobile terminal with the authentication key according to the user's biometric authentication result in performing the user authentication for online service use, And receives an authentication result of user identity verification and occupancy confirmation of the user of the user mobile terminal from the authentication service device.

Preferably, the authentication application receives the challenge value according to the authentication performed by the user from the authentication service device, requests the biometric authentication of the user to the authentication device installed in the user mobile terminal, And transmits the signature information to the authentication device. The authentication information includes a challenge value and identification information of the user mobile terminal, and requests signature of the combination information to the authentication device. Device.

Preferably, the authentication application may be configured to automatically perform an automatic authentication process on the user mobile terminal by a user authentication execution request for online service use or a push message from the authentication service device from an online service application installed in the user mobile terminal, Can be driven.

According to the present invention, the user mobile terminal further includes the identification information of the user mobile terminal in addition to the signature result according to the biometric authentication, and transmits the result to the authentication service server. On the basis of this, the authentication service server verifies the signature result for biometric authentication Authentication and occupancy confirmation of the user mobile terminal is performed through linkage with the communication company server, so that it is possible to carry out the authentication that can prevent the non-repudiation while at the same time facilitating the convenience of the biometric authentication.

Further, even when a third party registers his / her biometric information as biometric information of another user, it is possible not only to verify the primary biometric authentication result through biometrics but also to use the user information It is possible to block approval of a malicious biometric authentication of a third party by performing authentication of the identity of the user and occupation authentication of the user to the user mobile terminal.

1 shows a UAF (Universal Authentication Framework) authentication scheme according to the FIDO standard,
FIG. 2 shows a configuration diagram of an embodiment of a non-repudiation authentication service system according to the present invention,
FIG. 3 shows a configuration diagram of an embodiment of an authentication service apparatus of a non-repudiation authentication service system according to the present invention,
4 is a block diagram of an embodiment of a user mobile terminal of a non-repudiation authentication service system according to the present invention,
5 shows a flowchart of an embodiment of a method for providing a non-repudiation authentication service according to the present invention,
6 shows a flowchart of another embodiment of the method for providing a non-repudiation authentication service according to the present invention,
7 is a flowchart illustrating a process of reflecting a signature result combined with identification information of a user mobile terminal to a biometric authentication result in the method of providing a non-repudiation authentication service according to the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other objects, features and advantages of the present invention will become more apparent from the following detailed description of the present invention when taken in conjunction with the accompanying drawings.

First, the terminology used in the present application is used only to describe a specific embodiment, and is not intended to limit the present invention, and the singular expressions may include plural expressions unless the context clearly indicates otherwise. Also, in this application, the terms "comprise", "having", and the like are intended to specify that there are stated features, integers, steps, operations, elements, parts or combinations thereof, But do not preclude the presence or addition of features, numbers, steps, operations, components, parts, or combinations thereof.

In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

In the present invention, in addition to the signature result according to the biometric authentication through the user mobile terminal, the identification information of the user mobile terminal is transmitted to the authentication service server when the user authenticates the online service, Authenticate the biometrics authentication result, and provide an authentication method for authenticating the user of the user mobile terminal and confirming the identity of the user through association with the communication company server.

FIG. 2 shows a configuration diagram of an embodiment of a non-repudiation authentication service system according to the present invention.

The non-repudiation authentication service system according to the present invention may include a user terminal 10, a user mobile terminal 100, an online service server 300, an authentication service device 200, and a communication company server 400 have.

The user terminal 10 is a communication device that is provided with an online service and basically connects to an online service server 300 that provides an online service to provide various online services provided from the online service server 300 to the user . Here, various communication devices such as a PC, a notebook, a tablet, and a smart phone, which are commonly used, can be applied to the user terminal 10.

The user mobile terminal 100 is a communication terminal that performs authentication for a user when authentication is required for the user when the user terminal 10 is provided with an online service, Or a personal communication terminal optimized for performing the non-repudiation authentication service process according to the present invention may be applied.

Preferably, the user mobile terminal 100 may include an authentication application for performing a non-repudiation authentication service process according to the present invention and an authentication device for performing user authentication through biometrics authentication for the user. At this time, the authentication application and the authentication device may be implemented in a separate configuration, or may be implemented in a configuration in which the authentication application is combined with the authentication application.

The authentication application of the user mobile terminal 100 may add the signature information obtained by adding the identification information of the user mobile terminal 100 to the biometric authentication result of the user performed by the authentication device in cooperation with the authentication service device 200 And transmits the verification result to the authentication service device 200. The authentication service device 200 receives the verification result of the signature result and the identity verification result of the user of the user mobile terminal 100 and the occupancy verification result.

In addition, the user mobile terminal 100 may replace the user terminal 10. For example, the user mobile terminal 100 may be provided with a mobile browser to provide an online service provided from the online service server 300 through a mobile browser Or an online service application capable of performing an online service provided from the online service server 300 may be mounted so that the user mobile terminal 100 may perform functions of the user terminal 10. [

The authentication application and authentication device of the user mobile terminal 100 will be described in further detail with reference to the embodiment of the user mobile terminal 100 described below.

The authentication service apparatus 200 receives and verifies the signature result signed by adding the identification information of the user mobile terminal 100 to the user authentication result performed through the biometric authentication in the user mobile terminal 100, Authentication confirmation service for the user of the user mobile terminal 100 through the authentication server 400 by providing the authentication service.

For example, the authentication service apparatus 200 may have a security policy for each authentication service corresponding to a specific online service provided by the online service server 300, and may register and use an authentication service for the user according to the security policy In particular, a signature result including the identification information of the user mobile terminal 100 is received from the user mobile terminal 100 and is verified by the user authentication result through the biometric authentication, And confirms the user identity and occupancy of the user of the user mobile terminal 100 through the communication company server 400 based on the information and the identification information of the user mobile terminal 100. [

That is, whether the user information about the user who wants to use the online service of the online service server 300 and the identification information of the user mobile terminal 100 are checked through the communication company server, It is possible to confirm the identity of the user performing the authentication process and whether the legitimate user occupies the user mobile terminal 100. [

Here, the authentication service apparatus 200 may be implemented as a separate apparatus specialized for implementing the present invention, or may be implemented as a server equipped with a program for providing a non-repudiation authentication service according to the present invention.

The online service server 300 is a device for providing a specific online service to a user, wherein the specific online service provides a financial service such as an online service for providing various information or contents, an online service for providing electronic commerce, or an Internet banking And various services that can be performed online, such as online services.

The communication company server 400 transmits the user information and the identification of the user mobile terminal 100 according to the confirmation request of the user mobile terminal 100 from the authentication service apparatus 200 as a device of the communication company to which the user mobile terminal 100 is subscribed. Information of the user mobile terminal 100 and whether or not the user owns the mobile terminal 100 and provides the result to the authentication service apparatus 200. [

The non-repudiation authentication service system according to the present invention may be used for not only a primary verification of the biometrics authentication result for the user performed by the user mobile terminal 100 but also a biometrics authentication result for the user mobile terminal 100 The identification information of the user mobile terminal 100 is included in the signature result so that the identification information of the user mobile terminal 100 and the user information transmitted from the online service server 300 are combined with each other, Authentication of the user of the user mobile terminal 100 and confirmation of occupation of the user with respect to the user mobile terminal 100 can be performed to prevent the user from being denied the user at the time of application of the biometric authentication method, .

The main configuration of the non-repudiation authentication service system according to the present invention will be described in more detail with reference to the embodiments.

FIG. 3 shows a configuration diagram of an embodiment of an authentication service apparatus of the non-repudiation authentication service system according to the present invention.

The authentication service apparatus 200 receives the signature result including the identification information of the user mobile terminal 100 in addition to the user biometric authentication result performed by the user mobile terminal 100 and receives the signature result from the user mobile terminal 100, The user identification and occupancy confirmation of the user of the user mobile terminal 100 is performed through the communication company server 400 based on the identification information of the mobile terminal 100 and the user information transmitted from the online service server 300, Confirms the identity of the user, confirms the occupation of the user mobile terminal with respect to the identified user, and provides the authentication result.

For this, the authentication service apparatus 200 may include an authentication service registration unit 210, an authentication service processing unit 230, a communication company server interlocking unit 250, and the like.

The authentication service registration unit 210 performs a series of processes for registering the use of the authentication service of the user in cooperation with the authentication application according to the authentication service use registration request from the authentication application installed in the user mobile terminal 100 Creates a user's authentication service registration information, and registers the user's use of the authentication service based on the created authentication service registration information.

Preferably, the authentication service registration unit 210 receives the authentication key generated corresponding to the registration of the user's biometric information in the user mobile terminal 100, and stores the authentication key in association with the biometric authentication of the user.

As an example of registration of a user's use of an authentication service, the authentication service registration unit 210 generates a registration original document including a service code for a specific online service and an authentication method according to the security policy of the authentication service, And transmits the registration signatures signed by the authentication key and the authentication key generated by the authentication of the user in the biometric authentication method according to the security policy received from the authentication application to the authentication application, Can be generated.

Here, the authentication key may be a two-key method of a private key and a public key. The authentication service registration unit 210 may receive the public key from the user mobile terminal 100 and register the public key corresponding to the user's biometric authentication.

The authentication service processing unit 230 verifies the signature result according to the biometrics authentication result of the user in cooperation with the authentication application installed in the user mobile terminal 100 when the authentication request for the user is performed, Based on the identification information and the user information transmitted from the online service server 300, provides an authentication service for confirming the user's identity and the occupancy confirmation of the user mobile terminal 100 through the corresponding communication company server 400. [

As an example, the authentication service processing unit 230 may drive an authentication application installed in the user mobile terminal 100 through a push message or the like. Then, the authentication service processing unit 230 receives the signature result signed by the authentication application and the combination information including the biometric authentication result for the user and the identification information of the user mobile terminal 100, and verifies the signature result. The authentication service processing unit 230 can verify the signature result with the authentication key registered in the authentication service registration unit 210. [

More preferably, the authentication service processing unit 230 generates a challenge value of a random number according to the user authentication request and transmits the challenge value to the authentication application of the user mobile terminal 100, and transmits the challenge value to the user mobile terminal 100 according to the biometric authentication result for the user. The signature value obtained by hashing and combining the combined information combining the challenge value and the wisdom ID number of the user mobile terminal 100 and the wisdom ID number of the user mobile terminal 100 can be received. (230) generates verification information combining the challenge value with the wake-up ID of the user mobile terminal (100) and performs hash processing on the verification information. The authentication information registration unit (210) The verification result of the signature can be verified against the verification information obtained by hash processing.

The authentication service processing unit 230 generates mobile terminal information including the identification information of the user mobile terminal 100 and the user information transmitted from the online service server 300 and transmits the mobile terminal information to the communication company server 400 The mobile terminal 100 requests the confirmation of the user and the occupancy confirmation of the user mobile terminal 100, and judges the user authentication and the occupancy authentication based on the result received from the communication company server 400 accordingly.

The communication company server interworking unit 250 requests the communication server 400 to confirm the identification information of the user mobile terminal 100 from the authentication service processing unit 230 and transmits the identification information of the user mobile terminal 100 and the user information And transmits the result of the identification of the user to the communication company server 400 and the confirmation of the occupancy confirmation of the user mobile terminal 100 and delivers the result to the authentication service processing unit 230. [

Furthermore, the authentication service registration unit 210 and the authentication service processing unit 230 can generate a transaction ID for identifying the corresponding process, process the corresponding process by associating the transaction ID, and generate the transaction ID The result of the process can be effectively processed only when the termination of the process is completed within a predetermined time by operating the timer.

The authentication service apparatus 200 of the non-repudiation authentication service system according to the present invention may be configured such that each configuration is separately configured as an individual device, or a program having a program capable of providing a certification service by performing a series of processes Or may be configured as a server, and the authentication service apparatus 200 can be used not only for verifying the biometrics authentication of the primary user by interworking with the authentication application installed in the user mobile terminal 100, 400 to provide the authentication result of the user's identity verification of the user and the occupancy confirmation of the user mobile terminal 100, thereby providing the authentication service for the user's non-repudiation authentication for the user.

Next, a configuration diagram of an embodiment of a user mobile terminal of the non-repudiation authentication service system according to the present invention shown in FIG. 4 will be described.

The user mobile terminal 100 performs biometrics authentication for the user, generates association information combining the biometrics authentication result with the identification information of the user mobile terminal, and transmits the signature result signed by the association information to the authentication service apparatus 200 , The authentication service apparatus 200 receives the authentication result of the user's identity verification and the occupancy confirmation of the user mobile terminal 100.

To this end, the user mobile terminal 100 may include an authentication application 110, an authentication device 150, and the like. In addition, the user mobile terminal 100 may include various configurations provided as a wireless communication terminal.

The authentication application 110 performs an authentication process for the user when the user uses the online service in cooperation with the authentication service apparatus 200. The authentication application 110 registers the use of the authentication service for the user in the authentication service apparatus 200 in advance, When the user authentication for the online service use of the online service server 300 is required, the identification information of the user mobile terminal 100 is extracted according to the authentication result through the user biometric authentication of the authentication device 150, And transmits the signature result obtained by signing the combined information to the authentication service apparatus 200. Here, the identification information of the user mobile terminal 100 may be a waking identification number mounted on the mobile terminal, and various information capable of identifying the mobile terminal, such as a mobile terminal number and a serial number of the mobile terminal, .

For example, the authentication application 110 requests the authentication service apparatus 200 to start performing the authentication, receives the challenge value of the random number from the authentication service apparatus 200, receives the challenge value and the user The signature information obtained by hashing the combined information combining the wired identification number of the mobile terminal 100 and transmitting the signature information to the authentication service apparatus 200 can be transmitted.

Then, the authentication application 110 receives authentication results from the authentication service apparatus 200 for user identity confirmation and occupancy confirmation of the user mobile terminal 100.

Here, the authentication application 110 may be an individual device configuration mounted or connected to the user mobile terminal 100, or may be configured to operate the basic configurations of the user mobile terminal 100 to perform the processing of the non-repudiation authentication service according to the present invention Or may be a computer program that performs a series of processes.

The authentication device 150 performs authentication of the user with respect to the user. Preferably, the authentication device 150 includes biometrics means capable of recognizing the biometrics information of the user, registers the biometrics information of the user through the biometrics means, Biometric authentication can be performed. Here, the biometric information may include biometric information through various biometric methods such as fingerprint recognition, iris recognition, facial recognition, voice recognition, etc. Accordingly, the user mobile terminal 100 may be provided with a user And a biometric unit for biometric identification of the biometric unit.

Also, the authentication device 150 may be provided with an authentication key management means for managing a signature of the authentication key while generating and storing a user's authentication key. The authentication key management means may include an authentication key corresponding to the user's biometric information And then provide a signature result signed by the authentication key held at the time of the signature request of the authentication application 110 to the authentication application 110. [ Here, the authentication key may be a two-key scheme of a private key and a public key, and a public key generated upon registration of the user's biometric information may be provided to the authentication service apparatus 200 through the authentication application 110 and registered.

Although the authentication application 110 and the authentication device 150 are shown as separate components in the embodiment of FIG. 4, the authentication application 110 and the authentication device 150 may be integrated into one configuration and loaded in the user mobile terminal 100, if necessary.

When the user terminal 100 uses the online service provided by the online service server 300, the user mobile terminal 100 transmits the online service application 300 linked with the online service server 300 to use the corresponding online service, (170) may be additionally mounted.

The online service application 170 may request the authentication application 110 of the user mobile terminal 100 to perform the user authentication process when the online service use of the online service server 300 requires user authentication, The authentication application 110 may perform the authentication process according to a request for execution of the user authentication process from the application 170.

The online service application 170 may be a computer program that performs a series of processes for providing an online service between the user mobile terminal 100 and the online service server 300.

As described above, the user mobile terminal 100 of the present invention performs the biometric authentication of the user through the biometric authentication when the user authentication is required according to the online service utilization, and combines the identification information of the user mobile terminal 100 with the biometric authentication result And transmits the signature result obtained by signing the combined information to the authentication service server 200. The authentication service server 200 confirms the identity of the user and confirms the occupation of the user with respect to the user mobile terminal 200 So that more convenient authentication through biometric authentication can be performed and a non-repudiation service can be provided at the same time.

According to the present invention, the non-repudiation authentication service system according to the present invention can be applied to perform a simpler biometric authentication process while simultaneously performing the user's non-repudiation authentication service. In the present invention, We suggest a method.

A method for providing a non-repudiation authentication service according to the present invention is mainly a verification of a user's biometric authentication performed on a user mobile terminal, a verification of a user identity through a communication company server in an authentication service device, And performing the occupancy confirmation of the user, which will be described with reference to the following embodiments.

As described above, the authentication service apparatus according to the present invention may be implemented as a kind of server. In the following embodiments, the authentication service apparatus will be referred to as an authentication service server when the authentication service apparatus is implemented as a server. A procedure performed by the authentication service server and a procedure performed by the user mobile terminal are distinguished. However, for convenience of description, the procedure performed by the authentication service server and the procedure performed by the user mobile terminal will be described in unison.

FIG. 5 shows a flowchart of an embodiment of a method for providing a non-repudiation authentication service according to the present invention.

The embodiment of FIG. 5 is a case where the user mobile terminal 100 performs a function of using an online service without distinguishing the user mobile terminal 100 from the user terminal, Of the present invention is an embodiment of a method for providing a non-repudiation authentication service according to the present invention.

When the user mobile terminal 100 accesses the online service server 300 and requests the use of the online service (S110), the online service server 300 requests the authentication service server 200 to authenticate the user (S120) do. At this time, the online service server 300 may transmit the user information registered in the online service server 300 to the authentication service server 200, or may additionally transmit the information about the online service.

As the user authentication is requested at the time of using the online service, the authentication application installed on the user mobile terminal 100 is executed (S130), and the authentication application performs a series of authentication processes according to the preset security policy. The user mobile terminal 100 recognizes the biometric information for the user and performs the user authentication through the biometric authentication based on the registered biometric information stored in step S140.

If the biometric authentication of the user is performed through the authentication device installed in the user mobile terminal 100, the authentication application requests the biometric authentication for the user by the authentication device installed in the user mobile terminal 100, The biometric authentication for the user can be performed through the device.

The authentication application extracts identification information from the user mobile terminal 100 (S150) before, after, or simultaneously with the biometric authentication process for the user. Here, the identification information may be various information for identifying a mobile terminal registered in a communication company server, such as a waking heart identification number, a mobile terminal number, and a serial number of the mobile terminal mounted on the mobile terminal. The wired ID number of the user mobile terminal 100 is applied as the identification information.

The authentication application generates binding information by combining the wired identification number of the user mobile terminal with the biometric authentication result according to the biometric authentication result for the user, and signs the binding information by signing the binding information with the stored private key (S160) To the service server 200 (S170). For example, when a challenge value for performing an authentication is transmitted from the authentication service server 200 according to authentication performed by a user, the authentication application combines the challenge value with the wired identification number as a result of biometric authentication, And transmit the signature result to the authentication service server 200.

In this case, when an authentication device for generating and managing an authentication key is provided, the authentication application may transmit the association information to the authentication device and generate a signature result signed with the private key held in the authentication device. Also, the authentication application may transmit the wired identification number extracted by the user mobile terminal 100 when the signature result is transmitted.

The authentication service server 200 verifies the signature result transmitted from the authentication application of the user mobile terminal 100. The authentication service server 200 registers the authentication result with the user mobile terminal 100 The authentication service server 200 can receive and retain the authentication key corresponding to the biometric authentication of the user, and the authentication service server 200 verifies the signature result with the authentication key held in association with the user (S210). For example, when the authentication service server 200 generates and transmits a challenge value to the authentication application according to the authentication performed by the user, the authentication service server 200 extracts a challenge value from the signature result with the authentication key, The verification result of the signature can be verified.

Preferably, the authentication key may be a two-key method of a public key and a private key. In this case, the authentication service server 200 may receive the public key corresponding to the user's biometric authentication and store the public key in advance.

Upon completion of the verification of the signature result, the authentication service server 200 generates mobile terminal information combining the wired identification number of the user mobile terminal 100 and the user information transmitted from the online service server 300, Server 400 to request confirmation of the identity of the user based on the mobile terminal information and the occupation of the user of the user mobile terminal 100 in operation S230.

The communication company server 400 confirms whether the user is correct and the owner of the user mobile terminal is correct based on the registered user information corresponding to the wicket identification number and provides the confirmation result to the authentication service server 200 S250).

The authentication service server 200 generates an authentication result based on the identification of the user and confirmation of occupation of the user with respect to the user mobile terminal 100 based on the confirmation result provided from the communication company server 400 in operation S260, 100 and the online service server 300 (S270, S280).

The online service server 300 provides the corresponding online service to the user mobile terminal 100 according to the authentication result from the authentication service server 200 (S300).

FIG. 6 shows a flowchart of another embodiment of the method for providing the non-repudiation authentication service according to the present invention.

6, when the user terminal 10 and the user mobile terminal 100 are configured as separate devices, when the user terminal 10 receives an online service from the online service server 300, And the authentication for the user is performed through the mobile terminal 100. [

When the user terminal 10 accesses the online service server 300 to request the use of the online service (S410), the online service server 300 requests the authentication service server 200 to authenticate the user (S420) . 5, the online service server 300 can transmit the user information registered in the online service server 300 to the authentication service server 200. In addition, .

The authentication service server 200 pushes the execution of the authentication application to the user mobile terminal 100 corresponding to the user information according to the authentication request for the user from the online service server 300 in operation S430, 100) is executed (S440).

5, the authentication application executes a series of authentication processes according to a predetermined security policy according to the execution of an authentication application installed on the user mobile terminal 100. In the embodiment of FIG. 6, The terminal 100 performs the biometric authentication of the user (S450) and extracts the waking heart identification number according to the result (S460). The signature information obtained by signing the combined information combining the wake identification number with the private key To the authentication service server 200 (S460).

The authentication service server 200 verifies the signature result transmitted from the user mobile terminal 100 using a public key in operation S510 and transmits the wired identification number of the user mobile terminal 100 and the user information received from the online service server 300 (S520) and sends it to the corresponding communication company server 400 to confirm the identity of the user based on the mobile terminal information and confirm the occupation of the user mobile terminal 100 of the confirmed user (S530).

Based on the mobile terminal information received from the authentication service server 200, the communication company server 400 confirms the identity of the user and the occupation of the user mobile terminal and provides the confirmation result to the authentication service server 200 (S550) The authentication service server 200 generates an authentication result for confirming user identity and occupancy of the user mobile terminal 100 based on the confirmation result provided from the communication company server 400 in operation S560, (S250, S580) to the online service server (100) and the online service server (300).

The online service server 300 provides the online service to the user terminal 10 according to the authentication result from the authentication service server 200 (S600).

In the present invention, the user mobile terminal 100 provides the signature result obtained by signing the identification information of the user mobile terminal 100 together with the biometric authentication result to the authentication service server 200, The mobile terminal 100 and the authentication service server 200 may be configured to authenticate the user to the mobile terminal 100 through the corresponding communication company server 400. In this case, The process of reflecting the signature result combined with the identification information of the user mobile terminal in the authentication result will be further described with reference to the flowchart of the embodiment shown in FIG.

When the authentication application 110 of the user mobile terminal 100 is executed (S710) according to the execution of the user authentication process for using the online service, the authentication application 110 accesses the authentication service server 200 and starts user authentication (S720).

In response to the user authentication initiation request from the authentication application 110, the authentication service server 200 generates a random number challenge value for the user authentication (S730) and transmits the challenge value to the authentication application 110 (S740) .

The authentication application 110 receives the challenge value according to the user authentication start, extracts the worm identification number of the user mobile terminal 100 (S750), and generates combining information combining the extracted worm identification number and the challenge value (S760 )do.

The authentication device 150 of the user mobile terminal 100 recognizes the biometric information of the user and performs biometric authentication in operation S810. At this time, the biometric authentication of the authentication device 150 is performed by the authentication application 110 In response to a user authentication start request from the user.

The authentication device 150 transmits the combined information to the authentication device 150 in step S830 in response to the success of the biometric authentication when the biometric authentication of the user succeeds in step S820. And requests a signature.

In response to the signature request from the authentication application 110, the authentication device 150 signs the binding information with the previously stored private key (S840). At this time, the binding information is hashed and then signed with the private key, (S850). Then, the authentication application 110 receiving the signature result transmits the wrist ID number of the user mobile terminal 100 to the authentication service server 200 together with the signature result (S860).

The authentication service server 200 generates verification information combining the wake identification number transmitted from the authentication application 110 and the challenge value generated according to the user authentication start (S910).

In step S920, the authentication service server 200 extracts the hash-processed binding information from the signature result using the public key corresponding to the biometric authentication of the user, After hashing the information, the verification information is compared with the combined information (S930), and the validity of the signature result is verified (S940).

Through the above process, the authentication service server 200 is verified with respect to the biometric authentication result of the user performed in the user mobile terminal 100.

5 and 6, when the verification result is valid, the authentication service server 200 transmits the user information received from the online service server 300 and the mobile terminal 100 including the identification information of the user mobile terminal 100, The terminal information is generated and the confirmation of the terminal information is requested to the communication company server 400 to confirm the user identity through the communication company server 400 and confirm the occupation of the user with respect to the user mobile terminal 100. [

As described above, according to the present invention, the user mobile terminal further includes the identification information of the user mobile terminal in addition to the signature result according to the biometric authentication, and transmits the signature result to the authentication service server. Verification and occupancy confirmation of the user mobile terminal is performed through cooperation with the communication company server as well as verifying the convenience of the biometric authentication and performing the authentication that can prevent the non-repudiation of the user.

The foregoing description is merely illustrative of the technical idea of the present invention, and various changes and modifications may be made by those skilled in the art without departing from the essential characteristics of the present invention. Therefore, the embodiments of the present invention are not intended to limit the scope of the present invention but to limit the scope of the present invention. The scope of protection of the present invention should be construed according to the following claims, and all technical ideas within the scope of equivalents thereof should be construed as being included in the scope of the present invention.

10: user terminal,
100: user mobile terminal,
110: authentication application, 150: authentication device,
170: Online service application,
200: authentication service device,
210: authentication service registration unit, 230: authentication service processing unit,
250: communication company server interlocking part,
300: online service server,
400: carrier server.

Claims (20)

The authentication service apparatus comprising: an authentication request receiving step of receiving an authentication request for the user and user information from the online service server;
Receiving the signature result obtained by signing the unique identification information of the user mobile terminal extracted by the user mobile terminal according to the biometric authentication result for the user from the user mobile terminal with the authentication key;
A signature result verification step of the authentication service device verifying the signature result with a previously stored authentication key corresponding to the user and performing a primary verification based on the biometric authentication for the user;
The authentication service apparatus checks the mobile terminal information including the unique identification information of the user mobile terminal included in the signature result and the user information transmitted from the online service server, A mobile terminal confirmation request step of requesting a mobile terminal; And
Wherein the authentication service device receives a user identity confirmation and an occupancy confirmation of the user of the user mobile terminal based on the mobile terminal information from the communication company server, And generating an authentication result on the basis of the primary verification and the secondary verification. The method according to claim 1,
The authentication request receiving step includes:
Generates a challenge value according to an authentication request for the user, and transmits the generated challenge value to the user mobile terminal,
The signature result receiving step includes:
Receiving a signature result obtained by signing unique identification information of the user mobile terminal and combining information including the challenge value from the user mobile terminal with an authentication key,
Wherein the signature result verification step comprises:
And verifying the challenge value included in the signature result with a previously stored authentication key corresponding to the user. 3. The method of claim 2,
The signature result receiving step includes:
Receiving the signature result and unique identification information of the user mobile terminal from the user mobile terminal,
Wherein the signature result verification step comprises:
Generating verification information including the challenge value and unique identification information of the user mobile terminal and hashing the verification information; And
Extracting the hash-processed binding information from the signature result with the previously stored authentication key corresponding to the user, and verifying the hash-processed binding information against the hash-processed verification information. Method of providing non-repudiation authentication service. The method according to claim 1,
The authentication request receiving step includes:
And transmitting a push message for driving an authentication application to a user mobile terminal corresponding to the user according to an authentication request for the user from the online service server. A biometric authentication step in which a user mobile terminal performs biometric authentication for the user according to user authentication performed for an online service;
Generating a signature result obtained by signing the unique identification information of the user mobile terminal extracted by the user mobile terminal with the authentication key according to the biometric authentication result, and transmitting the signature result to the authentication service device; And
Wherein the user mobile terminal performs a primary verification based on the biometric authentication of the user based on the signature result from the authentication service device and the unique identification information of the user mobile terminal included in the signature result and the user information provided from the online service server And an authentication result receiving step of receiving the authentication result generated by performing a secondary verification based on user identity confirmation and occupancy confirmation of the user of the user mobile terminal through a communication company server based on the authentication result received by the communication server, How to provide authentication services. 6. The method of claim 5,
Wherein the biometric authentication step comprises:
Receiving a challenge value for user authentication from the authentication service device,
The signature result transmission step includes:
And generating a signature result obtained by signing the combination information including the challenge value and the unique identification information of the user mobile terminal with an authentication key according to the biometric authentication result. 6. The method of claim 5,
Wherein the biometric authentication step comprises:
Wherein the authentication application installed in the user mobile terminal requests the authentication device installed in the user mobile terminal to perform the user biometric authentication and receives the biometric authentication result according to the user biometric authentication from the authentication device. How to provide authentication services. The method according to claim 6,
The signature result transmission step includes:
The authentication application installed in the user mobile terminal generates association information including the challenge value and unique identification information of the user mobile terminal according to the biometric authentication result;
The authentication application requesting an authentication device mounted on the user mobile terminal to sign the binding information;
The authentication application hashes the binding information from the authentication device and receives a signature result signed with an authentication key; And
Wherein the authentication application sends the signature result to the authentication service device,
The authentication result receiving step includes:
Wherein the authentication application receives the authentication result from the authentication service device. 6. The method of claim 5,
The method further comprises the step of the user mobile terminal receiving the activation message of the authentication application according to user authentication for online service use from the authentication service device and running the authentication application installed in the user mobile terminal To provide a non-repudiation authentication service. 6. The method of claim 5,
Further comprising the step of activating an authentication application installed in the user mobile terminal according to a user authentication execution request for online service use from an online service application installed in the user mobile terminal for using the online service, Prevention authentication service. 11. The method according to any one of claims 1 to 10,
Wherein the unique identification information of the user mobile terminal comprises:
A wired identification number, a telephone number of the mobile terminal, or a serial number of the mobile terminal. 11. The method according to any one of claims 1 to 10,
Wherein the authentication key has the private key of the user mobile terminal in a two-key manner of a private key and a public key, and the authentication service device has a public key. Receiving an authentication request and user information for a user from an online service server, receiving a signature result obtained by signing unique identification information of the user mobile terminal with an authentication key according to a biometric authentication result for the user from a user mobile terminal, The signature verification unit verifies the signature result with an authentication key to perform a primary verification based on the biometric authentication for a user, And a second verification unit configured to perform a second verification based on user identification and occupancy confirmation of the user of the user mobile terminal through the server to generate and provide an authentication result based on the first verification and the second verification. Device. 14. The method of claim 13,
Receiving an authentication request and user information for a user from an online service server, receiving a signature result obtained by signing unique identification information of the user mobile terminal with an authentication key according to a biometric authentication result for the user from a user mobile terminal, And authenticating the user of the user mobile terminal based on the mobile terminal information including the unique identification information of the user mobile terminal through the communication company server and the user information, An authentication service processor for generating a verification result based on the first verification and the second verification, and providing the authentication result; And
The user mobile terminal makes a request for confirmation of the mobile terminal information to the communication company server in cooperation with the communication company server to which the user mobile terminal is subscribed and receives a result of user identity confirmation and occupancy confirmation of the user of the user mobile terminal from the communication company server And a communication server server interlocking unit. 15. The method of claim 14,
The authentication service processing unit,
Generating a challenge value in response to an authentication request for the user from the online service server and transmitting the generated challenge value to the user mobile terminal and transmitting the combination information including the unique identification information of the user mobile terminal and the challenge value from the user mobile terminal to an authentication key And verifies the received signature result. 15. The method of claim 14,
The authentication service processing unit,
And transmits a push message for driving the authentication application to the user mobile terminal according to an authentication request for the user from the online service server. 15. The method of claim 14,
And an authentication service registration unit for registering the use of the authentication service of the user according to the authentication service use registration request from the user mobile terminal and receiving and storing the authentication key generated for the user's biometric authentication from the user mobile terminal Characterized in that the authentication service device. The mobile terminal according to claim 1, wherein the identification information of the user mobile terminal is extracted according to the biometric authentication result of the user according to the execution of the user authentication for the online service, and the signature result signed with the authentication key of the user mobile terminal is transmitted to the authentication service device, Based on the result of the signature from the authentication service apparatus, primary authentication based on the biometric authentication of the user, unique identification information of the user mobile terminal included in the signature result, and user information provided from the online service server And an authentication application for receiving the generated authentication result by performing a secondary verification based on user identity confirmation and occupancy confirmation of the user of the user mobile terminal through the mobile terminal. 19. The method of claim 18,
Receiving a challenge value according to authentication performed by a user from the authentication service device, requesting a biometric authentication of a user with an authentication device mounted on the user mobile terminal, and transmitting the challenge value and the challenge value to the user mobile terminal An authentication application for generating binding information including unique identification information, requesting the authentication device to sign the binding information, receiving the signature result signed by the binding information from the authentication device, and transmitting the result to the authentication service device Wherein the mobile terminal is a mobile terminal. 19. The method of claim 18,
An authentication application that is automatically activated on the user mobile terminal by a user authentication execution request for online service use or a push message from the authentication service apparatus is loaded from an online service application installed in the user mobile terminal Features a user mobile terminal.

Images