KR101989610B1 - Sound-based one-time password two-phase authentication method - Google Patents

Abstract

In the sound-based two-step authentication method of the authentication server according to an embodiment of the present invention, Comprising the first authentication through the primary authentication channel; Generating and transmitting a first one-time password (OTP) to an authentication assisting device according to a second authentication channel, or requesting generation of the first OTP to the authentication assisting device; Receiving, by the authentication apparatus, recording data in which the second OTP is recorded with the modulated sound; Demodulating the recorded data to obtain the second OTP; Verifying the second OTP by comparing the first OTP and the second OTP; And transmitting the verification result to the authentication device. It may include.

Description

Sound-based one-time password two-phase authentication method}

In the present specification, in a two-phase / -channel authentication system used for enhanced security, the convenience of one-time password (OTP) used as a two-step authentication means is increased. We propose an improved two-step / channel authentication system using sound-based OTP.

Two-stage / channel authentication system is used to enhance security of user authentication system such as login system. The two-step / channel authentication system uses one-step authentication using ID-password, which is an existing user authentication method, and a channel (for example, Short Message Service (SMS)) other than the channel (for example, the Internet) used in the one-step authentication. , Application, etc.), a layered security system that requires two-factor authentication.

One-time password (OTP) is used as a method for two-factor authentication in such a security system. OTP is valid for one-time use only for authentication, and is no longer valid after one-time use. Therefore, OTP is more secure than conventional multiple authentication means (for example, authentication method using ID and password). Free from the threat of spills.

The conventional OTP authentication system for two-stage / channel authentication follows the following procedure. In the following procedure, it is assumed that the user has registered information (eg, a mobile phone number, OTP Seed) for using the secondary channel (eg, SMS, application, etc.) provided by the service provider in the system. .

1) The user performs one-step authentication (eg, ID and password authentication).

2) The service provider generates a random number using a channel (for example, SMS or application) registered in advance for two-step authentication, and delivers it to the user.

A) If the channel registered in advance is an SMS, the [SMS] service provider generates a random number to be used as an OTP and transmits the random number generated through the SMS to the user.

B) If the pre-registered channel is an application, the [application] service provider requests the user to execute the application and input a random number displayed in the application.

3) The user enters the received random number.

4) The service provider verifies the random number and completes two-step verification.

When using the secondary channel as an SMS, the service provider may pre-register phone number information of the user's mobile / mobile device in the server. Therefore, the server generates the OTP and then transmits the OTP to the user through SMS, and the user can authenticate by passing the received OTP back to the service provider.

When using the secondary channel as an application, an application for generating an OTP may be installed in a user's portable / mobile device such as a smartphone. The application can use a time-based one-time password (TOTP) algorithm to generate the OTP.

As described above, the conventional two-step / channel authentication system directly receives an OTP transmitted from a (pre-registered) secondary channel from a user and performs authentication. That is, in the conventional two-step / channel authentication system, the user's action of checking the transmitted OTP and inputting it to the secondary channel is required. This behavior of the user is a factor that degrades the user convenience of two-step / channel authentication, there is a problem that has a large delay time.

An object of the present specification is to propose a new two-step / channel authentication system using sound in order to solve / prevent problems such as deterioration of user convenience and large delay time.

In the sound-based two-step authentication method of the authentication server according to an embodiment of the present invention, Comprising the first authentication through the primary authentication channel; Generating and transmitting a first one-time password (OTP) to an authentication assisting device according to a second authentication channel, or requesting generation of the first OTP to the authentication assisting device; Receiving, by the authentication apparatus, recording data in which the second OTP is recorded with the modulated sound; Demodulating the recorded data to obtain the second OTP; Verifying the second OTP by comparing the first OTP and the second OTP; And transmitting the verification result to the authentication device. It may include.

In addition, the second OTP may be converted into the sound by a frequency shift keying (FSK) modulation scheme by the authentication assistance device.

In addition, the frequency band of the sound may correspond to an inaudible frequency band.

In addition, the second authentication channel may correspond to a short message service (SMS) or an application.

The transmitting of the first OTP or requesting generation of the first OTP may include generating the first OTP and transmitting the generated first OTP to the authentication assistant device when the second authentication channel is the SMS. If the channel is the application, the step of transmitting the generation of the first OTP to the authentication assistant device.

In addition, in the sound-based two-step authentication method of the authentication server, if the second authentication channel is the SMS, the generated first OTP is transmitted to the authentication assistance device through the SMS, and a recording command is provided to the authentication device. Making; It may further include.

Also, in the sound-based two-step authentication method of the authentication server, if the second authentication channel is the application, requesting the authentication auxiliary device to generate the first OTP through a messaging server, and instructing the authentication device to record. step; And instructing the authentication device to stop recording when the second OTP receives the completion of reproduction of the modulated sound from the authentication auxiliary device. It may further include.

In addition, the second OTP may correspond to a time-based OTP (TOTP) generated based on a predetermined seed value and a time.

The verifying of the second OTP may include verifying the second OTP by comparing a seed value of the first OTP and a seed value of the second OTP; It may include.

In addition, the sound-based authentication method of the authentication assistance device according to another embodiment of the present invention, comprising: receiving a one-time password (OTP) from the authentication server through the authentication channel; Modulating the OTP with sound; And reproducing the sound; It may include.

The step of modulating the OTP to sound may be a step of modulating the OTP to sound according to a frequency shift keying (FSK) modulation scheme.

In addition, the frequency band of the sound may correspond to an inaudible frequency band.

In addition, the authentication channel may correspond to a short message service (SMS).

In addition, the sound-based authentication method of the authentication assistant device according to another embodiment of the present invention, the step of receiving a request for the generation of the OTP through the messaging server from the authentication server; Generating the OTP; Modulating the OTP with sound; And reproducing the sound; It may include.

In addition, the OTP may correspond to a time-based OTP (TOTP) generated based on a predetermined seed value and time.

The step of modulating the OTP to sound may be a step of modulating the OTP to sound according to a frequency shift keying (FSK) modulation scheme.

In addition, the frequency band of the sound may correspond to an inaudible frequency band.

In addition, the authentication channel may correspond to an application.

According to one embodiment of the present invention, since two-step authentication is performed using sound, user convenience is increased, and the authentication time is significantly reduced as compared with the conventional method.

1 is a diagram illustrating a two-step / channel authentication system according to an embodiment of the present invention.
2 is a flowchart illustrating a sound-based secondary authentication method through SMS according to an embodiment of the present invention.
FIG. 3 is a flowchart illustrating the flowchart of FIG. 2 in view of an authentication assistant device.
4 is a flowchart illustrating a sound-based secondary authentication method through an application according to an embodiment of the present invention.
FIG. 5 is a flowchart illustrating the flowchart of FIG. 4 in view of an authentication assistant device. FIG.
6 is a block diagram of an authentication apparatus and an authentication assistance apparatus included in a sound-based two-step / channel authentication system according to an embodiment of the present invention.

The following description may be made in various ways and have a variety of embodiments, specific embodiments will be illustrated in the drawings and described in detail. However, this is not intended to limit the technology described below to specific embodiments, it should be understood to include all changes, equivalents, and substitutes included in the spirit and scope of the technology described below.

The terms first, second, A, B, etc. may be used to describe various components, but the components are not limited by the terms, but merely for distinguishing one component from other components. Used only as For example, the first component may be referred to as the second component, and similarly, the second component may be referred to as the first component without departing from the scope of the technology described below. The term and / or includes a combination of a plurality of related items or any item of a plurality of related items.

As used herein, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It is to be understood that the present invention means that there is a part or a combination thereof, and does not exclude the presence or addition possibility of one or more other features or numbers, step operation components, parts or combinations thereof.

Prior to the detailed description of the drawings, it is to be clear that the division of the components in the present specification is only divided by the main function of each component. That is, two or more components to be described below may be combined into one component, or one component may be provided divided into two or more for each function. Each of the components to be described below may additionally perform some or all of the functions of other components in addition to the main functions of the components, and some of the main functions of each of the components are different. Of course, it may be carried out exclusively by.

In addition, in carrying out the method or operation method, each process constituting the method may occur differently from the stated order unless the context clearly indicates a specific order. That is, each process may occur in the same order as specified, may be performed substantially simultaneously, or may be performed in the reverse order.

The invention proposed in the present specification is an invention for a low-latency sound-based one-time password authentication method for increasing user convenience, and aims to automatically transmit the OTP to the second authentication means through a sound other than the user.

The two-stage / channel authentication system proposed by the present invention includes a server of an authentication service provider, an authentication device of a user (for example, a computer device, a portable / mobile device, etc.) and an authentication assistant device (for example, a computer device, a portable / Mobile devices, etc.), and examples of communication methods / means between the devices are as follows.

Service provider's server and authentication device: Internet

-Service Provider's Servers and Authentication Aids: i) a separate messaging server (or push server) when using SMS or ii) applications (examples include Google's Firebase Cloud Messaging)

-Authentication device and authentication auxiliary device: sound

Since sound is used as a communication method / means between the authentication device and the authentication assistance device, the authentication device and the authentication assistance device of the present invention should be provided with a microphone or a speaker for recording / reproducing the sound, respectively. For example, the authentication device should be equipped with a microphone and the authentication assistant device with a speaker.

A more detailed embodiment of the sound-based two-step / channel authentication scheme will be described below with reference to FIGS. 1 to 5. In the following embodiments, it is assumed that the first authentication is completed, and will be described based on a sound-based second authentication method. As the first authentication method, various authentication methods such as authentication through ID and password may be applied. However, the present invention is not limited thereto, and the following embodiments may be applied / introduced to various authentication systems for high security and low latency (for example, as a first authentication method of one step / channel authentication method). Can be used).

1 is a diagram illustrating a two-step / channel authentication system according to an embodiment of the present invention. In this embodiment, at least one step may be deleted or a new step may be added.

1. First, a user may attempt authentication using an authentication device (eg, a computer device). Here, the user's attempt to authenticate to the authentication device may correspond to, for example, a case where the user wants to log in or access a specific site / device / service.

2. The server of the authentication service provider transmits an OTP to a pre-registered user's authentication assistant device (e.g., a portable / mobile device) through a pre-registered channel for sound-based authentication (e.g., In case of SMS, an authentication request message for requesting generation of OTP may be transmitted to the channel (for example, when the channel is an application).

3. The authentication assistant may modulate OTP obtained through the channel into sound data. In this case, as a modulation method for modulating sound, frequency shift keying (FSK) may be used. An example of applying the octal FSK modulation in units of 125 Hz from 1000 Hz ('000') to 1875 Hz ('111') to deliver a six-digit number '123456' may be as follows.

1) Since 3 bytes are required to represent 6 digits, the authentication assistant can convert '123456' into a binary with a size of 24 bits as shown below. The first 4 bits can then be used for Error Check:

-000 000 011 110 001 001 000 000

2) Next, the authentication assistant may divide a binary number of 24 bits converted into binary numbers by 3 bits, and then convert it into a frequency array corresponding to each of the separated 3 bits values:

-1000Hz-1000Hz-1375Hz-1750Hz-1125Hz-1125Hz-1000Hz-1000Hz

3) Next, the authentication assistant device can reproduce the frequency array one by one according to a predefined / set time interval (for example, 0.125 seconds).

The method of demodulating the sound received from the authentication assistant device may be performed in the reverse order of the above-described FSK modulation method.

In this case, when the frequency band reproduced by the authentication assistant device corresponds to the audible frequency band (0 to 20000 Hz), it may cause inconvenience to the user. Therefore, the frequency band reproduced by the authentication assistant device may be limited to an inaudible frequency band (eg, 20000 Hz or more) within a frequency band supported by the performance of the microphone / speaker provided in the authentication device and the authentication assistant device.

4. The authentication assistant device can play a sound corresponding to the FSK modulation-completed frequency, and the authentication device can record a sound played from the authentication assistant device.

5. The authentication apparatus transmits the recorded sound data to the service provider's server, and the server may demodulate and convert the recorded sound data into OTP.

6. Finally, the server may verify that the converted OTP is valid, and send the verification result (eg, authentication success or failure) to the authentication device.

7. Finally, the authentication device can complete the authentication process by providing the verification result to the user.

In the sound-based authentication system according to the present embodiment, in order to prevent an error that may occur during sound transmission, the OTP may be encoded / decoded by an error detection or correction code, and / or error recovery that repeats the same sound N times ( Error Recovery means can be used.

On the other hand, in the present specification, the authentication device of the sound-based two-step / channel authentication system is an authentication request device equipped with a sound recording means (for example, a microphone), the authentication auxiliary device is a sound reproduction means (for example, a speaker) Each may be generalized to the provided authentication token.

Hereinafter, the embodiment will be divided into a case where the secondary channel is an SMS (FIGS. 2 and 3) and an application (FIGS. 4 and 5).

2 is a flowchart illustrating a sound-based secondary authentication method through SMS according to an embodiment of the present invention. For the flowchart, the descriptions of the above-described embodiments may be applied in the same or similar manner, and overlapping descriptions will be omitted. In addition, in this flowchart, the sound-based two-step / channel authentication system includes an authentication device, an authentication assistant device, and a server (or an authentication server, a service providing server), wherein the authentication assistant device is a portable / mobile device, and the authentication device is a personal computer (Personal). Computer), but is not limited thereto. In addition, at least one step may be omitted from the flowchart, and a new step may be added.

Referring to FIG. 2, first, a user may attempt to authenticate an authentication device (S2010).

Next, the authentication device may inform the server of the authentication attempt of the user (S2020). This can be done by the authentication device sending a message to the server informing the authentication attempt.

Next, the server may generate an OTP (S2030) and instruct the authentication device to perform recording (S2040). Furthermore, the server may transmit the OTP generated in step S2030 to the authentication assistant device through SMS (S2050).

The authentication device that receives the recording command from the server may record the sound through the sound recording means for a preset recording time (S2050).

The authentication assistant apparatus that receives the OTP from the server through the SMS may extract the OTP from the SMS (S2060), and modulate the extracted OTP into a sound (S2070). In this case, the FSK modulation method may be used as the sound modulation method, and a detailed description thereof is as described above with reference to FIG. 1. Next, the authentication assistant device may reproduce the sound generated by modulating the OTP through the sound reproducing means (S2090).

When the preset recording time expires, the authentication device may transmit a recording file (or recording data) of the sound reproduced from the authentication auxiliary device to the server (S2100).

The server receiving the recording file may demodulate the recording file to obtain an OTP (S2110), and verify the corresponding OTP (S2120). In more detail, the server may verify the OTP by determining whether the OTP obtained in step S2110 is the same as the OTP used in step S2030 / S2050. If the two OTPs are identical, the verification can be concluded;

Next, the server may transmit an OTP verification result to the authentication apparatus, and instruct the authentication apparatus to provide / display the verification result to the user (S2130).

Finally, the user may check the verification result provided / displayed by the authentication apparatus (S2140).

FIG. 3 is a flowchart illustrating the flowchart of FIG. 2 in view of an authentication assistant device.

Referring to FIG. 3, the authentication assisting apparatus may receive an SMS including OTP information from a server (S3010).

Next, the authentication assistant device may extract the OTP from the received SMS (S3020).

Next, the authentication assistant device may modulate the extracted OTP to sound (S3030). In this case, various modulation schemes may be used, for example, the FSK modulation scheme may be used as described above.

Next, the authentication assistant device may reproduce the modulated sound (S3040). In this case, the frequency band of the reproduced sound may correspond to an inaudible frequency band.

4 is a flowchart illustrating a sound-based secondary authentication method through an application according to an embodiment of the present invention. More specifically, FIG. 4 is a flowchart illustrating an authentication method when an OTP is generated using a time-based OTP (TOTP) separately in an application.

For the flowchart, the descriptions of the above-described embodiments may be applied in the same or similar manner, and overlapping descriptions will be omitted. Also, in this flowchart, the sound-based two-step / channel authentication system includes an authentication device, an authentication assistant device, a push server (or messaging server) and a server (or authentication server, a service providing server), and the authentication assistant device is a portable / mobile device. The device and the authentication device are described based on the case of a personal computer (PC), but are not limited thereto. In this flowchart, the authentication assistant device and the push server (or messaging server) may be implemented as one device. In addition, at least one step may be omitted from the flowchart, and a new step may be added.

Referring to FIG. 4, first, a user may attempt to authenticate an authentication device (S4010).

Next, the authentication device may inform the server of the authentication attempt of the user (S4020). This may be performed by the authentication device sending a message indicating the authentication attempt to a server (or an authentication server, a service providing server).

Next, the server (or authentication server, service providing server) may request the OTP generation / playback to the authentication auxiliary device through the push server (or messaging server) (S4030, S4040). In operation S4050, the server (or an authentication server or a service providing server) may instruct the authentication apparatus to perform recording.

Upon receiving the OTP generation / regeneration request, the authentication assisting device may generate an OTP (S4060), and modulate the generated OTP to sound (S4070). At this time, the authentication assistant device may generate the OTP through the TOTP algorithm.

TOTP algorithm generates OTP based on current time and initial Seed value. This is an extension of the HMAC-based One-Time Password (HOTP) algorithm. In the HOTP algorithm, the result of using the Seed value and the event counter that increases sequentially with each authentication as the parameter of the HMAC algorithm is used as the OTP. In contrast, TOTP uses OTP as the result of using the time value as a parameter of the HMAC algorithm instead of the event counter. The detailed procedure for TOTP is as follows.

1) Convert the current time (currentTime) divided by the OTP's retention time (timeLimit) to 8 bytes and store it in time: byte [8] time = convertToByteArray (currentTime / timeLimit)

2) Compute the hash with the HMAC function using seed and time: byte [] hash = HMAC (seed, time)

3) Convert the hash to an integer and calculate the OTP based on the codeDigits of the OTP you want to find: int otp = convertToInteger (hash)% power (10, codeDigits)

To use the TOTP algorithm, there is a condition that the variable Seed value used in the TOTP algorithm must be shared between the service provider and the user's application in advance. To this end, the service provider may generate a random Seed value and then share the Seed with the application through QR Code or direct input. In the present embodiment using the application, it is assumed that pre-sharing of seed values is completed between the service provider (that is, the server) and the application. When the service provider requests the second authentication, the user runs the application and the application Authenticate by passing the OTP indicated on to the service provider (ie server).

The authentication assistant device that has completed sound modulation of the OTP may play the modulated sound (S4090). When the authentication device that receives the recording command from the server receives the recording stop command from the server (or the authentication server or the service providing server), Sound can be recorded through the sound recording means (or during the preset recording time) (S4080).

The authentication assistant device that completes the sound reproduction may notify the server through the push server (or messaging server) that the sound reproduction is completed (S4100 and S4110). Next, the server (or the authentication server, the service providing server) may transmit a recording stop command to the authentication device (S4120).

Upon receiving the recording stop command, the authentication device may transmit a recording file (or recording data) to a server (or an authentication server or a service providing server) (S4130).

The server (or an authentication server or a service providing server) may demodulate the recorded file to obtain an OTP (S4140) and verify the corresponding OTP (S4150). More specifically, the server (or an authentication server or a service providing server) may verify the OTP by determining whether the demodulated OTP corresponds to a TOTP generated based on a seed value shared with the authentication auxiliary device in advance. If the seed value of the demodulated OTP is the same as the seed value shared in advance, it can be concluded that the verification succeeds, and in other cases, the verification fails.

Next, the server may transmit an OTP verification result to the authentication apparatus and instruct the authentication apparatus to provide / display the verification result to the user (S4160).

Finally, the user may check the verification result provided / indicated by the authentication apparatus (S4170).

FIG. 5 is a flowchart illustrating the flowchart of FIG. 4 in view of an authentication assistant device. FIG.

First, the authentication assistant device may receive an OTP play request from a server (or an authentication server or a service providing server) through a push server (or a messaging server) (S5010).

Next, the authentication assistant device may generate an OTP (S5020). In this case, the authentication assistant device may generate an OTP by applying an OTP algorithm previously promised with a server (or an authentication server or a service providing server). For example, the authentication assistant device may generate an OTP through a TOTP algorithm, and a seed value for generating the OTP may be shared with a server (or an authentication server or a service providing server) in advance.

Next, the authentication assistant device modulates the OTP to sound (S5030), and may reproduce the modulated sound (S5040). In this case, various modulation schemes may be used as the modulation scheme of the OTP. For example, an FSK modulation scheme may be used.

Finally, the authentication assistant device that has completed the sound reproduction may notify the server (or the authentication server or the service providing server) through the push server (or messaging server) that the reproduction is completed (S5050).

6 is a block diagram of an authentication apparatus and an authentication assistance apparatus included in a sound-based two-step / channel authentication system according to an embodiment of the present invention.

The authentication device and the authentication assistance device 6000 included in the sound-based two-step / channel authentication system may include various hardware means for appropriately performing at least one function described above.

For example, as shown in the figure, the authentication device and the authentication assistance device 6000 is a sound recording / reproducing means (for example, a microphone, a speaker, etc.) 6010, other devices for recording / playing sound Communication means 6020 for communicating with the server, memory 6030 for storing data, and / or processor 6040 for processing (e.g., modulation / demodulation, etc.), and the like. have.

An experiment was conducted to verify the efficiency of the present invention according to the embodiment described above.

The service provider's server is based on Linux and is divided into web service part and authentication part. The web service part is a part of the website that appears on the user's computer. It records the sound and receives the OTP. The authentication part is responsible for demodulating and verifying OTP generation, request, and sound data with OTP. The implementation languages were PHP, HTML5 / CSS3, Python, and JavaScript. The user's portable device is an Android-based device that implements the application in Java. Google used Firebase Cloud Messaging as its messaging server. In the experiment, 8-band frequency modulation is used in 125Hz units in the 18000Hz to 19000Hz band.

As a result of the experiment, the transmission time for each signal was 0.125 seconds, and the time taken to deliver one signal was about 1 second, and it was confirmed that the authentication was completed much faster than the user directly inputting the OTP to the authentication device.

The present invention can be utilized in various ways as an authentication means of a system requiring high security and low latency. For example, it can be variously used as a means for high security and low latency single / multiple authentication in web pages, and certain devices.

According to this embodiment of the present invention, since the sound is used as an authentication means, it is possible to ensure the proximity of the authentication assistant device and the authentication device (when the distance between the two devices is far, the sound may not be recorded properly. ). In addition, since the sound of the inaudible frequency band is used, and the sound does not pass through the wall, the security is ensured since the authentication is not revealed to others. In addition, since two-step authentication is performed using sound, the user's convenience is increased, and the authentication time is significantly reduced as compared with the conventional method.

Embodiments according to the present invention may be implemented by various means, for example, hardware, firmware, software, or a combination thereof. In the case of a hardware implementation, an embodiment of the present invention may include one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), FPGAs ( field programmable gate arrays), processors, controllers, microcontrollers, microprocessors, and the like.

In addition, in the case of the implementation by firmware or software, an embodiment of the present invention is implemented in the form of a module, a procedure, a function, etc. for performing the above-described functions or operations, so that the recording medium can be read by various computer means. Can be recorded. Here, the recording medium may include a program command, a data file, a data structure, etc. alone or in combination. Program instructions recorded on the recording medium may be those specially designed and constructed for the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. For example, the recording medium may be magnetic media such as hard disks, floppy disks and magnetic tapes, optical disks such as Compact Disk Read Only Memory (CD-ROM), digital video disks (DVD), Magnetic-Optical Media, such as a Disk, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, Flash Memory, and the like. Examples of program instructions may include high-level language code that can be executed by a computer using an interpreter as well as machine code such as produced by a compiler. Such hardware devices may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

In addition, the device or the terminal according to the present invention may be driven by a command that causes one or more processors to perform the functions and processes described above. For example, such instructions may include interpreted instructions, such as script instructions such as JavaScript or ECMAScript instructions, or executable instructions or other instructions stored on a computer readable medium. Furthermore, the device according to the present invention may be implemented in a distributed manner over a network, such as a server farm, or may be implemented in a single computer device.

Furthermore, a computer program (also known as a program, software, software application, script or code) mounted on an apparatus according to the invention and executing a method according to the invention comprises a compiled or interpreted language or a priori or procedural language. It can be written in any form of programming language, and can be deployed in any form, including stand-alone programs or modules, components, subroutines, or other units suitable for use in a computer environment. Computer programs do not necessarily correspond to files in the file system. A program may be in a single file provided to the requested program, in multiple interactive files (eg, a file that stores one or more modules, subprograms, or parts of code), or part of a file that holds other programs or data. (Eg, one or more scripts stored in a markup language document). The computer program may be deployed to run on a single computer or on multiple computers located at one site or distributed across multiple sites and interconnected by a communication network.

For convenience of description, the drawings are divided and described, but the embodiments described in each drawing may be merged to implement a new embodiment. In addition, the present invention is not limited to the configuration and method of the embodiments described as described above, the above embodiments are configured by selectively combining all or part of each embodiment so that various modifications can be made May be

In addition, while the preferred embodiments have been shown and described, the present specification is not limited to the above-described specific embodiments, and those skilled in the art without departing from the scope of the claims. Various modifications can be made by the user, and these modifications should not be understood individually from the technical spirit or prospect of the present specification.

6000: authentication device / authentication auxiliary device
6010: Sound recording / playback means
6020: communication means
6030: memory
6040: processor

Claims (18)

In the voice-based two-step authentication method of the authentication server,
Completing the primary authentication through the primary authentication channel;
Generating, by the authentication server, any seed value for use of a time-based OTP algorithm;
Generate a first one-time password (OTP) according to a second authentication channel, encode the first OTP with an error detection or correction code, and transmit the first OTP to an authentication assistant device, or generate the first OTP to the authentication assistant. Making a request to the device;
Receiving, by the authentication apparatus, recording data in which the second OTP is recorded with the modulated sound;
Demodulating the recorded data to obtain the second OTP;
Verifying the second OTP by comparing the first OTP and the second OTP; And
Transmitting a verification result to the authentication device; Including;
When generating the recording data, the authentication assistant device repeats the same sound two or more times,
The second OTP corresponds to a TOTP generated based on the seed value and time.
The secondary authentication channel is an application,
The application is a sound-based two-step authentication method for sharing the seed value with the authentication server. The method of claim 1,
And the second OTP is converted into the sound by a frequency shift keying (FSK) modulation scheme by the authentication assistance device. The method of claim 2,
The sound frequency band corresponds to an inaudible frequency band, sound-based two-step authentication method. delete delete delete The method of claim 3, wherein
Requesting the authentication assisting device to generate the first OTP via a messaging server, and instructing the authentication device to record; And
Instructing the authentication device to stop recording when the second OTP receives the completion of reproduction of the modulated sound from the authentication auxiliary device; Further comprising, a sound-based two-step authentication method. delete The method of claim 7, wherein
Verifying the second OTP,
Verifying the second OTP by comparing the seed value of the first OTP and the seed value of the second OTP; Including, the sound-based two-step authentication method. In the sound-based authentication method of the authentication assist device,
Receiving, by the authentication assist device, a seed value received from an authentication server through a QR code or directly from a user;
Receiving an one-time password (OTP) encoded from an authentication server through an authentication channel;
Error detecting or correcting code decoding the OTP;
Modulating the OTP with sound; And
Repeatedly playing the sound two or more times; Including;
The OTP corresponds to a time-based OTP (TOTP) generated based on the seed value and time.
The authentication channel is an application,
The application is a sound-based authentication method for sharing the seed value with the authentication server. The method of claim 10,
The step of modulating the OTP to sound, the step of modulating the OTP to sound according to the frequency shift keying (FSK) modulation scheme, sound-based authentication method. The method of claim 10,
And the frequency band of the sound corresponds to an inaudible frequency band. delete delete delete delete delete delete

Images