KR102160892B1 - Public key infrastructure based service authentication method and system - Google Patents

Abstract

The present invention provides a method and system capable of confirming whether user authentication has been initiated by accessing a correct service server by a currently used user terminal. More specifically, according to the present invention, when the user ID is input to the service server for user authentication after accessing the service of the user terminal, the service server generates a service authentication value and presents it to the user terminal, and then generates a service authentication value or authentication value. Provides a method of encrypting possible related values with a PKI-based key and transmitting them to an authentication terminal. Thereafter, the value transmitted from the service is decrypted by verifying the value with the PKI-based key stored in the authentication terminal in advance, and the service confirmation value or the service confirmation value based on the related value is generated and displayed to the user. It provides a service authentication method and system that enables a user to directly check whether a connection with a service server is connected with the naked eye.

Description

Public key based service authentication method and system {PUBLIC KEY INFRASTRUCTURE BASED SERVICE AUTHENTICATION METHOD AND SYSTEM}

The present invention relates to an authentication method and system, and more specifically, to a public key-based service authentication method and system.

As dozens of online services and mobile devices are used in everyday life, next-generation authentication technologies that can substitute for user authentication using mobile devices are being introduced. One of the most representative technologies is a user authentication technology such as FIDO (Fast IDentity Online) applying a biometric information recognizer attached to a user's smartphone and a PKI (Public Key Infrastructure) based technology.

PKI-based user authentication technology using such a mobile terminal generally operates in the following manner. Whenever a user subscribes to the service, a pair of asymmetric keys are generated in the mobile terminal through a separate identification procedure such as registering his/her biometric information, and the user's secret key is stored in the user's mobile terminal, and the service server This is a method of transmitting the public key. Later, when the user accesses the service and enters the ID, the service server transmits a pre-designated or random attempt value to the user's terminal at the time of connection, and the user's terminal confirms the identity of the biometric value registered by the user. After passing through, the user terminal signs the received attempt value with the user's private key and sends it to the server. Accordingly, the service server verifies the corresponding value with the user's public key stored in the server, and performs a user authentication procedure to confirm whether a legitimate user has performed user authentication with a legitimate authentication terminal.

However, the existing mobile-based user authentication technology authenticates whether the correct user accesses the service server through the correct mobile authenticator, but does not verify whether the service terminal currently used by the user is connected to the correct service server and the user authentication request is initiated. .

For example, when a service app and an authentication app are connected to a mobile terminal and are not operated separately but are operated separately, or when a user accesses an online service through a web service from a PC terminal and authenticates the user's access with the authentication app of the mobile terminal, the user May perform a request for user confirmation entering the mobile terminal without checking whether a normal service server is connected to a normal service terminal.

Therefore, when the user receives a user authentication request from the service server to the terminal on which the user authentication app is installed, it is not possible to check whether the current service terminal is connected to a normal service and the user request is received. At this time, if the first user's service terminal accesses the wrong service other than the normal service server, and the hacker enters the user ID into the hacker's service terminal at that point, a user confirmation request is sent to the correct user's mobile authentication app. do. In this case, the user may be mistaken for his or her own access and may perform user verification to authenticate the hacker's access attempt instead of the user.

More specifically, when the first user accesses the service from the service terminal with the farming website or the farmed mobile app and enters the ID, the hacker accesses the actual service server with the ID acquired at that time and enters the user ID. And, when the user authentication request is activated on the mobile authentication app terminal possessed by the user, the user regards it as an authentication request according to his or her connection and performs an identity verification procedure such as inputting a biometric value, so that the hacker's service terminal is a real service server. You will be certified by

Therefore, when the service and authentication are operated separately through the mobile authenticator, if the user authenticates without confirming that authentication is initiated by the tampered service, no matter how high security the applied user authentication technology is, it is a critical problem to service security. Will occur.

In the meantime, authentication methods for verifying whether a user's terminal has met the correct service includes a verification method based on a QR code and a verification method based on a service OTP (Service One Time Password).

In the QR code-based verification method, when a user accesses the service and enters a user ID, the QR code generated by the service server is displayed on the user's service terminal, and the value detected using the camera of the user's mobile authentication app is displayed. It was a method of sending it to the service server. However, the method of using a QR code has a limitation in that it is not possible to sense one's screen with one's own camera in a mobile work environment where the service app and the authentication app are simultaneously used with one mobile terminal, along with the hassle of sensing with a camera.

In addition, the method of verifying the service based on the service OTP is to display the OTP value generated by the service server on the user's service terminal when the user accesses the service and enters the ID, and generates the OTP value through the user's mobile verification app. It was a way to check whether the service was a normal service. However, in the method of using service OTP, the authentication value must be expressed only in numbers due to the nature of OTP, so the user can use the name of the connected service or the service item name (the function name in the service, transaction name, contract document, trader name, transaction amount, etc.) There was a limitation in that it was not possible to express it in a way that could be directly contrasted.

Therefore, there is a need for a PKI-based service authentication technology that allows a user terminal to access a correct service server or a correct subservice of a service to check whether user authentication has been initiated.

The present invention provides a method and system capable of confirming whether user authentication has been initiated by accessing a correct service server by a currently used user terminal.

More specifically, according to the present invention, when the user ID is input to the service server for user authentication after accessing the service of the user terminal, the service server generates a service authentication value and presents it to the user terminal, and then generates a service authentication value or authentication value. Provides a method of encrypting possible related values with a PKI-based key and transmitting them to an authentication terminal. Thereafter, the value transmitted from the service is decrypted by verifying the value with the PKI-based key stored in the authentication terminal in advance, and the service confirmation value or the service confirmation value based on the related value is generated and displayed to the user. It provides a service authentication method and system that enables a user to directly check whether a connection with a service server is connected with the naked eye.

According to an aspect of the present invention, in configuring a mobile authentication technology using a PKI-based technology, a PKI-based authenticator app and an authentication server are provided to check whether user authentication has been initiated by accessing the service terminal currently used to the correct service server. do.

Here, the PKI-based authentication server that checks service and user authentication,

After receiving the user ID, generating the service authentication code according to the conditions given in advance, presenting it to the user's service terminal through the service server, and encrypting the service authentication value or the related value that can generate the authentication value with a PKI-based key It transmits to the authentication terminal, decrypts the encrypted user authentication value received from the authenticator app, and delivers an authentication success message to the service server if it matches the user authentication value specified in advance.

Here, the PKI-based authenticator app used for the service,

The encrypted service authentication value received from the authentication server is decrypted with the PKI-based key stored in the authentication terminal in advance, and the service check value is generated based on the service check value or related value, and the service check value is displayed to the user, and the corresponding service terminal Allows the user to directly check whether or not is connected to a legitimate service server, and after passing the identity verification process for the user's consent procedure, the user authentication value is generated according to the pre-specified conditions, encrypted with the stored PKI-based key, and encrypted with the authentication server. Passed the user authentication value.

According to an embodiment of the present invention, in using a mobile authentication technology using a PKI-based technology, the user can explicitly check whether the user terminal currently used accesses the correct service server and user authentication has been initiated. There is an effect to be prepared for authentication requests.

In addition, there is an effect of configuring a more secure mobile-based authentication environment by allowing a single terminal to perform a method that was previously performed by a user terminal and an authenticator app separately based on a QR code.

In addition, since the existing OTP (One time password) exceeds the limit that only numbers should be expressed, the name of the connected service or the service item name presented by the service is directly expressed to the user in authenticating the service. There is an effect that the user can directly collate the service and express it.

1 is a view for explaining a PKI-based service authentication method and system according to an embodiment of the present invention.
2 to 7 are exemplary screens displayed on a screen during an authentication process according to a PKI-based service authentication method according to an embodiment of the present invention.

Since the present invention can apply various transformations and have various embodiments, specific embodiments will be illustrated in the drawings and described in detail in the detailed description. However, this is not intended to limit the present invention to a specific embodiment, it is to be understood to include all conversions, equivalents, and substitutes included in the spirit and scope of the present invention.

In describing the present invention, when it is determined that a detailed description of a related known technology may unnecessarily obscure the subject matter of the present invention, a detailed description thereof will be omitted. In addition, numbers (eg, first, second, etc.) used in the description of the present specification are merely identification symbols for distinguishing one component from another component.

In addition, throughout the specification, when one component is referred to as "connected" or "connected" to another component, the one component may be directly connected or directly connected to the other component, but specially It should be understood that as long as there is no opposing substrate, it may be connected or may be connected via another component in the middle.

In addition, throughout the specification, when a certain part "includes" a certain component, it means that other components may be further included rather than excluding other components unless otherwise stated. In addition, terms such as "unit" and "module" described in the specification mean a unit that processes at least one function or operation, which means that it can be implemented as one or more hardware or software, or a combination of hardware and software. . In addition, the Push ID expressed in this specification refers to a Push Token typically expressed by mobile app developers, and the push message service refers to a message service provided for each app by a mobile operating system such as Google or Apple.

1 is a diagram for explaining a PKI-based service authentication method and system according to an embodiment of the present invention, and FIGS. 2 to 7 are in the process of performing authentication according to the PKI-based service authentication method according to an embodiment of the present invention. These are example screens displayed on the screen. Hereinafter, embodiments of the present invention will be described in detail with reference to FIGS. 2 to 7 centering on FIG. 1.

1, a PKI-based service authentication system according to an embodiment of the present invention includes a service server 110 providing a service to a client, an account information DB 120, a PKI-based authentication server 130, and It may include a service client 200 accessing the service server and an authenticator app 210 for performing PKI-based authentication.

Here, the service client 200 is a computing device used by a user to access the service server 110 and collectively refers to various terminals such as a user's PC and a smart phone. In addition, the authenticator app 210 refers to an application program (ie, an agent program for authentication purposes) produced for performing service authentication and user authentication according to an embodiment of the present invention. The authenticator app 210 may be installed by the user directly on his or her authentication terminal (eg, a smartphone, etc.), but may be separately provided as a dedicated authentication terminal. That is, the service client 200 may be a web browser of a PC configured separately from the PKI-based authenticator app 210 or may be a mobile service app, and the service client 200 and the PKI-based authenticator app 210 are integrated into one mobile. It is also obvious that it can be an app. In addition, it is obvious that the account information DB 120 may also be integrated and operated with the service server 110 depending on the implementation method.

In addition, in FIG. 1, the service client 200 and the authenticator app 210 are shown as physically separated objects, but this is not necessarily the case. For example, when the service client 200 is a user's smartphone and the authenticator app 210 is installed on the smartphone, it may be implemented in one object. Referring to the drawings attached to the present specification, FIGS. 2, 4, and 6 are specific service terminals used by users such as a PC, etc., and the authenticator app 210 is a smartphone possessed by the user. It is an example of a case installed in. In this case, the service client 200 connects through the service server 110 and the web application, and the authenticator app 210 will perform service authentication and user authentication operations in a mobile environment (according to an embodiment of the present invention). Case 1). As another example, FIGS. 5 and 7 illustrate a case where the service client 200 is also a smartphone owned by the user, and the authenticator app 210 is installed on the smartphone. In this case, the authentication operation as well as the connection with the service server 110 will all be performed in a mobile environment (the second case according to the embodiment of the present invention).

The service server 110 is a configuration unit that provides a substantial service to a configuration unit corresponding to a request of the service client 200. When the first client attempts to connect, it requests a user ID [see S1 and S2 in Fig. 1], and when the ID is confirmed in the account information DB 120 [see S3 and S4 in Fig. 1], the PKI authentication server 130 The ID is transmitted and a service authentication code is requested [see S5 of FIG. 1].

At this time, if the underlying technology used as a PKI is a situation in which the authenticator app 210 must be running, after confirming the ID in the account information DB 120, a push message indicating that an authentication request has been received through a separate Push server (not shown) It is obvious that the PKI-based authenticator app 210 is sent, and when a signal indicating that the user who received the push message has driven the app is received, the authentication code request can be developed along with the ID delivery.

In addition, when requesting a service authentication code, the authentication code can be requested by adding a function name that other service servers are currently trying to perform in addition to the service authentication code. In other words, the service server transmits the name of the operation that is currently attempting to be authenticated. For example, when sending an ID, if the function name is attached to the site URL as'login', or if it is authenticated in a specific contract, the contract name, contract file location, contract document file, contract subject, etc. can be additionally included. .

The PKI authentication server 130 may generate a service authentication code according to a condition given in advance (see S6 in FIG. 1). At this time, the condition given in advance may be to generate an arbitrary number, or to generate the OTP value of the corresponding ID with a symmetric key previously designated for each separate user, such as OTP, and according to the contract number generation rule specified in advance. It can be created as'Contract 2016-Serial Number', etc., or any form specified in advance such as'Site Name (e.g., estorm.co.kr), Function Name Login', a string requesting service authentication by the service server. It can also be a string of.

Thereafter, the PKI authentication server 130 encrypts the generated service authentication code with a public key previously allocated corresponding to the recipient's ID, and transmits the generated service authentication code to the terminal on which the PKI-based authenticator app 210 of the corresponding ID is installed (S7 and See S8]. At this time, it is obvious that the delivery method can be delivered by any communication method such as socket communication or push message.

In addition, at this time, the PKI authentication server 130 transmits the generated service authentication code to the service server 110 so that the corresponding service authentication code can be posted to the user through a screen provided by the service server 110 [Fig. 1, see S9 and S10]. In this case, a screen wait for service authentication and user authentication is performed (see S11 in FIG. 1).

An example of a screen in which a service authentication code is posted through a screen provided by the service server 110 is shown in FIG. 2A. As another example of the screen, Figs. 4A and 5A show the service authentication code and other information related to the service connection (i.e., the URL of the service server, the service name, the purpose of authentication, the user who requested the authentication, etc.) ) Also exemplifies a case where it is expressed more. As another example of the screen, in Fig.6(a) and Fig.7(a), the service authentication code (in this example, it is a contract authentication code) and other information related to the corresponding contract (i.e., the contract location, contract name, contract The number, contractor and contractee, contract body value, etc.) are further expressed.

Accordingly, the PKI-based authenticator app 210 decrypts the transmitted encrypted value with its own secret key, processes the string in a pre-specified manner, and displays the service authentication code so that the user can confirm the user's consent. Is obtained [see S12, S13, S14 in Fig. 1]. At this time, the decrypted string may be an authentication value for service authentication itself, an OTP generation variable that can generate a service authentication value, a string that combines a site name with a function name, or a contract number There are no restrictions, such as the amount and the character string specified by the contractor name.

Here, in checking the service authentication code, the user's consent method may be variously applied according to a predefined method. As an example, user consent is a biometric information verification function that can identify the user, and it is obvious that various identification functions that can be performed on a smartphone such as fingerprint recognition, voice recognition, face recognition, and PIN verification can be applied. As an example of this, FIG. 3 shows a method of identifying an identity through fingerprint recognition.

When the user's authentication code is verified, the authenticator app 210 generates a user authentication value according to a predetermined condition [see S15 in Fig. 1], and encrypts the user authentication value with a private key of the corresponding ID usable in the authenticator. Then, it is transmitted to the authentication server 130 (see S16 and S17 in FIG. 1). At this time, the pre-designated condition can be used as it is the character string received at the time of service authentication, and can be changed by applying an arbitrary variable value such as time to the received character string, and the same condition that the server and the user decided to use in advance for authentication. It is obvious that it can be created by

The PKI authentication server 130 restores the encrypted value transmitted by the authenticator app 210 using the public key of the corresponding ID, and compares it with the user authentication code generated according to the conditions specified in advance, and if it matches, a legitimate authenticator app After confirming that data has been received from 210, the authentication result (ie, authentication approval) is transmitted to the service server (see S18 and S19 in FIG. 1). The service server starts the service according to the authentication approval (see S20 of FIG. 1). For example, when the purpose of authentication is login, the service access by the user is approved, and when the purpose of authentication is contract, the contract is approved according to the user's consent.

In the above, in implementing service authentication, the case where the service authentication value is encrypted with the user's public key stored in the PKI authentication server and decrypted with the user's private key in the PKI authenticator app has been described. It is also obvious that it can be encrypted with a key and decrypted with the server's public key in a PKI authenticator app. In other words, service authentication starts with the server's secret key, decrypts it with the server's public key stored by the user's PKI authenticator app, and asks the user to confirm whether the service authentication value displayed on the service screen and authenticator screen match , When the user confirms this, the user's PKI authenticator app generates user authentication values in a pre-specified manner, encrypts the user authentication values with a usable user private key, and transmits them to the PKI authentication server.

In addition, when the service server implements a service that seals the contract with the user's private key rather than user authentication, the overall flow is similar to the above, but the electronic contract file together with the ID can be delivered to the PKI authentication server. At this time, the PKI authentication server generates the hash value of the corresponding contract file, encrypts it with the user's public key, and delivers it to the PKI authenticator app, and the PKI authenticator app decrypts the hash value with its own private key, and when user consent is obtained. The hash value can be encrypted with the user's private key and transmitted to the PKI authentication server. Accordingly, it is also apparent that the PKI authentication server decrypts the received encrypted hash value with the user's public key, compares it with the hash value transmitted from the server, and informs the service server that the contract has been concluded if they match. Do.

In addition, if the method that the user agrees to according to the configuration is a biometric function such as fingerprint recognition installed in a mobile device, when the manufacturer's fingerprint reader is displayed on the screen, the service provider or the function name of the service provider is displayed together, so that the user can recognize the fingerprint. It is also obvious that it can be implemented at the manufacturer level so that you can confirm what you agree with. Examples of screens related thereto are shown in FIGS. 5B and 5C and 7B and 7C.

The public key-based service authentication method according to an embodiment of the present invention described above may be implemented as a computer-readable code on a computer-readable recording medium. Computer-readable recording media include all types of recording media in which data that can be read by a computer system are stored. For example, there may be read only memory (ROM), random access memory (RAM), magnetic tape, magnetic disk, flash memory, optical data storage device, and the like. In addition, the computer-readable recording medium can be distributed to a computer system connected through a computer communication network, and stored and executed as code that can be read in a distributed manner.

The above has been described with reference to the embodiments of the present invention, but those of ordinary skill in the relevant technical field variously modify the present invention within the scope not departing from the spirit and scope of the present invention described in the following claims. And it will be easily understood that it can be changed.

Claims (5)

As an authentication system,
An authentication server that acts on behalf of an online service server, and a mobile authentication app installed on a mobile device and performing an authentication procedure for a connection terminal that accesses the online service server,
The authentication server,
Generate a service authentication code in response to a user's service request to the online service server through the access terminal, and send the service authentication code to the online service server so that the service authentication code can be posted on the service screen. Encrypted service authentication code or encrypted service authentication code related value by performing encryption based on Public Key Infrastructure (PKI) so that transmission to the service server and the user can check the service authentication code through the screen of the mobile authentication app By transmitting to the mobile authentication app, it is possible to determine whether the corresponding service according to the service request of the user is a genuine service provided by the online service server,
The mobile authentication app,
The service authentication code and the service screen posted on the app screen by the user by decrypting the encrypted and received service authentication code or the service authentication code-related value based on the PKI and posting the service authentication code through the app screen. Service authentication can be performed regarding the authenticity of the service through comparison and confirmation of the service authentication code posted on the image, and after the service authentication is completed through the service authentication code check, the user authentication value according to a predetermined condition And transmits the generated user authentication value to the authentication server,
The authentication server,
The authentication value for verification is generated using the same generation condition as in the generation condition of the user authentication value in the mobile authentication app, and the authenticity of the user through comparison between the received user authentication value and the authentication value for verification Perform user authentication for confirmation, and notify the result of performing the user authentication to the online service server,
In the PKI-based encryption process, the authentication server,
The service generated by any one of a public key assigned in advance and a server private key of the authentication server in response to receiving the user's account information transmitted from the access terminal from the online service server, and corresponding to the received user account information Encrypt the authentication code or the service authentication code related value,
In the PKI-based decryption process, the mobile authentication app,
The encrypted received service authentication code or the service authentication code related value is based on the PKI using one of a private key used in correspondence with the user account information and a public key previously allocated in accordance with the authentication server. An authentication system, characterized in that to decrypt.
delete The method of claim 1,
The service authentication through the service authentication code verification is characterized in that the integrated implementation with a fast identity online (FIDO) based authentication method, authentication system.
The method of claim 1,
The authentication server generates the service authentication code according to a pre-designated condition by using the service-related information received from the online service server,
The service-related information is posted together with the service authentication code through the service screen of the online service server and the screen of the mobile authentication app.
The method of claim 4,
The above service-related information,
When the authentication purpose is access authentication, at least one of the web address information of the service server, the access service name, the authentication purpose, and the authentication requester is included,
When the authentication purpose is contract authentication, the authentication system including at least one of a contract name, a contract number, a contractor, a contractee, and a contract body value.

Images