KR102440879B1 - System and method for complex authentication that combines RFID tags and simple passwords - Google Patents

Abstract

A complex authentication system using an RFID tag and a simple password according to an embodiment of the present invention comprises: an identity verification terminal, which records an employee number, an authentication token, and an authentication password (information encrypted with an authentication hash) encrypted with a pattern as identity confirmation information on an employee ID RFID tag, and verifies the identity of an employee based on the presented employee ID RFID tag and pattern information; a mobile terminal, which when receiving a user authentication request from the identity verification terminal, confirms user authentication based on an employee number, a password, and a unique terminal number transmitted from the identity verification terminal, provides a JWS-based authentication token, and receives, registers and stores the authentication hash value, the employee number, and the unique terminal number used in the encryption process from the identity verification terminal once the user authentication is confirmed (signed), and provides the authentication hash value when requested by the identity verification terminal; and an electronic authentication server which performs certificate verification according to the request of the identity verification terminal. Therefore, the present invention can check the identity of a target person more conveniently.

Description

System and method for complex authentication that combines RFID tags and simple passwords

The present invention relates to a complex authentication system and method using an RFID tag and a simple password.

Conventional techniques related to user authentication have traditionally been self-authentication using an ID and password. However, this traditional authentication method has a problem in that it is difficult to perform a normal authentication function when the ID and password are leaked. To compensate for this, various authentication methods have emerged.

For example, there are mobile phone identity authentication, identity authentication through a public certificate, identity authentication using OTP, Internet Personal Identification Number (i-PIN) authentication, or identity authentication using a credit card.

Although accredited certificate authentication is an authentication protocol with a relatively high security level, it has disadvantages such as difficulty in carrying the accredited certificate stably and the complexity of the authentication process. In addition, the issue of safety has been raised due to an accident in which the public certificate is also leaked in large quantities recently.

The i-PIN is a method of self-authentication using a virtual identification number used on the Internet, and the user must know the new identification number in advance. There are limitations.

In addition, mobile phone user authentication is a method of authenticating the possession of a mobile phone using an authentication number, and there is a problem in that it is vulnerable to smishing.

In addition, since all of these conventional technologies are methods of entering a password (certificate password, I-PIN password) or authentication number, if the password or authentication number is exposed to others, personal authentication is inevitably disabled, and key input methods such as key logging The risk of exposure to hacking is high.

In addition, in the case of self-authentication using OTP, self-authentication can be performed only when the user possesses an OTP client (OTP token), and there are inconveniences such as generation of OTP through the OTP client and the user having to input the generated OTP. ham exists

Therefore, a technical idea capable of providing a high-security identity authentication protocol while maintaining convenience compared to conventional identity authentication technologies is required together with a payment protocol.

In addition, the need for two-channel authentication is increasing as online crimes become more intelligent and occur more frequently as online financial transactions are activated.

In addition, there are cases in which the user allows a predetermined service to another person. Even in this case, the authentication request and the authentication action that a legitimate user must perform for the authentication request to be authenticated can be separated, so that information necessary for authentication is easily exposed to others. A technical idea that can allow the use of the service without having to do so is required.

In addition, in order to use the conventional one-time information (eg, OTP, etc.), the client (eg, OTP token, etc.) and the authentication side (eg, OTP authentication server, etc.) each have the same OTP generation key (or seed), for example , time information) had to be created (or confirmed). In particular, time synchronization between the client and the authentication side is very important in order to generate one-time information through the time synchronization method, which has been widely used recently. For this time synchronization, the client side must be able to check the time. However, according to the technical idea of the present invention, the user device (eg, a smart card, etc.) may not include a timer. Also, even if the user device or the digital system is equipped with a timer, it may be difficult to actually synchronize the timer of the user device and the time with the authentication side (eg, the authentication system).

Laid-Open Patent Publication No. 10-2013-0029983

An object of the present invention is to provide a complex authentication system and method using an RFID tag and a simple password that can solve the problems of the present invention.

The complex authentication system using an RFID tag and a simple password according to an embodiment of the present invention for solving the above problems is an employee number, an authentication token, and an authentication password (with an authentication hash) encrypted with a pattern that is identification information in an RFID tag for an employee ID. an identification terminal that records the encrypted information) and confirms the employee's identity based on the employee ID RFID tag and pattern information presented by the employee; When a user authentication request is received from the identity confirmation terminal, after user authentication is confirmed based on the company number, password, and terminal unique number transmitted from the identity confirmation terminal, a JWS-based authentication token is provided, and the user authentication is confirmed (signed) , a mobile server that receives, registers and stores the authentication hash value, company number, and terminal unique number used in the encryption process from the identification terminal, and provides the authentication hash value when requested by the identification terminal; and an electronic authentication server that performs authentication verification of the electronic certificate in response to the request of the identity verification terminal.

In an embodiment, the identification terminal receives a JWS-based authentication token from the mobile server, and the authentication token is an authentication result authenticated with a private key.

In one embodiment, the identification terminal scans the RFID tag for the employee ID, extracts the employee number, the authentication token, and the authentication password encrypted from the RFID tag, and then decrypts the employee number and the authentication token encrypted with the pattern information. do.

In one embodiment, the identification terminal transmits the decrypted employee number and authentication token to the mobile server, and then requests validation of the authentication token and the registration confirmation of the terminal unique number.

In one embodiment, the identification terminal decrypts the authentication password with the authentication hash value issued from the mobile server, and then performs a login of the user account with the decrypted authentication password, and when the login is completed, the issued It is characterized in that the authentication hash value is returned to the mobile server.

A composite authentication method using an RFID tag and a simple password according to an embodiment of the present invention for solving the above problems includes: registering (recording) identification information in an RFID tag for an employee ID in an employee ID in an identification terminal; and confirming the identity of the employee based on the employee ID RFID tag and pattern information presented by the employee in the identification terminal.

In an embodiment, the step of registering (recording) the identification information includes: receiving an employee number, a password, an electronic authentication password and a pattern from a user (employee) in the identification terminal); requesting user authentication of a subject (employee) while transmitting the input information (employee number, password, terminal unique number) input from the identification terminal to a mobile server; providing a JWS-based authentication token to an identity verification terminal when user authentication is confirmed in the mobile server; receiving authentication confirmation information of the electronic certificate from the electronic authentication server in the identity confirmation terminal; Recording the employee number encrypted as a pattern on the RFID tag for the employee ID on the employee ID, the authentication token and the authentication password encrypted with the authentication hash; transmitting a company number and an authentication hash value from the identification terminal to a mobile server; and storing and registering an employee number and an authentication hash value in the mobile server.

In one embodiment, the step of confirming the identity is after scanning the RFID tag for the employee ID from the identification terminal, extracting the employee number, the authentication token, and the authentication password encrypted in the RFID tag, and then the employee number encrypted with the pattern information, authentication decrypting the token; after transmitting the decrypted employee number and authentication token from the identification terminal to the mobile server 300, requesting validation of the authentication token and confirmation of registration of a unique terminal number; issuing an authentication hash value registered to the identity verification terminal when validity and terminal unique number registration are confirmed in the mobile server; decrypting the authentication password with the authentication hash value issued by the identity verification terminal, and then logging in the user account with the decrypted authentication password; and returning the issued authentication hash value to the mobile server when the login is completed.

Therefore, using the complex authentication system and method using the RFID tag and the simple password according to an embodiment of the present invention, there is an advantage in that the identity of the subject can be more easily confirmed.

This is the conventional first method (eg, input ID and password and log in, compare the ID and password stored in the server to determine whether to authenticate) Inconvenient method to use together) and the second method (a method of verifying account information after verifying identity through personal authentication on the terminal, registering a simple password, and performing authentication while exchanging encrypted data when using a simple password) It has the advantage of having stronger security compared to that.

Therefore, the present invention can enhance security by using a hardware tag together when using a simple password, and by storing encrypted information in the RFID tag when registering the simple password, the RFID tag can be used together when using the simple password, and the RFID tag By storing encrypted data through , it is possible to lower the risk of personal information leakage, and provides the advantage that authentication is impossible without an RFID tag even if someone else knows the simple password.

1 is a network configuration diagram of a complex authentication system using an RFID tag and a simple password according to an embodiment of the present invention.
2 is a flowchart illustrating a complex authentication method using an RFID tag and a simple password according to an embodiment of the present invention.
FIG. 3 is a flowchart of the process S710 shown in FIG. 2 .
FIG. 4 is a flowchart of the process S720 illustrated in FIG. 2 .
5 is an exemplary view of a screen for registering user identification information in the identification terminal.
6 is an exemplary view of a screen for authenticating user identification information in the identification terminal.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily carry out the present invention. However, the present invention may be embodied in several different forms and is not limited to the embodiments described herein. And in order to clearly explain the present invention in the drawings, parts irrelevant to the description are omitted, and similar reference numerals are attached to similar parts throughout the specification.

Throughout the specification, when a part is "connected" with another part, this includes not only the case of being "directly connected" but also the case of being "electrically connected" with another element interposed therebetween. . Also, when a part "includes" a certain component, it means that other components may be further included, rather than excluding other components, unless otherwise stated, and one or more other features However, it is to be understood that the existence or addition of numbers, steps, operations, components, parts, or combinations thereof is not precluded in advance.

The terms "about," "substantially," and the like, to the extent used throughout the specification are used in or close to the numerical values when manufacturing and material tolerances inherent in the stated meaning are presented, and are intended to enhance the understanding of the present invention. To help, precise or absolute figures are used to prevent unfair use by unscrupulous infringers of the stated disclosure. As used throughout the specification of the present invention, the term "step of (to)" or "step of" does not mean "step for".

In this specification, a "part" includes a unit realized by hardware, a unit realized by software, and a unit realized using both. In addition, one unit may be implemented using two or more hardware, and two or more units may be implemented by one hardware. Meanwhile, '~ unit' is not limited to software or hardware, and '~ unit' may be configured to be in an addressable storage medium or may be configured to reproduce one or more processors. Thus, as an example, '~' denotes components such as software components, object-oriented software components, class components, and task components, and processes, functions, properties, and procedures. , subroutines, segments of program code, drivers, firmware, microcode, circuitry, data, databases, data structures, tables, arrays and variables. The functions provided in the components and '~ units' may be combined into a smaller number of components and '~ units' or further separated into additional components and '~ units'. In addition, components and '~ units' may be implemented to play one or more CPUs in a device or secure multimedia card.

In this specification, some of the operations or functions described as being performed by the terminal, apparatus, or device may be performed instead of in a server connected to the terminal, apparatus, or device. Similarly, some of the operations or functions described as being performed by the server may also be performed in a terminal, apparatus, or device connected to the server.

In this specification, some of the operations or functions described as mapping or matching with the terminal means mapping or matching the terminal's unique number or personal identification information, which is the identification data of the terminal. can be interpreted as

Hereinafter, a complex authentication system and method using an RFID tag and a simple password according to an embodiment of the present invention will be described in more detail based on the accompanying drawings.

1 is a device configuration diagram of a complex authentication system using an RFID tag and a simple password according to an embodiment of the present invention.

As shown in FIG. 1 , the complex authentication system 100 using an RFID tag and a simple password according to an embodiment of the present invention includes an identity verification terminal 200 and a complex authentication management server 300 .

Each component performs network communication, and the network refers to a connection structure in which information exchange is possible between each node such as a plurality of terminals and servers. Examples of such networks include RF, 3rd Generation Partnership Project (3GPP) networks, Long Term Evolution (LTE) network, 5th Generation Partnership Project (5GPP) network, World Interoperability for Microwave Access (WIMAX) network, Internet, Local Area Network (LAN), Wireless LAN (Wireless Local Area Network), WAN ( Wide Area Network), PAN (Personal Area Network), Bluetooth (Bluetooth) network, NFC network, satellite broadcasting network, analog broadcasting network, DMB (Digital Multimedia Broadcasting) network, and the like are included, but are not limited thereto.

In the following, the term at least one is defined as a term including the singular and the plural, and even if at least one term does not exist, each component may exist in the singular or plural, and may mean the singular or plural. it will be self-evident In addition, whether each component is provided in singular or plural will be changeable according to the embodiment.

The identification terminal 200 may be a terminal that issues identification information for confirming the identity of the employee (user). In more detail, it may be a terminal that records an employee number, an authentication token, and an authentication password (information encrypted with an authentication hash) encrypted with a pattern that is identification information on an RFID tag for an employee ID.

More specifically, the identification terminal 200 may be a terminal that receives an employee number, a password, an electronic authentication password, and pattern information from an employee (user).

The identification terminal 200 receives an employee number, a password, an electronic authentication password, and a pattern from a user (employee).

The identity verification terminal 200 may be a terminal that requests user authentication of a target (employee) while transmitting the input information (employee number, password, and terminal unique number) to the mobile server 300 .

The identity verification terminal 200 may be a terminal receiving confirmation of whether the electronic certificate is authenticated from the electronic authentication server 400 .

The identity verification terminal 200 may be a terminal that receives a JWS-based authentication token from the mobile server 300 to be described later. Here, the authentication token may be an authentication result authenticated with a private key.

When the identity confirmation terminal 200 receives the authentication confirmation information of the electronic certificate, the employee number, the authentication token, and the authentication password encrypted in a pattern are recorded in the RFID tag for the employee ID of the employee card. The authentication password may be information encrypted with an authentication hash.

Thereafter, the identification terminal 200 transmits the employee number and authentication hash value to the mobile server, and the mobile server 300 stores and registers the employee number and authentication hash value.

In addition, the identification terminal 200 may be configured to confirm the employee's identity based on the employee ID RFID tag and pattern information presented by the employee.

The identification terminal 200 may be configured to scan the RFID tag for an employee ID card, extract the employee number, the authentication token, and the authentication password encrypted from the RFID tag, and then decrypt the employee number and the authentication token encrypted with the pattern information.

The identity verification terminal 200 may be configured to transmit the decrypted employee number and authentication token to the mobile server 300 , and then request validation of the authentication token and registration confirmation of the terminal unique number.

The identity verification terminal 200 decrypts the authentication password with the authentication hash value issued by the mobile server 300, and then performs the user account login with the decrypted authentication password, and when the login is completed, the issued authentication It may be a configuration that returns a time value to the mobile server.

Next, when the mobile server 300 receives a user authentication request from the identity confirmation terminal 200, after confirming the user authentication based on the company number, password, and terminal unique number transmitted from the identity confirmation terminal 200, the JWS-based It may be a server that provides the authentication token to the identification terminal 200 . Here, the authentication token may be an authentication result authenticated with a private key.

When the mobile server 300 confirms the user authentication (sign), the electronic authentication server 400 may be configured to request whether to transmit the authentication confirmation of the electronic certificate to the corresponding identity confirmation terminal 200 .

The mobile server 300 receives and stores the authentication hash value, company number, and terminal unique number used in the encryption process in the identity confirmation terminal 200 from the identity confirmation terminal, and stores the authentication hash in the identity confirmation terminal 200 . It may be a configuration provided when a value is requested.

Next, the electronic authentication server 400 may be configured to perform authentication of the electronic certificate according to the request of the identity confirmation terminal 200 .

2 is a flowchart illustrating a complex authentication method using an RFID tag and a simple password according to an embodiment of the present invention, FIG. 3 is a flowchart of a process S710 shown in FIG. 2, and FIG. 4 is a process S720 shown in FIG. is the flow chart of

Referring to FIG. 2, the complex authentication method (S700) using an RFID tag and a simple password according to an embodiment of the present invention includes an identification information registration (recording) step (S710) and an authentication step (S720).

The step S710 may be a step of registering (recording) identification information in the RFID tag for the employee ID in the employee ID.

More specifically, referring to FIG. 3 , an employee number, a password, an electronic authentication password, and a pattern are received from a user (employee) in the identification terminal 200 . Thereafter, the identity verification terminal 200 transmits the input information (employee number, password, and terminal unique number) to the mobile server 300 and requests user authentication of the subject (employee). When the user authentication is confirmed (signed), the mobile server 300 provides the JWS-based authentication token to the identity confirmation terminal 200 . Here, the authentication token may be an authentication result authenticated with a private key.

After that, when the identity verification terminal 200 receives the authentication confirmation information of the electronic certificate from the electronic authentication server 400, the employee number encrypted with a pattern on the RFID tag for the employee ID on the employee ID, the authentication password encrypted with the authentication token and the authentication hash record

Thereafter, the identification terminal 200 transmits the employee number and authentication hash value to the mobile server, and the mobile server 300 includes a series of processes of storing and registering the employee number and authentication hash value.

Next, the authentication step ( S720 ) may be a step of confirming the identity of the employee based on the RFID tag and pattern information of the employee ID presented by the employee in the identification terminal 200 , referring to FIG. 4 .

More specifically, in the S720 process, after scanning the RFID tag for the employee ID in the identity verification terminal 200, extracting the employee number, the authentication token, and the authentication password encrypted from the RFID tag, the employee number and the authentication token encrypted with the pattern information Decrypt.

Thereafter, the identity verification terminal 200 transmits the decrypted employee number and authentication token to the mobile server 300 , and then requests validation of the authentication token and registration confirmation of the terminal unique number.

When the validity and registration of the terminal unique number are confirmed, the mobile server 300 issues an authentication hash value registered with the identity confirmation terminal 200, and the identity confirmation terminal 200 decrypts the authentication password with the issued authentication hash value. do.

Thereafter, the user account is logged in with the decrypted authentication password, and when the login is completed, the issued authentication hash value is returned to the mobile server.

Therefore, using the complex authentication system and method using the RFID tag and the simple password according to an embodiment of the present invention, there is an advantage in that the identity of the subject can be more easily confirmed.

This is the conventional first method (eg, input ID and password and log in, compare the ID and password stored in the server to determine whether to authenticate) Inconvenient method to use together) and 2nd method (method of verifying account information through personal authentication, etc. on the terminal, registering a simple password, and exchanging encrypted data when using a simple password) It has the advantage of having stronger security compared to

Therefore, the present invention can enhance security by using a hardware tag together when using a simple password, and by storing encrypted information in the RFID tag when registering the simple password, the RFID tag can be used together when using the simple password, and the RFID tag By storing the encrypted data through the system, the risk of personal information leakage can be reduced, and even if someone else knows the simple password, authentication is impossible without the RFID tag.

The device described above may be implemented as a hardware component, a software component, and/or a combination of the hardware component and the software component. For example, devices and components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA). , a Programmable Logic Unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions, may be implemented using one or more general purpose or special purpose computers. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For convenience of understanding, although one processing device is sometimes described as being used, one of ordinary skill in the art will recognize that the processing device includes a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that may include For example, the processing device may include a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as parallel processors.

The software may comprise a computer program, code, instructions, or a combination of one or more thereof, which configures a processing device to operate as desired or is independently or collectively processed You can command the device. The software and/or data may be any kind of machine, component, physical device, virtual equipment, computer storage medium or device, to be interpreted by or to provide instructions or data to the processing device. , or may be permanently or temporarily embody in a transmitted signal wave. The software may be distributed over networked computer systems and stored or executed in a distributed manner. Software and data may be stored in one or more computer-readable recording media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the embodiment, or may be known and available to those skilled in the art of computer software. Examples of the computer-readable recording medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic such as floppy disks. - includes magneto-optical media, and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

As described above, although the embodiments have been described with reference to the limited embodiments and drawings, various modifications and variations are possible by those skilled in the art from the above description. For example, the described techniques are performed in a different order than the described method, and/or the described components of the system, structure, apparatus, circuit, etc. are combined or combined in a different form than the described method, or other components Or substituted or substituted by equivalents may achieve an appropriate result.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

100: Complex authentication system and method using RFID tag and simple password
200: identification terminal
300: mobile server
400: electronic authentication server

Claims (8)

The employee number, authentication token, and authentication password (information encrypted by authentication hash) are recorded on the RFID tag for identification information, which is identification information. identification terminal to confirm;
When a user authentication request is received from the identity confirmation terminal, after user authentication is confirmed based on the company number, password, and terminal unique number transmitted from the identity confirmation terminal, a JWS-based authentication token is provided, and the user authentication is confirmed (signed) , a mobile server that receives, registers and stores the authentication hash value, company number, and terminal unique number used in the encryption process from the identification terminal, and provides the authentication hash value when requested by the identification terminal; and
and an electronic authentication server that performs authentication confirmation of the electronic certificate in response to the request of the identity confirmation terminal,
The identification terminal is
After transmitting the decrypted employee number and authentication token to the mobile server, it requests validation of the authentication token and confirmation of registration of a unique terminal number,
Decrypts the authentication password with the authentication hash value issued by the mobile server, and then performs a login of the user account with the decrypted authentication password, and returns the issued authentication hash value to the mobile server when the login is completed A complex authentication system using RFID tags and simple passwords.
According to claim 1,
The identification terminal is
A complex authentication system using an RFID tag and a simple password, wherein a JWS-based authentication token is provided from the mobile server, and the authentication token is an authentication result authenticated with a private key.
According to claim 1,
The identification terminal is
After scanning the RFID tag for an employee ID, extracting the employee number, authentication token, and authentication password encrypted from the RFID tag, and then using the RFID tag and simple password to decrypt the employee number and authentication token encrypted with pattern information.
delete delete registering (recording) the identification information in the RFID tag for the employee ID in the employee ID in the identification terminal; and
A step of confirming the identity of the employee based on the employee ID RFID tag and pattern information presented by the employee in the identification terminal,
The step of registering (recording) the identification information is
receiving an employee number, a password, an electronic authentication password and a pattern from a user (employee) in the identification terminal;
requesting user authentication of a subject (employee) while transmitting the input information (employee number, password, terminal unique number) input from the identification terminal to a mobile server;
providing a JWS-based authentication token to an identity verification terminal when user authentication is confirmed in the mobile server;
receiving authentication confirmation information of the electronic certificate from the electronic authentication server in the identity confirmation terminal;
Recording the employee number encrypted as a pattern on the RFID tag for the employee ID on the employee ID, the authentication token and the authentication password encrypted with the authentication hash; and
transmitting a company number and an authentication hash value from the identification terminal to a mobile server; and
storing and registering the employee number and the authentication hash value in the mobile server;
The step of verifying the identity is
after scanning the RFID tag for the employee ID by the identification terminal, extracting the employee number, the authentication token, and the authentication password encrypted from the RFID tag, and then decrypting the employee number and the authentication token encrypted with the pattern information;
after transmitting the decrypted employee number and authentication token from the identification terminal to the mobile server 300, requesting validation of the authentication token and confirmation of registration of a unique terminal number;
issuing an authentication hash value registered to the identity verification terminal when validity and terminal unique number registration are confirmed in the mobile server;
decrypting the authentication password with the authentication hash value issued by the identity verification terminal, and then logging in the user account with the decrypted authentication password; and
A complex authentication method using an RFID tag and a simple password, comprising returning the issued authentication hash value to a mobile server when login is complete. delete delete

Images