KR20050112508A - Method and system on internet site authentication using bar code technology - Google Patents

Abstract

The present invention is to improve the reliability of information on the Internet and to prevent logical hacking or personal information fraud in the electronic transaction by proving that the website is a secure site without forgery from the user's point of view.

Recently, fake sites made by fake sites such as public institutions and financial institutions have created fake sites, and e-mails linked to those fake sites are sent to users who impersonate trusted sites (institutions) or posted on portal sites to fake sites. Phishing, which has been used to lurk fake information or allow users to provide personal information, has become a frequent occurrence.

These fake sites are elaborately deceived by using pseudo-domain names or by deceiving domain names unless the user pays close attention.

In the case of an Internet site, the user is authenticated using an account name, password, or certificate to verify that the user is a legitimate user. However, there is no means for authenticating whether the site to be visited by the user is a real site.

As a result, many Internet users can be deceived by fake Internet sites without the technical means of identifying fake sites, which can lead to misinformation. In addition, Internet users can leak sensitive information such as account names, passwords, and credit card numbers to fake sites. Attackers use this information in various criminal acts such as fraud, which is a social problem.

If left unchecked, the credibility of the Internet itself can be severely affected by the use of the Internet and e-commerce.

The present invention by applying the bar code technology to strengthen the authentication of the user side for reliable sites such as public institutions, financial institutions to enhance the reliability of information on the Internet and provide personal information that is leaked to unintended sites It aims to prevent fraud on the Internet such as phishing.

Description

Method for strengthening Internet site authentication using bar code technology and its system {Method and System on Internet Site Authentication Using Bar Code Technology}

With the recent rapid development and spread of information systems and the Internet, the value of information assets is increasing day by day, and there are various attempts to protect them. Technically, technologies for diagnosing or removing vulnerabilities of various threats such as hacking, viruses, worms, and trojans have been developed. This includes firewalls, antivirus programs, and intrusion detection systems.

The firewall aims to analyze network traffic and only allow traffic that meets the established ruleset. The ruleset is generally set based on the IP address and the port number. It does not search the data itself. Therefore, installing a firewall does not prevent phishing.

Antivirus programs aim to remove programs for malicious purposes (system destruction, data deletion, system performance degradation, etc.). Phishing is not a program, so installing an antivirus program on your PC does not prevent phishing, such as visiting fake sites.

Intrusion detection system analyzes network traffic and detects hacking using known hacking pattern and informs system administrator. Therefore, even if the intrusion detection system is installed, it does not prevent phishing to transmit information desired by the user.

Keyboard encryption program prevents the leakage of information from malicious programs such as logging programs that may be installed on the PC by encrypting from the user inputting from the keyboard of the PC. Therefore, even if a keyboard encryption program is installed, phishing and the like cannot be prevented.

These technologies and solutions effectively protect information assets from various hacking attempts and information leakage attempts. Nevertheless, as seen in the recent Internet banking, the leakage of personal information using phishing and Internet fraud are frequent. Such fraud is to provide the user with the information in the user's memory, and there is a limit to preventing the existing security products.

Most Internet users don't remember IP addresses for many sites on the Internet, but they do remember domain names. Domain names are also likely to be recognized as the same site if they are similar. For example, if a site similar to www.korea.com etc. www.korea.or.kr, www.nophishing.org, www.k0rea.or.kr, www.corea.com used by phishers careless and closely domain name Can be recognized as the same site. In particular, when a user sends an e-mail linked to such a similar site, or links to an Internet bulletin board, the user can easily mistake the site.

In the above cases, it can be said that people who use the Internet neglect to authenticate the site, but the technique of creating a fake site is becoming more sophisticated, making it difficult for the user to judge by the naked eye. As a result, Internet users can question the credibility of the Internet itself, which can adversely affect the economy by shrinking e-commerce.

Therefore, the present invention enhances the reliability of the Internet and e-commerce by blocking the negative effects of the Internet such as phishing by enabling users to identify fake sites by strengthening authentication on the user side of legitimate sites as mentioned above. For the purpose of

1) Generate hash value for web page of internet site

The hash value is obtained by using the hash algorithm for the Internet domain name, the directory where the web page is located, and the web page name (URI). In this case, a hash using only a URI may be exploited by a third party, so that a hash value may be obtained by applying a hash algorithm including a key value known only to the authentication site. Can be, but is not limited to.

2) Convert Hash Value to Barcode

The barcode is an optically readable encoding of alphanumeric or special symbols by a combination of thick or thin bars (black bars) and spaces (white bars). This enables expression of information, collection and decryption of information. A sequence of black bars and white spaces representing letters or numbers is arranged to convert the bars and spaces into bits of binary zeros and ones, which are then combined and used as information, which is governed by the rules defined by the bar code language called symbology. Is made. In other words, a bar code is a language composed of bits of 0 and 1, which are the basics of computer internal logic, and there are various types of code systems depending on the ratio of bar thickness and space width. The printed code reproduces the data by reflecting light to the barcode recognition device, and collects and transmits the reproduced data.

To decode the information in the bar code, small light spots that reflect the changing values reflect through the bar and space through the scanner. The black bar, the black bar part of the barcode, reflects a small amount of light into the scanner, and the white space bar in the middle of the black bar reflects a lot of light. The difference in the amount of reflected light is translated into an electrical signal by a light detector in the scanner, which is then converted into binary zeros and ones, which are used in various combinations to represent specific letters and numbers. The letters and numbers are read using the combination of 0s and 1s.

There are various types of barcode readers, such as a ball-type pen and a contact type, a CCD type that is a contact scene, and a laser type that is recognized as a laser beam. Any of the data is converted into a form that can be collected by a computer or a barcode by a translator circuit or a decoder program called a decoder, and then the data is transmitted to the host computer.

Many programs are already available in the form of libraries that allow computers to recognize barcodes used offline. Therefore, it is not technically difficult to convert a hash value to a barcode using this. In addition, it will be said that it does not matter what type of barcode is used, such as one-dimensional barcode and two-dimensional barcode.

Create a picture file to attach the generated barcode to a web page. Picture files can be created in various forms, including bitmap files.

3) Attach the generated barcode to the web page

Attach the barcode created above to the web page.

4) Recognition of barcodes attached to web pages

When Internet users surf the Internet, they develop a program (hereinafter referred to as a "site authentication program") that identifies and verifies whether a site has a barcode. As shown in the diagram of Representation, it is not technically difficult to identify the existence of a barcode by searching a specific string through HTML parsing, and a program for HTML parsing is already available.

5) Comparison of URLs and Barcodes

The site verification program installed on the PC reads the barcode value attached to the web page, hashes it using the same algorithm that generated the barcode using the website, subdirectory and web page name entered in the URL window, and compares and matches it The Internet user may visually confirm whether the site is authenticated by checking the existence of a barcode.

Here, website name, subdirectory and web page name are not difficult to implement technically if using URL hooking technology, and the program using them is open enough to be easily obtained through internet.

If a similar URL is used to deceive the user and a bar code of the original site is attached to the fake site, the site authentication program can recognize the warning and warn the user, so that the fake site can be eliminated.

Due to the above invention, when an individual surfs the Internet, it is easy to visually check whether the site is an authorized site, and thus, it is possible to prevent damage by transmitting important information such as personal information and financial information to a fake site. .

[Representative diagram]

 A diagram explaining how an authentication program installed on an Internet user's PC identifies real and fake sites

[Figure 1]

Drawing showing the general process of phishing

[Figure 2]

A logical flow diagram that visually identifies, using a barcode, a fake site that mimics a real site

[Figure 3]

A diagram showing the process of converting to an authentication site by generating a barcode using a hash algorithm and attaching it to a web page.

Claims (3)

As described in 200 above, a method of obtaining a hash value by combining a URI and a key value known only to an authenticated site By using a hash value obtained in claim 1 above to generate a bar code attached to the web page to make it easy for Internet users to identify whether the site is visually authenticated As described in 201 above, a method of comparing a value obtained by identifying a barcode with a value obtained by hashing a URI is used to compare whether it is an authentication site.