KR20080011362A - Method for hacking protection of gotp - Google Patents

Abstract

A method for protecting a GOTP(Graphic One-Time Password) from hacking is provided to prevent stealth of GOTP authentication through packet sniffering or key logging by applying a pointer matching mode, a screen flickering mode, or a multiple image extracting mode to a GOTP interface. A GOTP authentication request is received and GOTP images are arranged in a screen of a terminal(S320). Points are fixed to the arranged GOTP images by a row unit(S330). A row pointer of the row including a hole key and a private key in the arranged GOTP image, and a path between the row pointers are calculated in the terminal, and the path is inputted through direction buttons of a keyboard or the screen(S340). A user is authenticated by comparing the inputted path with the calculated row pointer path(S350). The row pointer of the row including the hole and private key is replaceable with a line pointer of a line including the hole and private key.

Description

Method for hacking protection of GOTP}

The present invention relates to a method for preventing hacking that may occur in the process of inputting graphic OTP. More specifically, the method for preventing hacking of graphic OTP is provided by applying a pointer matching method, a screen flickering method, or a multiple image extraction method to a GOTP interface. A method for preventing hacking of graphic OTP.

Graphic One time password (GOTP) is one of OTP (One Oime Password), which is implemented in software. It is a way to create and manage passwords safely and conveniently without using them.

Through the graphical interface, the user can obtain a significant improvement in the ease of memory and the validity of the memory and secure the security. However, in actual use, the input value and password are separated and managed by simply inputting by using a direction key and a specific keyboard without being aware of OTP, and are safe from shoulder surfing, phishing and pharming. You can prevent it. In addition, both ease of use and minimization of the burden upon introduction can be achieved.

It is often uncomfortable to be behind someone when using a password key or cash machine attached to the entrance. The reason is that I am concerned about my password being exposed. The person standing behind will also feel uncomfortable. GOTP is a technology that eliminates this inconvenience, that is, technology developed with the goal of allowing users to securely enter their passwords even if they are watching from behind.

In general, the GOTP transmits one or more graphic images to the user terminal, and the user inputs coordinate values through the keyboard to virtually move a predetermined matching image by checking the transmitted images.

In this case, when hooking, phishing, and pharming an image and a keyboard input transmitted to a hacker attempting an illegal hacking, there is a problem of inferring an image set by a user.

That is, the user selects one or more images corresponding to his key and stores one or more images corresponding to the selected images on the server. Subsequently, in the case of performing GOTP for user authentication, the server transmits to the user's terminal an image set in which an additional image different from the image stored by the user is arranged at a predetermined position. Alternatively, the server generates a synchronization code and transmits it to the terminal, and the terminal arranges the images stored in the terminal using an array function corresponding to the synchronization code. The user checks the image set displayed on the terminal and inputs a coordinate shift value for matching the image corresponding to the image selected by the user with the keyboard.

The matched value is transmitted to a program in the terminal or to a server to check whether the coordinate shift value is correct. If the input coordinate shift value is correct, the user is allowed to access.

1 is a screen configuration diagram for a conventional GOTP authentication. Referring to FIG. 1, (a) is a screen displayed on a user terminal to receive an ID and password of a first authentication, and (b) is a private key image of an image group using GOTP, which is a second authentication. This is a screen displayed on the user terminal to receive a coordinate shift value.

The method of inputting the ID and password, which is the first authentication process, is the same as the conventionally known method. In the authentication process using GOTP, which is the second authentication, the path from the user's private key image to the hole image is input as a direction key among the group of images displayed on the user's terminal, and compared with the path calculated by the server or the terminal itself. If the user is allowed to access.

According to an embodiment, the user first sets one hole key and two private keys. During the authentication process, find the private key and the hole key among several randomly arranged images on the screen and press the direction key on the keyboard or the direction button displayed on the screen to move the position from the position of the private key to the position of the hole key. Click to enter. However, even if the direction key is pressed or the direction button is clicked, the image displayed on the screen does not move or display the direction of movement, and only the position movement value that is moved is stored, and the stored coordinate movement value is calculated and authenticated.

However, if you try to steal the code for each image that occurs during GOTP authentication using packet sniffer, key logging to record keyboard input to go to the corresponding image, and to steal the screen displaying the GOTP image. There was a problem that the user can easily infer which image the user selected.

The present invention devised to solve the problems of the prior art as described above, when inputting a path to move from the private key to the hole key of the GOTP image arranged on the screen, without entering all the path, the hole key in the column with the private key To match only the paths to the columns with the suffix method, to process the images on the screen as black blocks at the time the key is entered to prevent screenshot hacking, and to group similar images with different filenames, An object of the present invention is to provide a method for preventing hacking of graphic OOTI, which prevents others from stealing GOTP through hacking by selecting only one similar image of each image group in the GOTP authentication process and arranging it on the screen. have.

The above object of the present invention is to input only the path from the column with the private key to the column with the hole key, without inputting all the paths when entering the path from the private key to the hole key among the GOTP images arranged on the screen. This is achieved by a method for preventing hacking of graphic OTP including a thermal pointer matching method.

In addition, another object of the present invention is to prevent the hacking of the graphic OTP including a screen flickering method of processing the image of the screen as a black block to prevent screenshot hacking to record the screen when the key is input. Is achieved by the method.

In addition, another object of the present invention is achieved by a multi-image extraction method of grouping similar images having different file names, and then selecting only one image of each image group and outputting it to a screen when selecting an image of GOPT.

Therefore, the hacking prevention method of the graphic OTP of the present invention can prevent theft of GOTP authentication through hacking such as packet sniffering or key logging by applying a pointer matching method, a screen flickering method or a multiple image extraction method to the GOTP interface. It works.

The terms or words used in this specification and claims are not to be construed as being limited to their ordinary or dictionary meanings, and the inventors may appropriately define the concept of terms in order to best describe their invention. It should be interpreted as meaning and concept corresponding to the technical idea of the present invention based on the principle that the present invention.

Therefore, the embodiments described in the specification and the drawings shown in the drawings are only the most preferred embodiment of the present invention and do not represent all of the technical idea of the present invention, various modifications that can be replaced at the time of the present application It should be understood that there may be equivalents and variations.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

2 is a conceptual diagram illustrating a method of matching a thermal pointer of the present invention. Referring to FIG. 2, in general, inputting a movement path starting from a private key to a hole key moves in a two-dimensional array, that is, in all four directions of up, down, left, and right, and moves exactly to the position of the hole key. However, the thermal pointer matching method is a two-dimensional array of images displayed on the screen, but the user only needs to move the column where the private key is located to the column where the hole key is located.

By applying the column pointer matching method, the row pointer matching method is also possible. The array of images is more efficient to prevent the leakage of keys if expressed in random matrix such as n × m, n × n. Also, by applying the column pointer matching method, the row pointer matching method or the method of crossing the two methods can be used.

An example of the method of matching the thermal pointers will be described below. Assuming that the user-specified hole key is '@' 210, the private key is '*' 220, and '0' 230, the private key is first. To move from the ⓑ column with '*' 220 to the ⓐ column where the hall key '@' 210 is located, enter the left direction key or the left direction button once. Secondly, to move from the column ⓓ where the private key '0' 230 is located to the column ⓐ where the hall key '*' 210 is located, the left direction key or the left direction button is input three times.

Since the user moves only to the left or the right, the probability of authentication failure due to a mistake can be lowered. On the other hand, since multiple images are arranged in each column, it is difficult to infer the hole key and the private key.

3 is a flowchart showing a pointer matching method of the present invention. Referring to Figure 3, the terminal receiving the GOTP authentication request (S310) arranges the GOTP image on the screen (S320). The method of arranging the GOTP image should transmit the array code from the server to the terminal or arrange it using the random function or the array function in the terminal itself.

In the GOTP image arranged on the screen, a column pointer is designated for each column (S330), and a column pointer of a column to which a hole key and a private key belongs is identified. The terminal or server calculates a path from the column to which the private key belongs to the column to which the hall key belongs (S340) and compares it with the path received through the direction keys of the terminal keyboard or the direction buttons displayed on the screen (S340).

According to the comparison result, if the paths match, user authentication is finished, and if the paths do not match, the path input can be retried (S360). However, if the user gives up authentication or fails three or more times, authentication is automatically terminated.

4 is a conceptual diagram illustrating a screen flickering method of the present invention. Referring to FIG. 3, in the GOTP authentication process, when the path input from the private key to the hall key is finished, the enter key of the keyboard or the input button of the screen should be clicked. According to the recent key logging method, a hacking method for storing the contents of the screen as soon as an enter is input as well as a keyboard input signal has emerged. By repeatedly storing the input signal of the keyboard and the arrangement of the image displayed on the screen three or four times, hackers can easily infer the user's hole key and private key.

Invented screen blinking method to prevent this is the left button of the mouse for clicking the direction button on the screen when the user enters the path from the private key to the hole key to find the hole key and the private key image in the arrangement 410 of the GOTP image Alternatively, as soon as the direction key of the keyboard is pressed, all of the images on the screen are converted into black blocks (420), and when the pressing is terminated, the existing images appear again on the screen. When the hacker sees the saved screen through hacking, the image used in the GOTP authentication process does not appear and all black blocks appear, so the hacker cannot infer the user's hole key and private key.

Since the GOTP authentication process can input two or more private keys, after inputting the first path, the images of the blocked screen can be returned to the image 430 of the changed state when the next input occurs. If a user fails GOTP authentication, they can choose the steps to re-enter GOTP authentication. If the user passes GOTP authentication, the user is allowed access to the server.

5 is a flowchart illustrating a screen flickering method of the present invention. 5, the terminal receiving the GOTP authentication request (S510) arranges the GOTP image on the screen (S520). The method of arranging the GOTP image should transmit the array code from the server to the terminal or arrange it using the random function or the array function in the terminal itself.

The terminal or the server detects the positions of the hole key and the private key in the GOTP image arranged on the screen and calculates a path from the private key to the hole key (S530). When the user receives the path from the column to which the private key belongs to the column to which the hall key belongs (S530), the image arranged on the screen is converted into a black block at the moment the direction key of the terminal keyboard or the direction button on the screen is pressed. In operation S540, the previous image is displayed on the screen again when the pressing is released. The black block does not end once, but every time the direction key or button is pressed until the authentication process is completed.

The terminal or the server compares the input path with the precomputed path (S550), and if the paths match, end user authentication, and if the paths do not match, retry the path input (S560). However, if the user gives up authentication or fails authentication three or more times, it is automatically terminated.

6 is a conceptual diagram illustrating a method of extracting multiple images of the present invention. Referring to FIG. 4, in the multi-image extraction method, a user selects a hall key and a private key among representative images, and an image displayed on the screen during the GOTP authentication process is arranged using an image having a color or form similar to the representative image. will be. Based on the representative image, a plurality of similar images are bundled and stored in one category (610). The image 620 appearing on the screen during the GOTP authentication process is randomly selected from one of the categories and displayed on the screen (620) so that it is judged to be the same or very similar to the representative image when viewed by the user so that the user does not cause confusion. Should be.

Each image displayed on the screen during the GOTP authentication process is a randomly selected image in each category based on the representative image, so each file has a different file name. Thus, when hacking into the GOTP authentication process, the hacker sees a different path each time and a different filename each time. Therefore, no matter how much you steal the GOTP authentication process, the user's hole and private keys cannot be inferred.

7 is a flowchart illustrating a method of extracting multiple images of the present invention. Referring to FIG. 7, a user sets a hall key and a private key among a plurality of representative images in advance in order to perform GOTP authentication (S710). The representative image includes a plurality of similar image categories, and each similar image has a file name that is not related to each other.

When the GOTP authentication request occurs (S720), one image is extracted from the group of similar images instead of the representative image and arranged on the screen (S730). Only one image is extracted from one group. The terminal or the server grasps the positions of the hall key and the private key among the GOTP images arranged on the screen, calculates a path from the private key to the hall key (S740), and compares the path with the user input path (S740).

If the paths match, user authentication is completed, and if the paths do not match, the path input can be retried (S760). However, if the user gives up authentication or fails authentication three or more times, it is automatically terminated.

Although the present invention has been shown and described with reference to the preferred embodiments as described above, it is not limited to the above embodiments and those skilled in the art without departing from the spirit of the present invention. Various changes and modifications will be possible.

1 is a screen configuration diagram for a conventional GOTP authentication,

2 is a conceptual diagram showing a pointer matching method of the present invention;

3 is a flow chart showing a pointer matching method of the present invention;

4 is a conceptual diagram showing a screen flickering method of the present invention;

5 is a flowchart showing a screen flickering method of the present invention;

6 is a conceptual diagram illustrating a multiple image extraction method of the present invention;

7 is a flowchart illustrating a method of extracting multiple images of the present invention.

        <Explanation of symbols for the main parts of the drawings>

          210: hole key 220: private key

          230: private key

Claims (12)

In the authentication process for authenticating a user using GOTP, A first step of receiving a GOTP authentication request; Arranging a GOTP image on a terminal screen; A third step of assigning pointers in units of columns to the GOTP images arranged on the screen; A fourth step of calculating a path between a heat pointer and a heat pointer of a column to which a hole key and a private key belong in the GOTP image arranged on the screen, and receiving a path through a keyboard or a direction button of a screen; And A fifth step of determining whether to authenticate a user by comparing the input path with a path between the thermal pointers calculated in the fourth step; How to prevent hacking of graphic OTP including a. The method of claim 1, And a column pointer of a column to which the hole key and the private key belong, is replaced with a row pointer of the row to which the hole key and the private key belong. The method of claim 1, A method for preventing hacking of graphic OTP to increase the stability of GOTP authentication by repeating the first to third steps two or more times by designating two or more private keys. The method according to claim 1 and 2, The method of preventing hacking of the graphic OTP to use the column pointer and the row pointer simultaneously or sequentially. In the authentication process for authenticating a user using GOTP, A first step of receiving a GOTP authentication request; Arranging a GOTP image on a terminal screen; A third step of calculating, at the terminal or server, a path from the private key to the hall key in the GOTP image arranged on the screen; A fourth step of converting all the images on the screen into black blocks when the direction key of the keyboard or the direction button of the screen is pressed for inputting the path and returning to the previous image when the pressing is canceled; And A fifth step of determining whether the user is authenticated based on the path received through the fourth step How to prevent hacking of graphic OTP including a. The method of claim 5,  Step 6 of converting the black block to the original image and changing the arrangement of the GOTP image again after completing the path input once How to prevent hacking of graphic OTP including a. The method of claim 5 A black block is a way to prevent hacking of graphic tiffies by changing the image file or overwriting the black block over the image. The method of claim 5, A method for preventing hacking of a graphic OTP to increase the stability of GOTP authentication by repeating the third and fourth steps two or more times by designating two or more private keys. In the authentication process for authenticating a user using GOTP, A first step of setting a hall key and a private key among representative images to which a plurality of similar images are dependent; A second step of receiving a GOTP authentication request; A third step of extracting similar images belonging to each representative image from the GOTP images including the hall key and the private key and arranging them on the screen of the terminal; A fourth step of calculating a path from a private key to a hall key in a GOTP image arranged on the screen in a terminal or a server and receiving a path through a keyboard or a direction button of a screen; A fifth step of determining whether to authenticate a user by comparing the input path with the calculated path; How to prevent hacking of graphic OTP including a. The method according to claim 9, A method for preventing hacking of a graphic OTP to increase the stability of GOTP authentication by repeating the fifth and six steps two or more times by designating two or more private keys. The method according to claim 1, 5 or 9, A method for preventing hacking of a graphic OTP, in which a space for inputting an image or text for information transfer is provided in addition to an image arranged on a screen of a terminal. The method according to claim 1, 5 or 9, How to prevent hacking of Gracie Ortipi to retry path input or end authentication if authentication fails.

Images