KR20150053701A - System and method for authentication - Google Patents

Abstract

The present invention relates to a system and a method for authentication. The method for authentication according to the present invention, which is conducted by an authentication server communicating with a user terminal, comprises the steps of: receiving a request for entry including group-identifying data including a group code and information for identifying the group from the user terminal; if the group code and the information included in the group-identifying data are determined to correspond to each other, successfully processing a group authentication procedure with respect to the user terminal; issuing a member session key to the user terminal; and providing a service requested by the user terminal in response to a request for the service including the member session key from the user terminal. According to the present invention, the information exposure of service users can be prevented.

Description

[0001] SYSTEM AND METHOD FOR AUTHENTICATION [0002]

The present invention relates to an authentication system and an authentication method, and more particularly, to an authentication system and an authentication method that enable authentication and service use without recording information that can identify a service user.

Recently, various online services have been rapidly used due to the rapid development of network technology and the spread of mobile terminals.

As the online service utilization soars, the service providers providing the respective services are not able to collect and manage the personal information indiscriminately.

For example, in Korean Patent Laid-Open No. 10-2009-0056324, when a user registers personal information on one online site, a method of providing the user's personal information to other online sites is described.

As described above, in the conventional authentication methods, when acquiring personal information of service users and performing authentication using the personal information, there is a lack of consideration of exposure of the users' identity or other personal information to a third party due to leakage of personal information .

Especially, in the services requiring special security so that the identity of the service users is not exposed, there is a problem that the identity of the users can be exposed due to the negligence of the service providers.

Accordingly, it is an object of the present invention to provide an authentication system and method that can prevent identity exposures of service users.

It is another object of the present invention to provide an authentication system and method for preventing the identity of a service user from being exposed even by a hacking of a service provider's terminal or a server side, an information management difficulty, or an administrator's dishonest act.

It is still another object of the present invention to provide an authentication system and method for storing information provided by a service user in a subscription and authentication process in a non-decodable form on a server side of a service provider.

It is still another object of the present invention to provide an authentication system and method that are implemented to identify individual users and enable service use even when only a minimum amount of information is provided from a service user.

Yet another object of the present invention is to provide an authentication system and method that are implemented in such a manner that the identity of a publisher is not exposed by subscribing to a service through e-mail authentication and separating information used at the time of subscribing and information necessary for actual service use .

Yet another object of the present invention is to provide an authentication system and method for allowing only one activated service utilization account to exist for one email address for stable operation of the service.

As a technical means for achieving the above technical object, a method according to an embodiment of the present invention is performed by an authentication server communicating with a user terminal, and includes a group code and information capable of identifying the group Receiving a subscription request including group identification data including the group identification data; Performing a group authentication procedure for the user terminal and successively processing the group authentication procedure if it is determined that the group code and the information included in the group identification data correspond to each other; Issuing a member session key to the user terminal; And providing a service requested by the user terminal in response to a service request including the member session key from the user terminal.

A method according to an exemplary embodiment of the present invention is performed by a user terminal communicating with an authentication server via a network and includes a group code and a user interface for inputting group identification data including information for identifying the group Receiving the group code and the group identification data and transmitting the registration request including the group code and the group identification data to the authentication server; Encrypts the group identification data by using the password, and transmits the encrypted password and the encrypted group identification data to the authentication server Transmitting to the server; Receiving the member session key from the authentication server, storing the member session key, transmitting a service request to the authentication server including the member session key, and receiving a service provided by the authentication server .

According to an embodiment of the present invention having the above configuration, an authentication system and method that can prevent identity exposures of service users can be provided.

Further, according to the embodiment of the present invention, the identity of the service user can be prevented from being exposed even by hacking of the terminal of the service provider or server side, information management difficulty, or cheating of the administrator.

According to an embodiment of the present invention, it is possible that a service user does not store the information provided in the subscription and authentication process on the server side of the service provider.

Furthermore, according to an embodiment of the present invention, even if only a minimum amount of information is provided from a service user, individual users can be identified and services can be used.

According to an embodiment of the present invention, there is an advantage in that the identity of a publisher is not exposed by subscribing to a service through e-mail authentication and separating information used at the time of subscribing and information necessary for actual service use.

Also, according to an embodiment of the present invention, only one activated service utilization account exists for one e-mail address, so that the service can be stably maintained.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a perspective view showing a configuration of an authentication system according to an embodiment of the present invention; FIG.
2 is a block diagram illustrating a functional configuration of a user terminal included in an authentication system according to an embodiment of the present invention.
3 is a block diagram illustrating a functional configuration of an authentication server included in an authentication system according to an embodiment of the present invention.
FIG. 4 is a flowchart illustrating a process of sending an e-mail for group authentication according to a subscription request of a user in an authentication method according to an embodiment of the present invention.
5 is a flowchart illustrating a process of receiving an e-mail authentication code necessary for group authentication using e-mail in an authentication method according to an embodiment of the present invention.
6 is a flowchart illustrating a step of performing group authentication using an e-mail authentication code in an authentication method according to an embodiment of the present invention.
FIG. 7 is a flowchart illustrating a step of performing a member authentication for issuing a session key to a user terminal in an authentication method according to an embodiment of the present invention.
FIG. 8 is a flowchart illustrating the steps performed after executing an application installed in a user terminal in a time-series manner in the authentication method according to the embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, which will be readily apparent to those skilled in the art. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

Throughout the specification, when a part is referred to as being "connected" to another part, it includes not only "directly connected" but also "electrically connected" with another part in between . Also, when an element is referred to as "comprising ", it means that it can include other elements as well, without departing from the other elements unless specifically stated otherwise.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

2 is a block diagram illustrating a functional configuration of a user terminal included in an authentication system according to an embodiment of the present invention. FIG. 2 is a block diagram illustrating a functional configuration of a user terminal included in an authentication system according to an embodiment of the present invention. 3 is a block diagram illustrating a functional configuration of an authentication server included in an authentication system according to an embodiment of the present invention.

As shown in FIG. 1, an authentication system according to an embodiment of the present invention includes a user terminal 10 and an authentication server 30 connected through a network N. As shown in FIG. In addition, the e-mail authentication terminal 20 may further include an e-mail authentication terminal 20, wherein the e-mail authentication terminal 20 may be one terminal physically identical to the user terminal 10 or may be a separate terminal.

Here, the network N may be a local area network (LAN), a wide area network (WAN), a value added network (VAN), a personal area network (PAN) a mobile radio communication network or a satellite communication network.

The user terminal 10 and the e-mail authentication terminal 20 may be implemented as a portable terminal connected to a remote terminal through a network N, which can be connected to other terminals and servers. For example, a portable terminal is a wireless communication device that is guaranteed to be portable and mobility. The portable terminal includes a PCS (Personal Communication System), a GSM (Global System for Mobile communications), a PDC (Personal Digital Cellular), a PHS Personal Digital Assistant), IMT (International Mobile Telecommunication) -2000, CDMA (Code Division Multiple Access) -2000, W-CDMA (W-CDMA), Wibro (Wireless Broadband Internet) , A tablet computer, and the like, for example. At this time, the user terminal 10 is a terminal used by a user of an online service provided by an operator of the authentication server 30, and the e-mail authentication terminal 20 is a terminal that receives an authentication e-mail sent by the authentication server 30, Both of them are classified according to roles, and they may be the same terminal or different terminals as described above.

The user terminal 10 may be provided with an application for communicating with the authentication server 30 and providing an online service provided by the operator of the authentication server 30 and the authentication server 30 A web browser or a separate e-mail application is installed to receive and display the sent authentication e-mail through an e-mail server (not shown) or to create an authentication e-mail sent from the e-mail authentication terminal 20 to the authentication server 30 . In describing the embodiment of the present invention, the meaning indicated by the expression 'authentication e-mail' will be described later.

Meanwhile, the authentication server 30 communicates with the plurality of user terminals 10 via the network N to provide an online service, and the user terminal 10 authenticates each user terminal 10 through the user authentication procedure of each user terminal 10 And provides a service suitable for the identified user terminal 10. [

At this time, the service provided by the authentication server 30 is not limited to a specific service. However, for example, it may be a service in which a plurality of users register and share posts, such as an online bulletin board service or an online community service. In particular, in the embodiment of the present invention, the authentication server 30 can receive a selection or input from a user of a group to which each user belongs, authenticate that the user is a member of the group, To provide posts related to the organization or to join the community of the organization.

Hereinafter, the configurations of the user terminal 10 and the authentication server 30 will be described in detail. Prior to that, however, the terms used to describe them are defined first.

First, 'organizations' are various organizations to which individuals can belong. For example, all groups formed by individuals can be included in the group to achieve the same purpose such as company, school, social gathering. That is, the above-mentioned 'group' may include all groups that can be grouped by conceptual or socially, voluntary, or other.

In addition, 'group authentication' is used as a term to refer to an authentication procedure using data (including 'group identification data') including information capable of identifying an e-mail or other group, And a process of authenticating whether or not it is authentic.

In the embodiment of the present invention, the group authentication can be performed through e-mail. To this end, the authentication server 30 stores a group code for identifying each group and a format of the e-mail address corresponding to each group code . Here, the format of the e-mail address can be set as a character string of a host address portion excluding a portion for identifying a user in a general e-mail address.

For example, if the email address of the student 'Kim Min Ho' at 'Seoul National University' is 'kmh@snu.ac.kr' and the host address of the email service hosted by Seoul National University is 'snu.ac.kr' The server 30 stores the part after the '@' of the e-mail address 'kmh@snu.ac.kr' input from 'Kim Minho' and the part 'snu.ac.kr' of the host address part of the e-mail service provided by Seoul National University By confirming the match, group authentication can be performed.

Further, in the group authentication, in order to confirm that the e-mail address inputted by the user is an e-mail address actually used by the user, the authentication server 30 sends an authentication e-mail (hereinafter referred to as "authentication e-mail") to the e-mail address input by the user And authenticate whether or not the user has confirmed the authentication e-mail.

That is, for example, an authentication e-mail can be transmitted to the e-mail address 'kmh@snu.ac.kr' inputted by 'Min-ho Kim', and it can be authenticated whether or not the e-mail is confirmed within a predetermined time.

Here, various methods for detecting whether or not the user has confirmed the authentication e-mail can be used. For example, if the authentication link is selected in the e-mail authentication terminal 20 having received the authentication e-mail after transmitting the authentication e-mail sent by the authentication server 30 including an 'authentication link' . This will be described in more detail below.

As another example, the 'authentication string' may be included in the authentication email sent by the authentication server 30 so that the user can confirm the 'authentication string' included in the authentication email through the email authentication terminal 20 , And if the user who confirmed it correctly inputs the 'authentication string' through the user terminal 10 within a predetermined time, it may detect that the authentication e-mail has been confirmed by the user.

The group authentication method, which is performed by sending the authentication link including the authentication link or the character string for authentication to the group e-mail address received from the user by the authentication server 30, is referred to as the first embodiment.

As another group authentication method, in the second embodiment, when a user inputs an e-mail address for group authentication, the authentication server 30 determines whether the e-mail address input by the user corresponds to an e-mail address format The e-mail address of the operator side can be provided to the user so that the user can forward the authentication e-mail to the authentication server 30 manager, i.e., the service operator side. At this time, according to the embodiment, the user can selectively provide 'authentication keyword' to be recorded in the authentication e-mail. Then, when an authentication e-mail (including a keyword for authentication) is transmitted to the operator of the authentication server 30 using the same group e-mail address as the e-mail address inputted by the user, the e-mail address The authentication process can be completed. At this time, the authentication server 30 may compare the authentication keyword provided to the user with the authentication keyword included in the received e-mail, and may perform the group authentication success process only if they coincide with each other. At this time, in order to successfully process the group authentication, it is possible to check whether the IP address of the mail server that has sent the authentication email received from the user is normal. The sender of the received authentication email, the recipient, (E-mail address) provided to the user, and the authentication keyword provided to the user. Of course, in the second embodiment described above, the authentication server 30 may provide only the e-mail address of the operator to the user who intends to enter the collective e-mail address to proceed with the registration procedure, and may not provide the authentication keyword. In this case, the user may succeed in group authentication by sending an authentication e-mail having the e-mail address of the operator side as the receiver using his or her group e-mail address.

Furthermore, according to the third embodiment of the group authentication, in the present invention, group authentication may be performed using information other than the e-mail address. For example, the authentication server 30 may previously store identifier information such as a unique IP address or an SSID of a wireless LAN access point used by each group in advance for each group. In addition, the offline address information of each organization can be stored in advance.

Then, the authentication server 30 receives the identifier information of the wireless LAN access point accessed by the user terminal 10 from the user terminal 10 of the user who intends to subscribe to the service as a member of the specific group, May be compared with a wireless LAN access point identifier and an offline address of a previously stored group to authenticate whether or not the corresponding user actually belongs to the group.

The 'member authentication' means a process of giving a unique key (hereinafter referred to as 'session key') to the user terminal 10 that has been subjected to the group authentication as described above to grant the service connection of the user terminal 10 .

In one embodiment of the present invention, the authentication server 30 receives the password from the user of the user terminal 10 that has been group-authenticated, encrypts the information related to the user or the user terminal 10 and registers the information in the server, And performs the process of assigning a unique session key to each terminal 10, thereby completing the member authentication.

The functional configuration of the user terminal 10 according to the embodiment of the present invention will be described below with reference to the above-defined terms.

As shown in FIG. 2, the user terminal 10 includes a subscription requesting unit 11. As described above, the subscription requesting unit 11 can select a group to which the user belongs and request the authentication server 30 to subscribe to the online service for the group by the user who has executed the application installed in the user terminal 10 User interface.

The subscription requesting unit 11 may first let the user enter a group name or select any one of a plurality of group names already stored. Also, when the user inputs a group name, the user can select a group to which the user belongs by searching for and displaying the group name stored in advance corresponding to the string of the inputted group name. At this time, each group selected by the user may be matched with a group code for identifying the group. The subscription request unit 11, in transmitting the information about the group selected by the user to the authentication server 30, .

Also, as described above, the subscription request unit 11 may receive an email address from a user as a character string, and may transmit the email address to the authentication server 30 together with the group code.

Accordingly, the authentication server 30 can perform group authentication using the group code and the e-mail address thus transmitted. Of course, as described above, the subscription requester 11 can transmit the identifier of the wireless LAN access point and the current location information to the authentication server 30 according to the embodiment.

Meanwhile, the user terminal 10 may include an authentication key management unit 12. The 'authentication key' managed by the authentication key management unit 12 is received from the authentication server 30. When the subscription request unit 11 provides the group code and the e-mail address to the authentication server 30 as described above, the authentication server 30 confirms whether the received information corresponds to the e-mail address format of the selected group code, You can send an authentication email to a received email address. At this time, the authentication server 30 can notify the user terminal 10 of the fact of sending the authentication e-mail and can simultaneously provide the 'authentication key' to the user terminal 10. Here, the authentication key is a unique random number key newly generated each time authentication e-mail is sent.

Hereinafter, the notification of the fact that the authentication server 30 transmits the authentication e-mail to the user terminal 10 will be referred to as " authentication e-mail sending notification ".

Accordingly, the authentication key management unit 12 can store the authentication key received together with receiving the authentication email sending notification. When the authentication key management unit 12 is informed that confirmation of the authentication e-mail is completed later, the authentication key management unit 12 provides the stored authentication key to the authentication request unit 13 to be described later. Hereinafter, an authentication key received together with the authentication email forwarding notification and stored by the authentication key management unit 12 will be referred to as a 'first authentication key' hereinafter.

The authentication server 30 receives the e-mail address from the user terminal 10 and confirms that the received e-mail address is in the format corresponding to the group selected by the user, The authentication key management unit 12 may generate an authentication key and send it to the user terminal 10 when the authentication key is selectively provided to the user terminal 10 according to the e-mail address of the operator to send the authentication key, Can store it. That is, in this embodiment, the authentication key may be a unique random number key that is newly generated each time a user receives an authentication e-mail address (an e-mail address of an operator) and an authentication keyword.

As a third embodiment of the group authentication, when the subscription request unit 11 of the user terminal 10 transmits the identifier and the current location information of the wireless LAN access point and the group code to the authentication server 30, 30 can compare the received information with the information registered in advance for the group corresponding to the received group code and send the authentication key to the user terminal 10. [ The authentication key management unit 12 can store the authentication key received from the authentication server 30. [ At this time, the authentication key may be a unique random number key that is newly generated when the information received from the user is compared with the information of the organization stored in the authentication server 30, and is provided to the user terminal 10. [

Meanwhile, the user terminal 10 according to the embodiment of the present invention includes an authentication request unit 13. The authentication request unit 13 requests the authentication server 30 to final authentication for completing the group authentication so that member authentication can be performed.

The authentication server 30 notifies the user terminal 10 of the confirmation of the authentication e-mail, and again transmits the authentication key that was transmitted together when providing the authentication e-mail sending notification to the user terminal 10. [

Hereinafter, the notification that the authentication server 30 transmits the authentication e-mail to the user terminal 10 is referred to as an " authentication e-mail confirmation notification " Key is referred to as a " second authentication key ". At this time, the 'authentication e-mail confirmation notification' is a notification which is generated when the authentication server 30 has confirmed that the authentication e-mail has been browsed by the user when the authentication server 30 has sent the authentication e-mail according to the first embodiment of the present invention. (The request including the URL information corresponding to the authentication link is received by the authentication server 30), or the authentication string included in the authentication email is transmitted to the user terminal 10 via the user terminal 10 It can be done by confirming whether or not it has been transmitted to the authentication server 30 as described above.

Therefore, the authentication request unit 13 compares the second authentication key received together with the authentication e-mail confirmation completion notification with the first authentication key received together with the authentication e-mail sending notification and stored by the authentication key managing unit 12 , And confirms whether or not they match. Then, the authentication request unit 13 can confirm the success or failure of the group authentication by transmitting the authentication key and the e-mail address, which are identical to each other, to the authentication server 30 only when they match each other.

Of course, depending on the embodiment, according to the embodiment, the authentication key is not included in the authentication email sending notification, the authentication key is included only in the authentication email confirmation notification, and the authentication request unit 13 includes the authentication key in the authentication email confirmation notification The authentication server 30 may inquire about the success or failure of the group authentication using only the authentication key. The authentication key is not included in the authentication e-mail confirmation notification, and when the authentication request unit 13 receives the authentication e-mail confirmation notification, the authentication key included in the authentication e-mail sending notification is notified To the authentication server 30 so as to inquire about the success or failure of the group authentication corresponding to the authentication key.

On the other hand, in the second embodiment of the group authentication, the authentication server 30 notifies the user terminal 10 of the operator's side e-mail address (which may optionally include the authentication keyword) (Hereinafter referred to as " authentication e-mail address notification "), together with a first authentication key.

When the authentication server 30 confirms the authentication e-mail when the user confirms the authentication e-mail address notification and then sends the authentication e-mail (including the authentication keyword in the body text) to the corresponding e-mail address, ) To send the authentication e-mail confirmation notification again and send the second authentication key together.

In the second embodiment, the first authentication key and the second authentication key are not necessarily distinguished from each other, but the authentication key can be included in at least one of the two notifications sequentially generated.

On the other hand, in the third embodiment of the group authentication, when the authentication server 30 receives the identifier of the wireless LAN access point and the current location information together with the group code from the user terminal 10, The authentication server 30 determines whether the identifier of the received wireless LAN access point or the current location information corresponds to the user selected by the user, The user can be notified whether or not the user has made a request. Then, the user can perform the member authentication procedure using the authentication key included in the notification. That is, in the third embodiment, the authentication request unit 13 uses the authentication key included in the notification received from the authentication server 30 to confirm with the authentication server 30 whether or not the final group authentication has succeeded, Member authentication procedures can be performed.

Furthermore, the user terminal 10 according to the embodiment of the present invention may include a member information setting unit 14. [ The member information setting unit 14 receives the password from the user and can provide the authentication server 30 with information related to the user including the password.

At this time, the encryption unit 15 encrypts the input password and the e-mail address, so that the information about the user stored in the authentication server 30 is registered in an encrypted state, thereby completing the member authentication procedure.

The membership information setting unit 14 sets the membership information to the user terminal 10 as a response to the confirmation from the authentication server 30 to the authentication server 30 of the authentication request unit 13, When the authentication success response is received, a user interface for receiving a password from the user is provided. Of course, 'password' can be a simple numeric sequence of numbers, or it can contain other strings. Further, it is obvious that it may be constituted by a pattern having a specific trajectory.

The encryption unit 15 can encrypt the email address received by the subscription request unit 11 using the entered password. Also, the encryption unit 15 can encrypt the input password itself. Accordingly, the member information setting unit 14 can provide the encrypted e-mail address and the encrypted password to the authentication server 30. At this time, the e-mail address can be encrypted by the encrypted password first.

Furthermore, at this time, the member information setting unit 14 can transmit the previously received group code and the authentication key together with the encrypted e-mail address and the encrypted password to the authentication server 30.

Also, the member information setting unit 14 may receive a 'nickname' to be set by the user when receiving the password. Here, the nickname may be set to a specific character string. After the nickname is inputted by the member information setting unit 14, the authentication server 30 confirms whether the nickname is duplicated, and the nickname can be set so that the users do not overlap with each other . At this time, the member information setting unit 14 may transmit the nickname finalized by the user together with the encrypted password to the authentication server 30, so that the individual nicknames of the users can be registered in the authentication server 30.

On the other hand, as described above, the member information setting unit 14 provides the encrypted email address, the encrypted password, and other additional information to the authentication server 30, so that the authentication server 30 stores the encrypted information, After confirming the overlapping of the e-mail address, the session key is issued to the user terminal 10.

Meanwhile, the user terminal 10 according to an embodiment of the present invention stores and updates the session key issued from the authentication server 30 and transmits the session key together with the authentication server 30 To the authentication server 30, thereby allowing the authentication server 30 to identify the user terminal 10 and provide the service accordingly.

The user terminal 10 according to the embodiment of the present invention may also be connected to the authentication server 30 or another server operated by the operator of the authentication server 30 or the authentication API 30 provided by the operator of the authentication server 30 A post display unit 17 for requesting a post to a third party server using an application programming interface (OS), and receiving and displaying the requested post. The session maintaining unit 16 reads the session key stored in the session maintaining unit 16 and receives a session key identical to the session key issued from the authentication server 30 or the authentication server 30 to the user terminal 10, To another server or a third party server operated by the operator of the server 30 together.

Further, the user terminal 10 according to the embodiment of the present invention may receive a new post from the user and send it to the authentication server 30 or another server operated by the operator of the authentication server 30 or the authentication server 30, To the third party server using the authentication API provided by the administrator of the server 11, and registers the post.

The session maintaining unit 16 reads out the stored session key and receives the same session key as the session key issued from the authentication server 30 or the authentication server 30 to the user terminal 10, ) To another server or a third party server operated by the same operator.

Hereinafter, the functional configuration of the authentication server 30 that communicates with the user terminal 10 according to an embodiment of the present invention to perform the group authentication and the member authentication will be described in more detail. 3 illustrates the configuration of the authentication server 30 according to the first embodiment described above with reference to FIG. 3. FIG. 3 illustrates a configuration of the authentication server 30, which will be described later, 32 may be configured to include the e-mail sending unit 32a and the e-mail authenticating unit 32b. However, according to another embodiment, the group authentication unit 32 may be configured differently, and this will be described together.

The authentication server 30 may first include a subscription request receiving unit 31. [ When the subscription request is received from the user terminal 10, the subscription request receiving unit 31 receives and records the group code and the email address received by the subscription request unit 11 of the user terminal 10 together with the subscription request.

At this time, the subscription request receiving unit 31 may associate and store the received group code and the email address as one account.

Here, the information received by the subscription request receiving unit 31 may be recorded in the 'subscription table'.

The 'subscription table' is a table for receiving and storing the group code and the e-mail address received from the user terminal 10 together with the subscription request from the user terminal 10 and includes a subscription procedure including the group authentication and the member authentication procedure It is used during execution. The data written in the joining table is deleted after completing the joining procedure for the user terminal 10 and granting the session key to the user terminal 10. [

The types of data to be written in the subscription table are as follows.

Joining table Field name Explanation Group code The identification code of the organization you selected Email Address Plain email address entered by the user Authentication key A random number key to be transmitted to the user terminal Email verification code Random number code to be included in email authentication link (string for authentication) Push identifier The identification information of the application installed in the user terminal Group authentication success field Information on whether the field group authentication was successful

Here, the group code and the e-mail address are received from the user terminal 10 by the subscription request receiving unit 31 as described above. After receiving the subscription request from the user terminal 10, the subscription request receiving unit 31 can generate the authentication key and the e-mail authentication code in the subscription table.

The information recorded in such a joining table may be deleted after a predetermined period of time unless the user takes any action on the authentication e-mail within a certain period of time after sending the authentication e-mail.

At this time, the push identifier may be a push server (for example, a GCM of Android or the like), such as a Registered ID of an Android operating system, or a Device Token of an iOS, iOS < / RTI > APNS). Such device identification information may be provided for each application installed in each user terminal 10 and receiving a push notification to identify the application installed in each user terminal 10. [

Finally, the 'group authentication success field' will be described later.

Therefore, the subscription request receiving unit 31 temporarily stores the push identifier of the user terminal 10 requesting subscription in the above-mentioned subscription table, so that the above-mentioned authentication email sending notification and authentication email confirmation notification are transmitted in a push- And can be transmitted to the terminal 10.

At this time, when the subscription request is received together with the group code and the e-mail address from the user terminal 10, the subscription request receiving unit 31 acquires the e-mail address format corresponding to the group code and the e- It is possible to generate an authentication key and an e-mail authentication code, and record the e-mail authentication code in the registration table.

As described above, the authentication key is a unique random number key newly generated corresponding to each subscription request, and can be used as an identification purpose for distinguishing each subscription request.

The 'e-mail authentication code' can also be generated as a unique value such as an authentication key, for example, a random number key of 50 kbytes or more. At this time, the e-mail authentication code is included in the authentication e-mail sent from the e-mail sending unit 32a to be described later, specifically, as an authentication link in a format selectable by the user within the authentication e-mail, Or touches the authentication e-mail), so that the authentication server 30 can detect that the authentication e-mail corresponding to which e-mail authentication code has been confirmed. The above-described e-mail authentication code can be provided to the user in the form of an authentication string included in the authentication e-mail body, not in the form of an authentication link. That is, the email authentication code may be provided as either an authentication link or an authentication string.

At this time, the e-mail authentication code is recorded in the joining table when following the first embodiment of the group authentication, and in the case of following the second embodiment, the keyword field for authentication may be recorded instead of the e-mail authentication code field. In addition, in the second embodiment, when notifying each user of different receiving mail addresses, a field for the receiving mail address notified to each user may be included in the joining table. According to the third embodiment of the group authentication, a field for recording the identifier or the location information of the wireless LAN access point received from the user may be included instead of the e-mail authentication code field.

On the other hand, the authentication server 30 includes an e-mail sending unit 32a as a configuration of the group authentication unit 32, and the e-mail sending unit 32a includes an e-mail authentication code . For example, the authentication e-mail includes information about whether an attempt is made to join a service using an e-mail address to which the authentication e-mail is sent, information indicating that the subscription is approved when the authentication link is selected Information that the subscription is approved), and an authentication link (or a string for authentication). When an authentication link is selected or a character string for authentication is written, a corresponding e-mail authentication code is transmitted to the authentication server 30 so that it can be confirmed whether the user has approval for an authentication e-mail.

At this time, after sending the authentication e-mail, the e-mail sending unit 32a may send an authentication e-mail sending notification including the authentication key to the user terminal 10 using the push identifier corresponding to the e-mail address to which the authentication e-mail is sent.

Furthermore, the authentication server 30 may include an e-mail authentication unit 32b as a configuration of the group authentication unit 32. [ When the user authenticates the e-mail using the e-mail authentication terminal 20 and then selects an authentication link or inputs an authentication string, the e-mail authentication unit 32b sends an e-mail authentication code to the authentication server 30, (The field value that is not described or the field value is changed) in the group authentication success field value corresponding to the corresponding e-mail authentication code. In other words, the 'group authentication success field' is an area in which a value indicating whether or not the group authentication is successfully completed due to the successful completion of the e-mail authentication is written.

When the group authentication success field value is successfully processed as described above, the e-mail authentication unit 32b sends the authentication e-mail confirmation notification to the user terminal 10 using the corresponding push identifier and transmits the authentication key together.

Accordingly, the user terminal 10 can confirm that the group authentication using the authentication e-mail has been completed. Particularly, the user terminal 10 can recognize the first authentication key and the second authentication key included in the authentication e- After confirming whether or not the keys are matched, only one matching authentication key can be transmitted to the authentication server 30 again to make a final authentication request.

That is, when the authentication request including the authentication key is received from the user terminal 10 after the email authentication unit 32b succeeds in processing the group authentication success field value and transmits the authentication email confirmation notification to the user terminal 10 , It is possible to check the group authentication success field value and to transmit the group authentication success response to the authentication request only when it is confirmed that the success is processed.

That is, when the group authentication success field value is successfully processed in the authentication server 30, the application is executed in the user terminal 10 by sending the authentication e-mail confirmation notification so that the user terminal 10 can confirm it, (30) so that it can be confirmed whether or not the authentication is performed.

According to the second embodiment of the group authentication, the group authentication unit 32 described above may include an 'e-mail receiving unit' and an 'e-mail authentication unit', unlike the one shown in FIG. The e-mail receiving unit notifies the receiving e-mail address and the authentication keyword to the user terminal 10 (may include the first authentication key), then sets the received e-mail address as the recipient and the e- As the sender, and optionally receives an authentication e-mail including the keyword for authentication in the body text. When the authentication e-mail is received, the 'e-mail authentication unit' confirms whether the received e-mail address corresponding to the e-mail address corresponds to the authentication keyword in the subscription table and success-processes the group authentication success field value . The e-mail authentication unit may transmit the authentication key (second authentication key) to the user terminal 10 together with the authentication e-mail confirmation notification when the group authentication success field value is successfully processed.

According to the third embodiment of the group authentication, the above-described group authentication unit 32 receives the identifier of the wireless LAN access point accessible by the user terminal 10 and the current position information in place of the e-mail address from the user terminal 10 After receiving the group ID, the group selected by the user can be compared with the pre-stored wireless LAN access point identifier or the offline address information to perform group authentication. If the authentication is successful, the authentication key can be transmitted to the user terminal 10 while successively processing the group authentication success field value of the joining table.

On the other hand, upon receiving the group authentication success response from the authentication server 30, the user terminal 10 provides the user with a group authentication success screen enabling the password and the nickname to be set.

Further, according to an embodiment of the present invention, the authentication server 30 includes a member information management unit 34. [ The member information management unit 34 receives a nickname and a password that the user inputs through the group authentication success screen of the user terminal 10. [ At this time, the password can be encrypted and transmitted as described above.

The member information received by the member information management unit 34 from the user terminal 10 is recorded in the member table, and the fields of the member table are as follows.

Members table Field name Explanation Member number Identification code for each member Encrypted password The encrypted password received from the user terminal Encrypted email address Encrypted email address received from user terminal using password nickname Nickname received from user terminal Member session key Random key generated and written after member authentication

Here, the membership number may be an identification code newly generated by the member information management unit 34 when the member information is received from the user terminal 10 and written in the member table.

And the encrypted password and the encrypted email address can be received from the user terminal 10 as described above. The encrypted e-mail address may be a hash value stored in an encrypted form using a password, an e-mail address, and optionally additional information necessary for other encryption. At this time, the encryption of the e-mail address is not decoded again because it is encoded in a one-way encryption scheme. At this time, when the encrypted e-mail address is stored in the authentication server 30, the encrypted e-mail address is stored in an encrypted state so as not to be finally decrypted. However, in the user terminal 10, The authentication server 30 decrypts the encrypted e-mail address, and then encrypts the decrypted e-mail address in the non-decrypted manner. When the encrypted e-mail address is transmitted from the user terminal 10 to the authentication server 30 The authentication server 30 encrypts and transmits the encrypted data in a non-decrypting manner, and the authentication server 30 stores the encrypted data. For example, the encrypted e-mail address is encrypted in the user terminal 10 and is decrypted using the password input by the user and the salt value set by the service provider, that is, the operator side of the authentication server 30 Lt; / RTI >

The member table may additionally include a field in which a group code is written.

The member session key will be described later.

Thus, the member information management unit 34 records and manages the encrypted password received from the user terminal 10, the encrypted email address, the nickname, and the like. In this case, the encrypted password may be the one obtained by decrypting the encrypted password received from the user terminal 10 and then encrypting it again in another manner as described above.

On the other hand, the authentication server 30 may include an overlap processing unit 35. The duplication processing unit 35 is a structure for preventing duplication of membership when there is a duplicate subscription request for the same e-mail address or there is a re-subscription request for a user who has already been authenticated as a member.

For this, the duplicate processing unit 35 first determines whether the email address included in the join request is the same as the email address already registered in the join table when a new join request is received, It is possible to notify that it is a duplicate attempt. Likewise, when a new join request is received, the duplication processing unit 35 may determine whether the email address included in the join request is the same as the email address already registered in the duplicate processing table, which will be described later, have. Further, after the group authentication is completed for the user terminal 10, when the member information such as the password is inputted again, the duplicate processing unit 35 judges whether the email address inputted by the user terminal 10 is already registered in the duplication processing table It can be determined whether or not the e-mail address is the same as the e-mail address. At this time, the duplication processing unit 35 encrypts the plaintext email address with the same logic as the encryption logic used to encrypt the encrypted email address recorded in the deduplication table, and then compares the plaintext email address with the encrypted email address recorded in the deduplication table So that it can be judged whether or not there is a duplication.

When the duplication processing unit 35 notifies the user terminal 10 of the duplicate attempt, the user terminal 10 cancels the existing subscription and determines whether to attempt a new subscription, ) Can be notified. For example, if the user terminal 10 requests to join a new member with the same e-mail address, the duplicate processing unit 35 deletes all the conventional records related to the corresponding e-mail address, and can perform the member registration procedure again.

To this end, the user terminal 10 may include a 'forced flag' in transmitting the subscription request or the member information to the authentication server 30 when the user is notified that the user is a duplicate subscription attempt and then requests re-entry.

When the membership information for the subscription request or the member authentication is received, the duplicate processing unit 35 deletes the existing record according to the presence or absence of the forced flag even if the same email address already exists in the subscription table or the deduplication table Perform new group authentication and / or member authentication, or ignore membership requests or membership information registration.

Here, the table for deduplication may include the following fields.

Deduplication table Field name Explanation Encrypted email address Non-decodable Email session key Random number key generated when authentication succeeded

Each field of the deduplication table can be written by encrypting the e-mail address and generating a new e-mail session key when authentication to any user terminal 10 is successful.

Meanwhile, the authentication server 30 according to the embodiment of the present invention may include a session management unit 36. [

The session management unit 36 can newly create and manage the 'member session key' of the membership table and the 'email session key' of the table for deduplication.

Here, the member session key is synchronized with a member session key provided and stored in the user terminal 10, and the session management unit 36 identifies the member with the member session key received from the user terminal 10 and provides a service.

The e-mail session key is also a session key stored in the table for deduplication, and is similarly provided and stored in the user terminal 10. [

The reason why the e-mail session key is provided separately from the member session key is that, since there is no information related to each other between the table for membership and the table for deduplication for discriminating membership, data deleted when deduplication is performed Only the e-mail session key of the table for deduplication, it is not possible to determine what the corresponding member session key is, and the duplicate processing unit 35 can not delete it.

Therefore, only when the member session key received from the user terminal 10 exists in the member table and the received e-mail session key exists in the deduplication table and both the member session key and the e-mail session key are valid, In order to provide, two different session keys are issued and used.

That is, even if the e-mail session key is deleted and the member session key is confirmed to be valid in the deduplication process, the session management unit 36 can prevent the service from being provided for the service request including the deleted e-mail session key.

Furthermore, the authentication server 30 according to the embodiment of the present invention may include a post management unit 37. [ The post management unit 37 can register each post from the user terminal 10 and store the post. Of course, each post can be distinguished according to the group code.

The table for managing posts may include, for example, an identification number of a post and a member number in which a post is registered as a field.

In addition, the post management unit 37 can manage the comments on the respective posts together. To this end, the authentication server 30 may be provided with a comment table.

The comment table may include an identification number of the comment, an identification number of the post to which the comment is dependent, and a member number in which the comment is registered as a field.

Meanwhile, the authentication server 30 according to the embodiment of the present invention may include a post providing unit 38. The post providing unit 38 can provide a post and a comment managed by using the post table and the comment table according to a request of the user terminal 10. [

At this time, the post offerer 38 can notify the publisher of a new event, such as a comment being registered with the post created by the publisher. To this end, the authentication server 30 may be provided with a push information table.

In the push information table, the identification number of each post and the push identifier of the user terminal 10 that registered the post may be included as the respective fields.

At this time, the push information table does not include data associated with each member.

Therefore, even if each of the tables registered in the authentication server 30 flows out, as described above, since data having an organic correspondence relationship is not included between the tables and information related to the user is not included, In particular, it is not possible to identify who posted a particular post.

Also, in the above-described embodiment, the authentication key, the session key, and other member information may be exchanged between the user terminal 10 and the authentication server 30, It is obvious that the one side generated or inputted can be exchanged by encrypting and transmitting information when it is transmitted to the other side and by using it by decrypting it.

Meanwhile, in the embodiment of the present invention, in the case of using the group authentication method that does not use the e-mail address, that is, in the third embodiment of the group authentication, the e-mail address for preventing the double- Information can be input and duplicate processing can be performed. Or in this case, redundant processing may be omitted.

Hereinafter, an authentication method using the authentication system according to the embodiment of the present invention will be described with reference to the drawings.

FIG. 4 is a flowchart illustrating a process of sending an email for collective authentication according to a user's subscription request in an authentication method according to an exemplary embodiment of the present invention. FIG. 5 is a flowchart illustrating an authentication method according to an embodiment of the present invention, FIG. 6 is a flowchart illustrating a process of receiving an e-mail authentication code necessary for group authentication using the e-mail authentication code according to an exemplary embodiment of the present invention. Fig.

7 is a flowchart illustrating a step of performing a member authentication for issuing a session key to a user terminal in an authentication method according to an embodiment of the present invention, and FIG. 8 is a flowchart illustrating an authentication method according to an embodiment of the present invention FIG. 8 is a flowchart showing a step performed after executing an application installed in a user terminal in a time-wise manner; FIG.

Although the present invention will be described below with reference to a first embodiment in which a group authentication is performed by sending an authentication e-mail including an authentication code, the group authentication in the present invention is not limited to the method described below , The first to third embodiments of the group authentication described with reference to Figs. 1 to 3, and other ways in which substitution thereof is substantially easy.

4, when the user inputs or selects a group and an e-mail address on the subscription request screen provided by the user terminal 10 (S141), the user terminal 10 displays the corresponding group code and e-mail address, Then, the push identifier allocated to the application of the user terminal 10 is transmitted to the authentication server 30 (S142).

Accordingly, the authentication server 30 writes the received e-mail address, the group code, the push identifier, and the like in the subscription table, and then determines whether the e-mail address corresponds to the group code (S341).

If the host address included in the e-mail address does not match the format of the e-mail address corresponding to the group code, the authentication server 30 transmits an error message to the user terminal 10 (S342) An error message can be displayed (S143).

If it is determined in step S341 that the e-mail address is in a format corresponding to the group code, the authentication server 30 determines whether or not the e-mail address corresponding to the received e-mail address is already registered in the deduplication table (S343).

If it is determined that the forced flag is not included in the information received from the user terminal 10 (S344), the authentication server 30 determines whether the forced flag is included in the information received from the user terminal 10, (S345). ≪ / RTI >

Then, the user terminal 10 displays a duplicate message including a notification of a duplicate subscription request (S144), and the user is selected whether to continue the subscription process or to cancel the subscription.

If it is determined that the user intends to continue the group authentication procedure (S145), the user terminal 10 transmits the group code, the e-mail address, and the push identifier including the forced flag to the authentication server 30 again (S146).

Accordingly, the authentication server 30 performs steps S341, S343, and S344 described above.

If it is determined in step S343 that the email address included in the join request is not registered in the deduplication table or if it is determined in step S344 that the join request received from the user terminal 10 includes the forced flag, The authentication server 30 generates an e-mail authentication code and an authentication key corresponding to the subscription request, respectively (S346), and records it in the subscription table together with the information included in the subscription request (S347).

Here, in steps S346 and S347, according to the second embodiment of the group authentication, the receiving mail address and the authentication keyword are generated and recorded in the joining table, respectively.

Subsequently, the authentication server 30 sends out an authentication e-mail including the e-mail authentication code (S348), and transmits the authentication key corresponding to the subscription request to the user terminal 10 together with the authentication e-mail sending notification (S349). Meanwhile, the user terminal 10 receiving the authentication key can store it.

Also, in steps S348 and S349, the second embodiment of the group authentication notifies the user terminal 10 of the received e-mail address and the keyword information for authentication, and simultaneously transmits the authentication key to the user terminal 10 I can go to step. Accordingly, the authentication key is stored in the user terminal 10, and the user can send the authentication e-mail to the authentication server 30 using the user terminal 10 or other terminals.

On the other hand, when the authentication e-mail is thus sent (S351) and thereafter, as shown in Fig. 5, the e-mail authentication terminal 20 receives the authentication e-mail to which the e-mail authentication terminal 20 has sent the authentication link (Step S251). In step S251, the e-mail is displayed. At this time, the e-mail authentication terminal 20 may be the same terminal as the user terminal 10, as described above.

When the user of the e-mail authentication terminal 20 selects an authentication link or inputs an authentication string through an application installed in the user terminal 10 (S252) with the authentication e-mail displayed, the authentication server 30 An e-mail authentication code corresponding to the link (or the authentication string) is transmitted (S253).

Here, in steps S351 to S253 described above, if the group authentication method according to the second embodiment is followed, the authentication server 30 notifies the user terminal 10 of the received mail address and the keyword information for authentication, To the authentication server 30, an authentication e-mail including the received e-mail address notified as the receiver and the authentication keyword in the body of the e-mail.

Accordingly, the authentication server 30 retrieves the same e-mail authentication code as the e-mail authentication code received from the subscription table, and successively processes the group authentication success field value corresponding to the retrieved e-mail authentication code (S353).

However, in the subscription table, if the same e-mail authentication code as the received e-mail authentication code is not found, the received signal is ignored.

According to the second embodiment, in step S353, the authentication server 30 compares the sender and recipient information of the authentication e-mail received from the user with the information stored in the subscription table, To process success or failure.

Meanwhile, in step S353 of FIG. 5, the authentication server 30 transmits a push message including a corresponding authentication key using the corresponding push identifier to the subscription request in which the group authentication success field value is successfully processed, that is, The notification can be transmitted (S361).

The user terminal 10 then compares the authentication key received in step S349 of FIG. 4 with the authentication key received in step S361 of FIG. 6, and if they match (S161) To the authentication server 30 (S162).

The authentication server 30 confirms the group authentication success field value corresponding to the authentication key transmitted in step S162 (S362). If it is confirmed that the authentication process is successful (S363), the authentication server 30 transmits a group authentication success response (S364).

Accordingly, the user terminal 10 is provided with a screen for receiving a group authentication success screen, that is, member information such as a nickname and a password from the user (S163).

This completes the group certification.

On the other hand, as shown in FIG. 7, when the screen for setting the nickname and the password is provided to the user terminal 10 due to the completion of the group authentication, the user terminal 10 can receive the nickname and the password from the user (S171).

Then, the user terminal 10 encrypts the e-mail address using the inputted password, and also encrypts the password itself (S172).

Subsequently, the user terminal 10 transmits the member information such as the encrypted e-mail address, the encrypted password, the nickname, the group code, and the authentication key that has been issued in advance to the authentication server 30 (S173).

At this time, the user terminal 10 encrypts the e-mail address input by the user in a decryptable state and delivers it to the authentication server 30, and after the authentication server 30 decrypts the e-mail address, Or from the user terminal 10 to the authentication server 30, the encrypted e-mail address is encrypted and transmitted in a non-decrypted manner, and the authentication server 30 may store the encrypted e-mail address.

The authentication server 30 can confirm the e-mail address corresponding to the authentication key in the subscription table by using the authentication key received together with the received membership information (S371).

When the e-mail address stored in the plain text is confirmed in the joining table, the authentication server 30 checks whether the corresponding e-mail address is already registered in the duplicate removal table (S372). This step S372 may be accomplished by encrypting the plaintext email address with the same logic as the encryption logic used to encrypt the encrypted email address recorded in the deduplication table and then comparing it with the encrypted email address recorded in the deduplication table have. The encryption logic used to encrypt the email address at this time may be determined or changed by the operator of the authentication server 30. [

If it is determined in step S372 that the e-mail address is duplicated, the authentication server 30 checks whether the forced flag is present in the member information, and if there is no forced flag, the authentication server 30 transmits a duplicate message to the user terminal 10 S375), it is notified that it is a duplicate attempt to join the same e-mail address.

The user terminal 10 receiving the message displays the duplicate message (S174) and allows the user to select whether to subscribe to the same e-mail address or to give up the subscription.

If the user terminal 10 does not wish to continue the subscription procedure and complete the member authentication, all other procedures are discontinued. However, if the user terminal 10 receives a user input to continue the subscription procedure (S175), the user terminal 10 transmits the subscriber information and the authentication key transmitted in step S173 again. At this time, (S176).

Accordingly, the authentication server 30 receives the member information, the authentication key, and the enforcement flag, and re-executes steps S371 to S374.

If it is determined in step S372 that the e-mail address does not exist in the deduplication table, the authentication server 30 generates a new e-mail session key, encrypts the e-mail address, and writes the e-mail address together in the deduplication table (S373).

On the other hand, if it is determined in step S372 that the same e-mail address exists on the duplicate removal table, but the authentication server 30 determines that the forced flag is included in the member information in step S374, And updates and stores the new e-mail session key (S376).

Then, the authentication server 30 writes the received member information in the member table, and generates and stores the member session key together (S377).

When the group authentication is completed with respect to the user terminal 10 requesting the subscription and the membership information registration and the session key issuance are performed to complete the member authentication procedure, (S378), and issues an e-mail session key and a member session key to the user terminal 10. [

Accordingly, the user terminal 10 can store the session keys. At this time, the user terminal 10 can delete all of the temporary stored data such as the e-mail address and the group code together with the issuance of the session key.

In the above description, the group authentication procedure and the member authentication procedure are divided into a plurality of processes, and the authentication server 30 has been described with reference to a time-series execution step. Hereinafter, referring to FIG. 8, And the process of membership certification.

As shown in FIG. 8, when the application is executed in the user terminal 10 (S181), the user terminal 10 checks whether the issued authentication key exists first (S182).

Here, since the authentication key is deleted from the user terminal 10 by issuing the session key, the existence of the authentication key means that the session key for the user terminal 10 has not yet been issued, that is, the subscription procedure is not completed can do.

Accordingly, if it is confirmed that the authentication key is stored in the user terminal 10 in step S182, the user terminal 10 can transmit the authentication key and the e-mail address received from the user to the authentication server 30 S183).

Accordingly, the authentication server 30 can confirm the group authentication success field value corresponding to the authentication key received in the subscription table (S381).

The authentication server 30 may transmit a group authentication success response or a failure response to the user terminal 10 (S383, S384) depending on whether or not the group authentication success field value has been successfully processed.

Accordingly, when the user terminal 10 receives the success response (S184), it provides a screen for performing the member authentication by receiving the group authentication success screen, that is, the member information such as the nickname and the password from the user terminal 10, 7 may be performed.

If the authentication key does not exist in the user terminal 10, or if the authentication key exists but the group authentication fails (the session key also does not exist), the subscription request screen may be displayed (S187). The new group and the e-mail address are input, and the group authentication procedure shown in Figs. 4 to 6 can be performed again.

If the authentication key does not exist in the user terminal 10 and the session key exists, the user terminal 10 can use the service using the session key (S192).

If the screen is locked (S188), the user terminal 10 provides the user with a user interface for inputting the password, and displays the password (S189).

Accordingly, the password inputted by the user can be encrypted and transmitted to the authentication server 30 together with the session key (S190).

The authentication server 30 that received the message retrieves the same member session key as the received session key from the member table, and compares the encrypted password corresponding to the searched member with the encrypted password received in step S190 (S383 ).

If the two passwords do not match, the authentication server 30 can transmit an error message to the user terminal 10.

If it is determined in step S383 that the two passwords match, the authentication server 30 may check whether the e-mail session key is valid in the deduplication table (S385), and then transmit the authentication success response to the user terminal 10.

Accordingly, the user terminal 10 receives the authentication success response (S191) and can use the service normally (S192).

On the other hand, in the authentication method described with reference to Figs. 4 to 8, when the group authentication method is replaced with the group authentication method according to the third embodiment, the group authentication procedure shown in Figs. 4 to 6 is performed by the authentication server 30 ) Receives the group code and the identifier of the wireless LAN access point and the current location information from the user terminal 10, and then registers the identifier of the wireless LAN access point and the current location information in advance for the group corresponding to the received group code The authentication result is compared with the access point identifier and the offline location of the group, and when they correspond to each other, the group authentication success field value is successively processed, and the authentication key is generated and transmitted to the user terminal 10. At this time, in order to prevent duplicated membership, an e-mail address can be registered from the user as in the first or second embodiment, but this e-mail address can not be used for group authentication but can be used only for deduplication. In addition to e-mail addresses, office numbers and the like may be replaced with information for deduplication.

The authentication method according to the embodiment shown in Figs. 4 to 8 includes the steps of time-series processing in the authentication system shown in Figs. Therefore, even if omitted from the following description, the description of the authentication system shown in Figs. 1 to 3 can be applied to the authentication method according to the embodiment shown in Figs.

The authentication method according to the embodiment described with reference to Figs. 4 to 8 may also be implemented in the form of a recording medium including instructions executable by a computer such as a program module executed by a computer. Computer readable media can be any available media that can be accessed by a computer and includes both volatile and nonvolatile media, removable and non-removable media. In addition, the computer-readable medium may include both computer storage media and communication media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Communication media typically includes any information delivery media, including computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave, or other transport mechanism.

The authentication method according to an embodiment of the present invention may also be implemented as a computer program (or a computer program product) including instructions executable by a computer. A computer program includes programmable machine instructions that are processed by a processor and may be implemented in a high-level programming language, an object-oriented programming language, an assembly language, or a machine language . The computer program may also be recorded on a computer readable recording medium of a type (e.g., memory, hard disk, magnetic / optical medium or solid-state drive).

Therefore, the authentication method according to an embodiment of the present invention can be realized by the computer program as described above being executed by the computing device. The computing device may include a processor, a memory, a storage device, a high-speed interface connected to the memory and a high-speed expansion port, and a low-speed interface connected to the low-speed bus and the storage device. Each of these components is connected to each other using a variety of buses and can be mounted on a common motherboard or mounted in any other suitable manner.

Where the processor may process instructions within the computing device, such as to display graphical information to provide a graphical user interface (GUI) on an external input, output device, such as a display connected to a high speed interface And commands stored in memory or storage devices. As another example, multiple processors and / or multiple busses may be used with multiple memory and memory types as appropriate. The processor may also be implemented as a chipset comprised of chips comprising multiple independent analog and / or digital processors.

The memory also stores information within the computing device. In one example, the memory may comprise volatile memory units or a collection thereof. In another example, the memory may be comprised of non-volatile memory units or a collection thereof. The memory may also be another type of computer readable medium such as, for example, a magnetic or optical disk.

And the storage device can provide a large amount of storage space to the computing device. The storage device may be a computer readable medium or a configuration including such a medium and may include, for example, devices in a SAN (Storage Area Network) or other configurations, and may be a floppy disk device, a hard disk device, Or a tape device, flash memory, or other similar semiconductor memory device or device array.

It will be understood by those skilled in the art that the foregoing description of the present invention is for illustrative purposes only and that those of ordinary skill in the art can readily understand that various changes and modifications may be made without departing from the spirit or essential characteristics of the present invention. will be. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive. For example, each component described as a single entity may be distributed and implemented, and components described as being distributed may also be implemented in a combined form.

The scope of the present invention is defined by the appended claims rather than the detailed description and all changes or modifications derived from the meaning and scope of the claims and their equivalents are to be construed as being included within the scope of the present invention do.

Claims (21)

Performed by an authentication server in communication with a user terminal,
Receiving a subscription request including a group code and group identification data including information capable of identifying the group from a user terminal;
Performing a group authentication procedure for the user terminal and successively processing the group authentication procedure if it is determined that the group code and the information included in the group identification data correspond to each other;
Issuing a member session key to the user terminal; And
And in response to a service request comprising the member session key from the user terminal, providing the service requested by the user terminal. The method according to claim 1,
The group identification data is an email address,
Wherein the information capable of identifying the group includes host information included in the email address. 3. The method of claim 2,
Wherein the success-
Sending, to the e-mail address, an e-mail including an authentication code if the group code and host information contained in the e-mail address correspond to each other; And
And upon successful confirmation of the authentication code included in the sent e-mail, processing the group authentication procedure for the user terminal. 3. The method of claim 2,
Wherein the success-
Providing recipient e-mail address information for sending an authentication e-mail to the user terminal if the group code and host information included in the e-mail address correspond to each other; And
And when the authentication e-mail having the received e-mail address as a recipient is received, processing the group authentication procedure for the user terminal successfully. The method according to claim 1,
The group identification data includes,
An identifier of a wireless LAN access point accessible by the user terminal, and location information of the user terminal. 3. The method of claim 2,
The authentication method includes:
Further comprising receiving member information including the encrypted password from the user terminal and the email address encrypted with the password and recording the member information in the member table when the group authentication procedure for the user terminal is successful, Authentication method. The method according to claim 6,
Wherein the receiving the subscription request comprises:
And receiving a push identifier of the user terminal together. 8. The method of claim 7,
Wherein the receiving the subscription request comprises:
Further comprising storing the group code and e-mail address included together in the join request together, and the push identifier in a subscription table. 9. The method of claim 8,
Wherein the receiving the subscription request comprises:
Generating an authentication key to be issued to the user terminal in response to the subscription request; And
And storing the authentication key in the subscription table. 10. The method of claim 9,
The authentication method includes:
Further comprising the step of deleting, after recording the member information, the information recorded in the joining table for a member corresponding to the member information. 10. The method of claim 9,
The step of successfully processing the group authentication procedure includes:
And after the successful processing of the group authentication procedure, sending an email confirmation notification including the authentication key to the user terminal using the push identifier. 12. The method of claim 11,
Wherein the step of receiving the member information comprises:
And transmitting a group authentication success response to the user terminal when an authentication request including the authentication key is received from the user terminal. 12. The method of claim 11,
Wherein the step of receiving the member information comprises:
And receiving the authentication key together with the member information,
Wherein the issuing of the member session key comprises:
Confirming the e-mail address registered in the joining table corresponding to the authentication key received from the user terminal;
Generating an e-mail session key corresponding to the identified e-mail address, and recording the generated e-mail session key and the e-mail address in a table for deduplication; And
And issuing the email session key to the user terminal. 14. The method of claim 13,
Wherein the step of receiving the member information comprises:
Confirming whether the same email address as the confirmed email address is recorded in the deduplication table;
If the same e-mail address is recorded in the duplicate deletion table, notifying the user terminal that the duplicate registration request is made and selecting whether to proceed with the authentication process; And
Further comprising updating and storing an e-mail session key corresponding to the same e-mail address of the deduplication table if authentication procedure proceeding is requested from the user terminal. 14. The method of claim 13,
Wherein the issuing of the member session key comprises:
And storing the member information and the member session key in the member table. 14. The method of claim 13,
Wherein the providing of the service comprises:
In response to a service request including the member session key and the e-mail session key from the user terminal, providing the service requested by the user terminal only when the member session key and the e-mail session key are both valid , Authentication method. 16. The method of claim 15,
Wherein the providing of the service comprises:
Receiving a service request including the member session key and the encrypted password from the user terminal;
Confirming an encrypted password written corresponding to the member session key in the member table; And
And providing a service requested by the user terminal only when the encrypted password contained in the service request matches the encrypted password written in the member table. 14. The method of claim 13,
Wherein the receiving the subscription request comprises:
Checking whether the same e-mail address as the e-mail address is recorded in the deduplication table; And
And notifying the user terminal that the duplicate deletion request is an authentication request if the identical e-mail address is recorded in the duplicate removal table,
The authentication method includes:
Performing the following steps of performing the group authentication procedure only when the user terminal requests the authentication procedure proceeding, and performing the group authentication procedure succeeding process. 20. A computer program stored on a recording medium for performing the method of any one of claims 1 to 19. Is performed by a user terminal communicating with an authentication server over a network,
And a user interface for inputting the group identification data including the group code and the information for identifying the group, receives the group code and the group identification data, and receives the group code and the group identification data Sending a request to the authentication server;
Encrypts the group identification data by using the password, and transmits the encrypted password and the encrypted group identification data to the authentication server Transmitting to the server; And
Receiving a member session key from the authentication server, storing the member session key, transmitting a service request to the authentication server including the member session key, and receiving a service provided by the authentication server; . 20. A computer program stored on a recording medium for performing the method of claim 20.

Images