KR20170143381A - Method for authenticating user with personalized question - Google Patents

Abstract

The present invention relates to a method for authenticating a user at a registration server. More particularly, the present invention relates to a method for authenticating a user by a web server using the question number of a personalized question and a user response to the user who can answer with a number, and authenticating a user on a web server that is difficult for a third party to steal using a randomly selected personalized question among multiple personalized questions and a user response thereto. The method includes a first step of transmitting a personalized question; a second step of registering and storing the personalized question and the answer of a user in a database; and a third step of authenticating the user.

Description

A method for authenticating a user to a question mode on a registration server

The present invention relates to a method of authenticating a user on a registration server, and more particularly, a user who can answer a number can authenticate a user on a web server using a question number of a personalized question and a user response thereto, The present invention relates to a method for authenticating a user on a web server without the need for a user to memorize or learn by using a randomly selected personalized question and user response thereto from a plurality of personalized questions.

In general, the Internet refers to a communication network in which distributed data communication networks around the world are connected to one huge communication network so that an Internet user can easily obtain desired information. In recent years, As information technology such as communication technology rapidly develops, the demand of people using the Internet is rapidly increasing.

The service through the Internet is an online service that is virtual space that transcends temporal and spatial concepts, and the services are provided through the web sites of each server existing on the Internet.

In order to utilize contents or services provided by a specific web site of interest while surfing a large number of web sites, most of the users are required to join the web site as a member. User information such as a user's name, address, social security number, telephone number, e-mail address, and the like must be created and registered. In addition to the user information, a user's desired ID and password do.

When the user accesses the web server, the user must transmit his / her ID and password to the web server in order to log in to the web site. FIG. 1 is a flowchart illustrating a process of providing a web server to a conventional user terminal (e.g., a smart phone, The login screen shown in Fig. The user inputs a user ID and a password to the user login screen and transmits the user ID and password to the web server. The web server compares the stored user ID and password with the user ID and password received from the user terminal to approve the user login.

Therefore, conventionally, in order to use the Internet service through a web site on the Internet, most users have to use an ID and a password after joining as a member of the corresponding web server. When using a variety of Internet services, And the password had to be remembered.

For example, in recent years, e-commerce has been activated, and there may be many different websites that sell the same goods or services. When a user is registered in a plurality of websites, the user selects a web site In order to purchase a product through a website, you must remember the ID and password of the selected website. In the case of a web site that is used occasionally, it is difficult to memorize the ID and password of the corresponding web site. If the user ID or password entered in connection with the selected web site is different from the registered user ID and password stored in the selected web site, You have to go through a cumbersome process of asking for or re-registering your ID or password on the web server you have chosen to purchase goods or services through the selected website. Accordingly, the user accesses another web server that sells the same goods or services other than the selected web server to purchase goods or services.

This causes the user to give up the purchase of the goods or services on the web server desired by the user, and has the problem of losing the customer or failing to sell the goods or services from the viewpoint of the web server operator.

Furthermore, when a user joins a plurality of web servers, there is a problem that the increase in membership of the web server is hindered due to the concern that the user's ID or password may be leaked.

SUMMARY OF THE INVENTION The present invention has been made to solve the problems of the above-described conventional web server user authentication method, and it is an object of the present invention to provide a user authentication method, To provide a method for authenticating a user on a web server.

Another object of the present invention is to provide a method for authenticating a user in a web server which is difficult for a third party to steal using a personalized question selected randomly among a plurality of personalized questions and a user response thereto.

It is a further object of the present invention to provide a method and system for generating a one-time password from a plurality of personalized questions, It is difficult for the third party to obtain the user authentication information from the one-time password even if the user is exposed.

In order to accomplish the object of the present invention, there is provided a method for authenticating a user in a web registration server, comprising the steps of: transmitting n personalized queries to a user terminal; A second step of receiving a user response to each personalized question and dividing the personalized question into user identifiers and registering personalized questions and user answers in a database; and transmitting the personalized questions to the user terminal And a third step of authenticating the user by comparing the user answer received from the user terminal with the registered user answer in response to the personalized question.

Wherein the personalized question is a question for selecting one number personalized to the user from 0 to 9.

Preferably, the third step of authenticating the user is to select randomly selected m personalized questions among the personalized questions, send the selected m personalized questions to the user terminal, And authenticating the user based on whether or not the registered user answers to the m personalized questions selected when receiving the user response from the user terminal in response to the query and the received user response.

Preferably, the method for authenticating a user on a registration server includes performing a first step and a second step in accordance with a mode change command received from a user terminal when the user authentication mode is registered in the registration server in the password mode, Mode, and the third step is performed upon requesting authentication from the user terminal after changing to the question mode.

Preferably, the n personalized questions and the user answers are registered and stored in the database unit as the authentication question group, the preliminary question group, and the deletion question group, and the selected m personalized questions are randomly selected in the authentication question group .

Preferably, the third step of authenticating the user is to delete the mismatched personalized questions from the authentication question group and, if the received user answers are inconsistent with the stored user answers for the selected m personalized questions, And the personalized question selected in the preliminary question group is newly registered in the authentication question group.

Preferably, the method further comprises receiving from the user terminal a receiving one-time password consisting of a combination of the question number and the user answer of the personalized question in response to the selected m personalized questions, generating from the receiving one- And the user is authenticated by comparing the registered one-time password.

The receiving one-time password is generated as a combination of user responses entered in the order of questions, taking into account the order of questions of the personalized questions sent to the user terminal, and the registered one-time passwords take into account the sequence of questions of the personalized questions sent to the user terminal And is generated from the question number of the personalized question according to the order of the questions registered in the database and the user's answer of the personalized question according to the order of the questions.

The method for authenticating a user in the web registration server according to the present invention has the following effects.

First, in the registration server according to the present invention, the user authentication method can authenticate a user by using a question number and a user answer of a personalized question, which can be answered numerically, so that a user does not have to learn or learn separately The user can be easily authenticated by the web server.

Second, the user authentication method in the registration server according to the present invention uses a personalized question randomly selected from among a plurality of personalized questions and a user response thereto, thereby making it difficult for a third party to steal and securely authenticating a user in a web server have.

Third, the user authentication method in the registration server according to the present invention generates a one-time password in a format set from a sequential inquiry order of personalized questions randomly selected from a plurality of personalized questions and a user answer thereto, The third party can not obtain the user authentication information from the one-time password.

FIG. 1 shows an example of a login screen provided from a web server to a conventional user terminal.
2 is a diagram for explaining a user authentication system according to the present invention.
3 is a functional block diagram illustrating an example of a registration server according to the present invention.
FIG. 4 shows an example of an authentication question group, a preliminary question group, and a deletion question group according to an embodiment of the present invention.
5 is a functional block diagram for explaining an example of an authentication unit according to the present invention.
6 is a flowchart illustrating a method of registering a user in a registration server according to the present invention.
Figure 7 shows an example of personalized questions of a question group provided to a user terminal.
FIG. 8 shows an example of an interface screen provided to a user terminal to change from a password mode to a question mode according to the present invention.
9 is a flowchart illustrating a method for authenticating a user in a registration server according to an embodiment of the present invention.
10 illustrates an example of personalized questions that are provided to a user terminal upon user authentication to a registration server.
FIG. 11 shows an example of a format set by the format setting unit 177. FIG.

It is noted that the technical terms used in the present invention are used only to describe specific embodiments and are not intended to limit the present invention. In addition, the technical terms used in the present invention should be construed in a sense generally understood by a person having ordinary skill in the art to which the present invention belongs, unless otherwise defined in the present invention, Should not be construed to mean, or be interpreted in an excessively reduced sense. In addition, when a technical term used in the present invention is an erroneous technical term that does not accurately express the concept of the present invention, it should be understood that technical terms can be understood by those skilled in the art.

Furthermore, the singular expressions used in the present invention include plural expressions unless the context clearly dictates otherwise. In the present invention, terms such as "comprising" or "comprising" and the like should not be construed as encompassing various elements or various steps of the invention, Or may further include additional components or steps.

It is to be noted that the accompanying drawings are only for the purpose of facilitating understanding of the present invention, and should not be construed as limiting the scope of the present invention with reference to the accompanying drawings.

Hereinafter, a method for authenticating a user in a registration server according to the present invention will be described in detail with reference to the accompanying drawings.

2 is a diagram for explaining a user authentication system according to the present invention.

Referring to FIG. 2, the user terminal 10 and the registration server 100 are connected to the network 30. The network 30 may be a wired or wireless network of various types capable of transmitting and receiving data between the user terminal 10 and the registration server 100.

The user terminal 10 may be a smart phone or a personal computer that can be connected to the registration server 100 by a user. The registration server 100 may be a web server that provides a web service to the user terminal 10, Server. The user can join the registration server 100 through the user terminal 10 or use the web service provided by the registration server 100 through the login authentication.

The user must first register with the registration server 100 in order to utilize the web service provided by the registration server 100. The registration server 100 receives basic user information from the user terminal 10, , A name, an address, and a telephone number. The registration server 100 also sends a number of personalized questions to the user at the user terminal 10 and receives user responses to the personalized questions from the user terminal 10. Here, the personalized question for the user can be answered with a number between 0 and 9, and the question is composed of questions which can be variously answered from 0 to 9 for each user.

When a user requests registration authentication with the registration server 100 or requests the registration server 100 to generate a one-time password in order to use the service provided by the registration server 100, the registration server 100 ) Sends some or all of the personalized questions selected from the plurality of personalized questions to the user terminal and, in response, determines whether the user answers received from the user terminal 10 match the user answers stored in the registration server 100 Whether the user authenticates the login or the one-time password authentication process.

According to the field to which the present invention is applied, the registration server 100 may be configured with a web server for providing a web service and an authentication server for user authentication, respectively, and this is within the scope of the present invention.

3 is a functional block diagram illustrating an example of a registration server according to the present invention.

3, the transceiver 110 receives user information for subscribing to the registration server from the user terminal, transmits personalized questions to the user, and receives user responses to the user. And also sends and receives selected personalized questions or user responses to the user terminal upon login authentication or upon creation of a one-time password.

The registering unit 130 receives user information such as a user name, an ID, an age, a job, and a contact from a user terminal, Searches the question group previously registered in the database unit 190 and transmits a personalized question to the user stored in the searched question group to the user terminal. When receiving a user response from a user terminal in response to a personalized question, the registration unit 130 registers and stores the user response in the database unit 190 for each user, thereby completing the user registration procedure.

Preferably, the database unit 190 classifies the personalized questions according to the user's age, sex, occupation, etc., and can search for question groups matched with the inputted user information and provide them to the user terminal.

More specifically, the database unit 190 includes a user information DB 191 in which user information is registered and stored, and a personalized question And a question DB 193 in which user answers are stored. Here, some of the entire questions provided to the user are registered and stored in the question DB 193 as an authentication question group used to authenticate the user, and another part of all the questions provided to the user is incorrectly answered The query is stored in the question DB 193 as a preliminary question group provided to the user terminal. The question in which the user is wrongly answered among the questions in the authentication question group is registered and stored in the question DB 193 as a deletion question group.

FIG. 4 shows an example of an authentication question group, a preliminary question group, and a deletion question group according to an embodiment of the present invention. As shown in FIG. 4A, a total of 21 questions are registered in a question group If stored, the questions stored in the question group are provided to the user terminal in random order, and the question numbers of the questions provided to the user terminal are changed to the order of the questions unique to the user, thereby creating a question group unique to the user. 4 (a), the question number 11, the question number 7, the question number 21, and the question number 15 are sequentially stored in the database corresponding to the user in the order of the question number 1, 2, 3, 4, and so on.

Also, as shown in FIG. 4 (b), the authentication question group and the preliminary question group to be applied to the user in the question group corresponding to the user are randomly selected and stored in the authentication question group and the preliminary question group, respectively.

Thus, by randomly selecting a question sequence or randomly selecting a question to be stored in an authentication question group or a preliminary question group, and by providing a personalized question to a user in a randomly selected authentication question group or a preliminary question group, Prevent illegal hacking, or prevent some user's question group from being exposed, but stealing another user's question group.

In the present invention, a user who is a member of the registration server in a password mode for authenticating a user with an ID and a password can change the user authentication mode to a question mode for authenticating a user by querying in a password mode. When a user command for requesting a change of the user authentication mode from the password mode to the question mode is received, the personalized question is transmitted to the user as described above, and the user response to the user is registered and stored for each user. You can authorize users to login in question mode when they request a login.

The login unit 150 receives the user ID from the user terminal and searches the database unit 190 for the user information mapped to the received user ID when the user terminal accesses the registration server and requests the login.

When the authentication unit 170 receives the user information retrieved from the login unit 150, the authentication unit 170 searches the database unit 190 for an authentication question group mapped to the retrieved user information, Selects a random one at random and transmits it to the user terminal. When the authentication unit 170 receives the user response to the personalized question from the user terminal, the authentication unit 170 processes the authentication based on whether the received user response matches the user response registered in the database unit 190.

5 is a functional block diagram for explaining an example of an authentication unit according to the present invention.

5, the question selection unit 171 randomly selects a question to be provided to the user terminal in the authentication question group corresponding to the user among the question groups of the database unit 190. [ The question selection unit 171 can repeat the same questions to select at random or to select different questions at random. The question selection unit 171 controls the personalized question to be transmitted to the user terminal. The question number of the personalized question provided to the user terminal is not a unique question number, Quot; For example, when question numbers 16, 8, and 19 are sequentially selected in the authentication question group, question numbers 16, 8, and 19 are assigned to question numbers 1, 2, and 3 to the user terminal.

The authentication control unit 173 receives a user response to the personalized question to the user provided to the user terminal, compares the received user response with the stored user answers, and authenticates the user if they match. However, if the received user response is different from the stored user answer, the authentication control unit 173 provides the non-authentication message to the question management unit 175, and the question management unit 175, in response to the non-authentication message, The personalized question is deleted from the authentication question group and the deleted personalized question is stored in the delete question group. In addition, the question management unit 175 randomly selects one personalized question stored in the preliminary question group, updates the selected personalized question to the authentication question group, and provides the selected personalized question to the user terminal .

The authentication control unit 173 receives a user response to the personalized question additionally provided from the user terminal, and authenticates the user when the received user response matches the registered user reply. However, if the user responses of the additional personalized questions are again different, the different personalized questions are moved from the authentication question group to the deletion question group, and the personalized questions stored in the preliminary question group are updated to the set number of times. To handle user authentication.

Preferably, the format setting unit 177 provides the authentication control unit 173 with a format that is set by combining the personalized questions randomly selected by the question selection unit 171 and the question numbers unique to the users assigned to the respective questions , The authentication control unit 173 determines whether or not the one-time password including the user's answer and the unique question number received from the user terminal based on the set format matches the one-time private number generated by the registered user answer and the unique question number To authenticate the one-time password.

11 shows an example of a format set by the format setting unit 177. As shown in FIG. 11 (a), a unique question number and a corresponding user answer are alternately generated to generate a one-time password , Or it may be formatted so that a unique question number and user answer are placed in a row and a one-time password is generated as shown in Fig. 11 (b).

As shown in Fig. 11 (c), a 12-digit one-time password is constructed. The first numeral 7 indicates a position where three unique question numbers start, and three The answer and question are placed, and the remaining numbers can be formatted to represent parity numbers.

As described above, the format setting unit 177 can set various formats for generating the one-time password. Also, the format setting unit 177 changes the setting format every predetermined period, so that the third party can not hack the one-time password, do.

6 is a flowchart illustrating a method of registering a user in a registration server according to the present invention.

6, it is determined whether a user command for requesting registration to the registration server is received from the user terminal (S110). When the user command is received, the user authentication mode is registered in the question mode (S130) whether the user is to register in the password mode or not.

If the user requests registration to the registration server in the question mode, the user selects a question group mapped to the user based on the user information, and transmits the personalized question stored in the selected question group to the user terminal (S150). Here, the question group mapped to the user based on the user information can be selected differently according to the age, user's sex, marital status, and the like. Figure 7 shows an example of personalized questions of a question group provided to a user terminal.

When receiving a user response from a user terminal in response to a personalized question, the received user response is mapped to a personalized question number, and the received user answers are separately stored for each user (S170). Preferably, the user answer received from the user terminal and the unique question number are divided into an authentication question group and a preliminary question group, and are stored for each user.

On the other hand, when the user requests the user authentication mode in the password mode, it receives the password received from the user terminal, registers and stores the received password, and approves the login using the password (S190).

In addition, when the user registers in the registration server in the conventional password mode, when the user command for registering and changing the user authentication mode from the password mode to the question mode is received, the question mode can be changed through steps 150 and 170 described above. have. FIG. 8 shows an example of an interface screen provided to a user terminal to change from a password mode to a question mode according to the present invention.

9 is a flowchart illustrating a method for authenticating a user in a registration server according to an embodiment of the present invention.

9, when receiving an authentication request from a user terminal (S210), an authentication inquiry group mapped to user information is searched based on user information in the authentication request, The personalized question to be provided to the user is selected (S230). The selected personalized question is transmitted to the user terminal (S240). FIG. 10 shows an example of the personalized questions provided to the user terminal in user authentication at the registration server.

When receiving a user response from the user terminal in response to the personalized question, it is determined whether the received user reply and the registered user reply match each other (S260). If the received user reply and the stored user reply agree with each other, the user is authenticated (S270).

However, if the received user response is different from the registered user response, it is determined whether the number of times the different user responses are received is greater than or equal to the threshold number (S280). The non-authenticated user can authenticate through the authentication number or password mode transmitted to the registered user terminal. On the other hand, the personalized questions that received different user responses are moved and updated to the delete question group.

If the number of times that different user responses are received is equal to or less than the threshold number, one personalized question is randomly selected in the preliminary question group and updated and registered in the authentication question group (S290). An additional one personalized question is randomly selected from the renewed registered question group and provided to the user terminal.

The above-described embodiments of the present invention can be embodied in a general-purpose digital computer that can be embodied as a program that can be executed by a computer and operates the program using a computer-readable recording medium.

The computer-readable recording medium may be a magnetic storage medium (e.g., ROM, floppy disk, hard disk, etc.), an optical reading medium (e.g. CD ROM, Lt; / RTI > transmission).

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is evident that many alternatives, modifications and variations will be apparent to those skilled in the art. Accordingly, the true scope of the present invention should be determined by the technical idea of the appended claims.

10: user terminal 30: network
100: Registration server 110: Transmitting /
130: Registration unit 150: Login unit
170: Authentication section 190: Database base section
171: Question selection unit 173: Authentication control unit
175: Question management unit 177: Format setting unit

Claims (8)

A method for authenticating a user at a registration server,
A first step of transmitting n predetermined personalized questions to a user terminal;
a second step of receiving a user response to each personalized question from the user terminal in response to the n personalized questions and storing the personalized question and the user answer in a database by dividing the personalized question into user identifiers; And
And transmitting the personalized question to the user terminal when the authentication request is made from the user terminal to the registration server, comparing the user response received from the user terminal with the registered user response in response to the personalized question, And a third step of performing an authentication process. The method according to claim 1,
Wherein the personalized question is a question for selecting one number personalized to the user from 0 to 9. 3. The method of claim 2, wherein the third step of authenticating the user comprises:
Selecting at random m personalized questions of the personalized questions;
Transmitting the selected m personalized questions to the user terminal; And
Authenticating the user based on whether the stored user responses for the selected m personalized questions match the received user responses when receiving user responses from the user terminals in response to the selected m personalized questions; The user authentication method comprising: 4. The method of claim 3, wherein the method for authenticating a user at the registration server comprises:
When the user authentication mode is registered in the registration server in the password mode, the user authentication mode is changed to the question mode by performing the first step and the second step according to the mode change command received from the user terminal,
Wherein the third step is performed when an authentication request is made from the user terminal after changing to the question mode. The method of claim 3,
The n personalized questions and user answers are classified into an authentication question group, a preliminary question group, and a deletion question group, and are registered and stored in the database unit,
Wherein the selected m personalized questions are randomly selected in the authentication question group. 6. The method of claim 5, wherein the third step of authenticating the user comprises:
If the registered user answers and the received user answers for the selected m personalized questions are inconsistent with each other, the inconsistent personalized question is deleted from the authentication question group and newly registered in the deletion question group,
Wherein the personalized question selected in the preliminary question group is newly registered in the authentication question group. 4. The method of claim 3, further comprising: receiving, from the user terminal, a receiving one-time password consisting of a combination of the question number of the personalized question and the user answer in response to the selected m personalized questions,
Wherein the user is authenticated by comparing the received one-time password with a registered one-time password generated from m registered personalized questions. 8. The method of claim 7,
Wherein the receiving one-time password is generated as a combination of user answers entered in the query sequence in consideration of the order of questions of the personalized query sent to the user terminal,
Wherein the registered one-time password includes a question number of a personalized question according to the order of the questions stored in the database and a user's response to the personalized question according to the order of the questions, And generating the user authentication information.

Images