WO2013073780A1

WO2013073780A1 - Method and server for providing automatic login function

Info

Publication number: WO2013073780A1
Application number: PCT/KR2012/008691
Authority: WO
Inventors: 나호열; 김학민; 정진환
Original assignee: 주식회사 네오위즈인터넷
Priority date: 2011-11-18
Filing date: 2012-10-23
Publication date: 2013-05-23
Also published as: KR20130055116A

Abstract

The present invention relates to an authentication technology for preventing account theft when using an automatic login function. The server for providing an automatic login function according to the present invention includes: a token creating unit for creating an authentication token for a user account authenticated as an authorized user through authentication information received from a terminal; and an authentication controller for enabling the authentication token created in the token creating unit to be transmitted to the terminal, and causing the authentication token provided to the terminal to expire by interacting with the user account when a request for changing the authentication information is received. According to the present invention, the risk of account theft can be minimized even though a terminal is lost in a state where an automatic login function has been executed.

Description

How and Servers Provide Automatic Login

The present invention relates to an authentication technique for preventing an account from being stolen by an automatic login function.

Recently, as the spread of smart phones rapidly increases, more and more users install and use various types of applications on smart phones.

There are a number of applications that are provided with the automatic login function in the applications installed on the smartphone. When the automatic login function is executed, a series of processes in which the user enters an ID and password directly and is authenticated as a party user is executed. May be omitted.

However, if the terminal on which the application on which the automatic login function is executed is lost, the user who has acquired the lost terminal executes the application to automatically access the account of the real owner of the lost terminal by the automatic login function. It can also cause problems with malicious accounts being compromised.

In particular, in the case of an application linked to a payment system, for example, a paid application or a game application that enables payment of a paid license, damage to the real owner of the lost terminal may be greatly increased as the account is stolen.

In this background, it is an object of the present invention to provide an authentication method and server for providing an automatic login function that can minimize the risk of account theft even if the terminal is lost in the automatic login function is executed.

In order to achieve the above object, in one aspect, the present invention, the step of generating an authentication token in response to a request from the terminal and providing it to the terminal; Receiving a request for changing authentication information available for user authentication from the terminal or another terminal; Expiring the authentication token issued to each terminal through the account of the terminal user; And generating and providing a new authentication token for the user terminal authenticated through the changed authentication information.

In another aspect, the present invention, the token generation unit for generating an authentication token for the user account authenticated as a party user through the authentication information received from the terminal; And an authentication control unit configured to transmit the authentication token generated from the token generation unit to the terminal, and to expire the authentication token provided to each terminal in association with the user account when a request for changing the authentication information is received. Provide a server to provide.

As described above, according to the present invention, when there is a request for changing the authentication information, the authentication data generated for automatic login is invalidated, thereby reducing the risk of account theft when the terminal is lost and greatly improving the stability.

1 is a diagram illustrating an authentication system for providing an automatic login function according to an embodiment of the present invention.

2 is a flowchart illustrating an automatic login execution method provided according to an embodiment of the present invention.

3 is a flowchart illustrating an authentication method provided according to an embodiment of the present invention.

4 is a block diagram illustrating an authentication system for providing an automatic login function according to an embodiment of the present invention.

5 is a flowchart illustrating an authentication method provided according to an embodiment of the present invention.

According to the present invention, when authentication information required for access of a user account or unique information of an account holder is changed, the user who has an automatic login function is expired by expiring authentication data provided to each terminal in response to the user account. Its main feature is to help keep your account secure.

In the present invention, the 'authentication' is to access the account created by the user of the terminal in order to use the service provided to the terminal via the Internet to access the service server and create an account for service use By inputting the requested authentication information, for example, ID and password information to the service server means to confirm that the user is a party user who can receive the service and access to his account.

In addition, in the present specification, "issuance" or "issuance" of the token indicates that the token generated by the server is provided to the terminal.

Hereinafter, some embodiments of the present invention will be described in detail through exemplary drawings. In adding reference numerals to the components of each drawing, it should be noted that the same reference numerals are assigned to the same components as much as possible even though they are shown in different drawings. In addition, in describing the present invention, when it is determined that the detailed description of the related well-known configuration or function may obscure the gist of the present invention, the detailed description thereof will be omitted.

In addition, in describing the component of this invention, terms, such as 1st, 2nd, A, B, (a), (b), can be used. These terms are only for distinguishing the components from other components, and the nature, order or order of the components are not limited by the terms. If a component is described as being "connected", "coupled" or "connected" to another component, that component may be directly connected to or connected to that other component, but there may be another configuration between each component. It is to be understood that the elements may be "connected", "coupled" or "connected".

Referring to FIG. 1, an authentication system providing an automatic login function according to an embodiment of the present invention is connected to a terminal 10 through a network N to perform a server for performing authentication processing on the terminal 10 ( 20).

The terminal 10 is provided with at least one application capable of executing an automatic login function, and the application is described in this specification as an example of a game application for providing a game service, but the present invention is not limited thereto. Browsers can also be included in the application in a broad sense.

The server 20 may provide a page of the corresponding web site through a browser of the terminal 10 connected through the network N. In addition, the server provides a web page for the process of creating an account, and stores and manages various information such as account information related to the user account, user's unique information, and service usage history provided through the account. It is also possible to provide a purchase and payment function for various usage rights or items to be paid.

The server 20 generates separate authentication data using the unique information related to the account that can be used as authentication to increase the convenience of the terminal user to input the authentication information each time the service is used, and the generated authentication data terminal Since the authentication data is provided to the terminal 10 by providing the terminal 10, an automatic login function is provided so that the user can automatically access his / her account even without inputting the authentication information.

Such a server 20 has the same configuration as a conventional web server or web server. However, the software includes a program module implemented in any language such as C, C ++, Java, Visual Basic, Visual C and performing various functions.

In addition, the server 20 is generally connected to an unspecified number of clients (including terminals) and / or other servers through an open computer network such as the Internet, and receives and acts on a task request from a client or other web server. It may mean a computer system which derives and provides a result and computer software (server program) installed therefor.

In addition to the above-described server program, the server 20 is a series of application programs that operate on the server and various databases (DB: Database, hereinafter referred to as "DB"), which are built in the inside or outside depending on the case. It is to be understood as a broad concept, including a). Accordingly, the server classifies membership information and various kinds of information and data on sports games according to sports game types and stores and manages them in a DB. Such a DB may be implemented inside or outside the server.

In addition, the server 20 uses a server program that is variously provided according to operating systems such as DOS, Windows, Linux, UNIX, Macintosh, and the like for general server hardware. As a representative example, Website, Internet Information Server (IIS), and CERN, NCSA, and APPACH, which are used in a UNIX environment, may be used.

The terminal 10 connected to the server 20 through the network N is generally a personal PC, but all terminals capable of connecting to the server 20 and the server-client communication by connecting to the wired / wireless network N may be used. It is possible to apply a broad concept including all communication computing devices such as smart phones, notebook computers, mobile communication terminals, personal digital assistants (PDAs), game machines, and the like.

The network N may be a network connecting the server 20 and the terminal 10 to a closed network such as a local area network (LAN) or a wide area network (WAN), but may be a network such as the Internet. It is preferred to be open. The Internet has many services in the TCP / IP protocol and its upper layers: HyperText Transfer Protocol (HTTP), Telnet, File Transfer Protocol (FTP), Domain Name System (DNS), Simple Mail Transfer Protocol (SMTP), and SNMP ( The global open computer network architecture that provides the Simple Network Management Protocol (NFS), Network File Service (NFS), and Network Information Service (NIS). In addition, when the terminal 10 is a mobile communication terminal or a smartphone, the network N may include a mobile communication network.

Referring to FIG. 2, in the automatic login function provided to the terminal 10 through the server 20 according to an embodiment of the present invention, first, authentication information of a user input from the terminal is transmitted to the server through a network. (S10)

The server reads the received authentication information to determine whether the party user of the user account corresponding to the received authentication information is correct, and if confirmed as the party user, notifies the terminal that the user account has been accessed according to the authentication procedure.

In this case, when a request for executing the automatic login function is received from the terminal, the server generates authentication data for automatic login using various information related to the user account, and transmits the generated authentication data for automatic login to the terminal. In addition, the generated automatic login authentication data is stored separately in association with the user account.

In addition, the terminal stores the received authentication data for automatic login.

Thereafter, when the terminal wants to access a user account of the server, the terminal requests the user authentication by transmitting the stored authentication data for automatic login to the server.

The server may compare the automatic login authentication data stored separately with the automatic login authentication data received from the terminal to determine whether they match, and if not match, notify the terminal that it is confirmed that the user is a party user according to the authentication. . (S40)

In this case, the automatic login authentication data is preferably an authentication token generated in the form of a token. Hereinafter, the authentication token is applied as the authentication data for automatic login, but is not limited thereto.

The authentication method provided according to an embodiment of the present invention for enhancing security in the authentication process through the automatic login method provided as described above is as follows.

When the first terminal 10a and the second terminal 10b receive and store the authentication data for automatic login associated with the same user account, respectively, the server 20 in the first terminal 10a or the second terminal 10b. ) Is sent to the server 20, and the authentication data for automatic login stored respectively is connected to the same user account after the authentication process.

Referring to FIG. 3, the first terminal 10a transmits the authentication token stored in the first terminal 10a to the server 20 to request authentication.

The server 20 compares the received authentication token with the authentication tokens of the first terminal 10a stored in the server and determines whether the server 20 is matched, and if it is determined that the server 20 is connected to the corresponding user account according to the authentication confirmation. Notify

On the other hand, the second terminal 10b receives the request for changing the authentication information for the account to the server 20.

The authentication information may correspond to the password associated with the access of the account as described above, and the user's unique information for confirmation of the user holding the account, for example, contact information such as payment information, mobile phone, email, etc. Information and the like.

That is, when the second terminal 10b accesses the account, for example, when a password change request is made, a new password input to change together with the password change request is received by the server 20.

The server 20 updates and stores the received new password in the password data of the previously stored account, and notifies the terminal that the password change processing is completed.

In this case, when it is determined that the server 20 is authenticated through the automatic login by the second terminal 10b, the server 20 may be connected to the server 20 in the same manner as the authentication token provided to the second terminal 10b before changing the password. The stored authentication token expires so that it is no longer valid, and a new authentication token is generated and provided to the second terminal 10b.

In particular, the server 20 expires at least one or more authentication tokens provided to each terminal in association with the account before the request for changing the password is received from the second terminal 10b.

Therefore, after the request for changing the authentication information associated with the account is received, all authentication tokens issued to each terminal are expired so that they are no longer valid, and then the first request as an authentication request for accessing the account again from the first terminal 10a. When the authentication token provided to the terminal is received, the authentication token received from the first terminal 10a is already expired (invalidated) data, so the server 20 processes the authentication as failed and sends it to the first terminal 10a. Notify.

That is, in the authentication method according to the embodiment of the present invention referring to FIG. 3, when an authentication information change request is received from the terminal, the account is no longer stealed by expiring all authentication tokens issued to each terminal in the account corresponding to the authentication information. This can be prevented from occurring.

For example, when the first terminal 10a is lost, a user who acquires the lost first terminal 10a may access an account of a legitimate owner of the first terminal through an automatic login function of the first terminal 10a. You may want to log in and use your account maliciously. In this case, when the legitimate owner of the first terminal 10a accesses the server 20 through the second terminal 10b and changes authentication information before being maliciously abused, the first terminal 10a automatically changes the authentication information. Since the authentication token stored for login becomes invalid, the malicious user who has lost the first terminal 10a cannot access the account of the legitimate owner of the first terminal 10a.

In addition, even if a malicious user has already accessed the account of the legitimate owner of the first terminal 10a through the first terminal 10a and steals the account, the legitimate owner may access the server 20 through the second terminal 10b. Since you can no longer steal the account after you change the authentication information by accessing, you can prevent continued account theft.

In addition, when a malicious user who has acquired the first terminal 10a changes the authentication information by accessing the server 20, the legitimate owner of the first terminal 10a is his or her account through the second terminal 10b. Even when attempting to access the authentication token, the authentication token issued to the second terminal 10b according to the change of the authentication information is also expired, and thus automatic login through the second terminal 10b is impossible.

Therefore, the legitimate owner of the first terminal 10a accessing the server 20 through the second terminal 10b may detect that his account has been stolen, change the authentication information again, and issue a previously issued certificate. You can mitigate further damage by expiring the authentication token again or by reporting the account theft to the server administrator.

Referring to FIG. 4, the terminal 10 performing the automatic login function according to an embodiment of the present invention is received from the authentication request unit 110 and the server 20 requesting authentication to the server for automatic login. The authentication token storage unit 120 stores the authentication token.

When the authentication requesting unit 110 accesses the server 20 through a browser of the terminal 10, an execution command of an automatic login function is input by a user on a web page provided by the server 20. When the server 20 generates a request command for requesting issuance of an authentication token.

A control unit (not shown) of the terminal 10 controls the request command generated from the authentication requesting unit 110 to be transmitted to the server 20, and reads the data received from the server 20 to authenticate the token. If the authentication token storage unit 120 to be stored.

The authentication request unit 110 may be installed in the terminal 10 and operate together in each application requiring authentication in order to receive a service. For example, when a game application is installed in a terminal, when the application is first executed and connected to a server providing a game service, the authentication requesting unit 110 automatically authenticates or executes an automatic login function according to a user's selection. You can request a token.

Therefore, when there are a plurality of such applications, when each application is executed for the first time, the authentication requesting unit 110 may request an authentication token for each application executed for the first time, and the authentication token storage unit 120 receives the authentication token received for each application. Can be saved.

Referring to Figure 4, the server 20 for providing an automatic login function according to an embodiment of the present invention, the token generator 210 for generating an authentication token for a user account authenticated as a party user, the generated authentication And an authentication control unit 230 that controls the token to be transmitted to the terminal 10 and expires all authentication tokens provided to each terminal 10 when a request for changing the authentication information for the account is received from the terminal 10. do.

In addition, when the authentication token provided to the terminal 10 is received from the terminal 10, it is determined whether the authentication token stored in the server 20 matches with the received authentication token and whether the authentication token is authenticated. It includes an authentication request processing unit 220 for notification, and generated from the user database 250 and the token generation unit 210, which stores the account-related information for each account, the user-related information holding each account, the terminal ( The authentication token provided in 10) includes a token storage unit 240 that is stored in association with each account.

The authentication control unit 230 instructs the token generation unit 210 to generate an authentication token when an execution command of the automatic login function is received from the terminal 10 or when authentication information related to the corresponding account is changed.

The token generator 210 generates an authentication token by using identification information of the terminal 10, account information of the user, and identification information of a service to be provided by the server 20 through authentication.

For example, if user A has an account having an ID of PPP with respect to a service server providing an SSS game and accesses his account through a first terminal, the token generator 210 of the first terminal The authentication token is generated by collecting the identification information, the PPP which is the account information of the user, and the identification information of the SSS, which is a game service to be provided.

In addition, when the user A has an account whose ID is PPP with respect to the service server that provides the SSS game and accesses his account through the second terminal, the token generator 210 identifies the second terminal. It generates the authentication token by collecting the user's account information, PPP, and identification information of the SSS, the game service to be provided.

That is, the token generation unit 210 may generate different authentication tokens provided to each terminal when accessing the same account from various terminals 10.

Similarly, when providing a plurality of game services through one account, for example, there may be a case where an A game application, a B game application, and a C game application can be used with an account having an ID of PPP.

In this case, each of the A, B, and C game applications may be requested to issue an authentication token when the game application is first executed and connected to the server 20. The token generating unit 210 may be an authentication token for authentication of the A game application. An authentication token for authentication of a game application and an authentication token for authentication of a C game application may be generated respectively. In this case, the token generator 210 may generate different authentication tokens by generating authentication tokens including identification information of each game application.

In other words, the token generation unit 210 may generate authentication tokens having different values according to a service to be used, according to a terminal to be accessed for the same account, and the token storage unit 240 may At least one authentication token generated for each account in association with the user database 250 is stored.

The token generator 210 may generate an authentication token including the time information at the time of receiving the command of generating the authentication token or the time of generation of the authentication token in the above information, and collect each piece of identification information and time information. Generates a series of data codes using, and transforms the generated data code through a hash function to encrypt.

In addition, the token generator 210 may enhance the security of the authentication token by mixing the data code with a randomly generated random code and modifying it through a hash function.

The generated authentication token is provided to the first terminal, and the first terminal stores the received authentication token, and stored when the user A accesses a service server that provides an SSS game through the first terminal. The authentication request is made by sending the to the service server.

The authentication request processor 220 checks a checksum of an authentication token issued from the token generator 210, that is, generated and provided to the terminal, so that authentication is performed.

The authentication request processing unit 220 compares the received authentication token and a checksum value of the authentication token stored in the server 10 and determines that authentication is performed if the same is the same.

Checksum is a value used to check the accuracy of data and is one of error detection methods. The checksum sends all the data sent before the end of the input data or sends the sum of all the data inputted at the end of the input data separately or at the end of the transmission data in order to check whether the data has been properly input or transmitted when the data is input or transmitted. The sum of the sums is sent separately, and the receiver of the data can check whether there is an error by summing the received values in turn and then comparing the received sum values with each other.

Accordingly, the authentication request processing unit 220 may calculate a checksum value for the data code before being encrypted with the token in the token generator 210 or calculate a checksum value for the data code constituting the encrypted authentication token. The calculated value may be stored together with the token storage unit.

According to the operation of the authentication controller 230, the authentication request processor 220 calculates a checksum value for the authentication token received from the terminal 10, and checksum of the corresponding authentication token stored in the token storage unit 240. Compare with the value to see if it matches. As a result, if the checksum value calculated from the authentication token received from the terminal 10 and the checksum value stored in the token storage unit 240 match, the authentication token received from the terminal 10 is determined to be valid and the authentication is confirmed. Notify the terminal 10 that it is.

The authentication request processing unit 220 is derived from the token as long as the data forming the token is not changed as the token generated by the token generating unit 210 of the server is stored in the server 20 and the terminal 10, respectively. The same value is used to perform authentication processing.

On the other hand, the authentication control unit 230, when receiving a request for changing the authentication information for the corresponding account from the terminal 10 is linked to the account and is no longer valid for all authentication tokens stored in the token storage unit 240 Expire.

The method of expiring the authentication token in the authentication control unit 230 is to change state information for all authentication tokens stored in the token storage unit 240 differently than before.

In more detail, all authentication tokens include status information. For example, when "OK" and "DEL" indicate the status of the authentication token, the authentication controller 230 is in the "OK" status information. You can expire the authentication token by changing the "DEL" status.

Therefore, the authentication request processing unit 220 in the process of requesting the authentication token stored in the token storage unit 240 for comparison with the authentication token received from the terminal 10, the status information of the corresponding authentication token is "DEL" If it is confirmed that it can be treated as an authentication failure.

In addition, the authentication request processing unit 220 calculates a checksum value for the authentication token received from the terminal 10 and calculates a checksum value for the authentication token stored in the token storage unit 240. If the state information of the authentication token stored in step 240 is changed from "OK" to "DEL", the checksum value calculated accordingly is also different.

Referring to the authentication method of the terminal provided by the server according to an embodiment of the present invention operating as described above briefly as follows.

First, an authentication token is generated according to a request from the terminal, and the generated authentication token is transmitted to the terminal. (S200, S210)

When receiving a change request for authentication information available for user authentication from the terminal or another terminal, the received change request is processed to be made normally, and the authentication token issued to each terminal through the terminal user's account expires. (S220 to S240)

In this case, the step of expiring the authentication token may operate by changing state information of the authentication token issued to each terminal.

Next, a new authentication token is generated for the user terminal authenticated through the changed authentication information and provided to the corresponding terminal.

In the above description, all elements constituting the embodiments of the present invention are described as being combined or operating in combination, but the present invention is not necessarily limited to the embodiments. In other words, within the scope of the present invention, all of the components may be selectively operated in combination with one or more. In addition, although all of the components may be implemented in one independent hardware, each or all of the components may be selectively combined to perform some or all functions combined in one or a plurality of hardware. It may be implemented as a computer program having a. Codes and code segments constituting the computer program may be easily inferred by those skilled in the art. Such a computer program may be stored in a computer readable storage medium and read and executed by a computer, thereby implementing embodiments of the present invention. The storage medium of the computer program may include a magnetic recording medium, an optical recording medium, and the like.

In addition, the terms "comprise", "comprise" or "having" described above mean that the corresponding component may be included, unless otherwise stated, and thus excludes other components. It should be construed that it may further include other components instead. All terms, including technical and scientific terms, have the same meanings as commonly understood by one of ordinary skill in the art unless otherwise defined. Terms commonly used, such as terms defined in a dictionary, should be interpreted to coincide with the contextual meaning of the related art, and shall not be construed in an ideal or excessively formal sense unless explicitly defined in the present invention.

The above description is merely illustrative of the technical idea of the present invention, and those skilled in the art to which the present invention pertains may make various modifications and changes without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention but to describe the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The protection scope of the present invention should be interpreted by the following claims, and all technical ideas within the equivalent scope should be interpreted as being included in the scope of the present invention.

CROSS-REFERENCE TO RELATED APPLICATIONCROSS-REFERENCE TO RELATED APPLICATION

This patent application claims priority under No. 119 (a) (35 USC § 119 (a)) of the Patent Application No. 10-2011-0120668, filed with Korea on November 18, 2011. All content is incorporated by reference in this patent application. In addition, if this patent application claims priority for the same reason for countries other than the United States, all its contents are incorporated into this patent application by reference.

Claims

In the method by which the server provides an automatic login function,

Generating and providing an authentication token to the terminal according to an automatic login authentication request from the terminal;

Receiving a request for changing authentication information available for user authentication from the terminal or another terminal;

Expiring the authentication token issued to each terminal through the account of the terminal user; And

Generating a new authentication token for the user terminal authenticated through the changed authentication information and providing the new terminal with a request for changing the authentication information;

Method for providing an automatic login function comprising a.
The method of claim 1,

The step of expiring the authentication token, a method for providing an automatic login function, characterized in that for changing the status information of the authentication token issued to each terminal.
The method of claim 1,

The authentication information is a method for providing an automatic login function, characterized in that the password for the account of the terminal user.
A token generator for generating an authentication token for a user account authenticated as a party user through authentication information received from the terminal;

An authentication control unit configured to transmit the authentication token generated from the token generation unit to the terminal, and to expire the authentication token provided to each terminal in association with the user account when a request for changing the authentication information is received.

Server providing an automatic login function comprising a.
The method of claim 4, wherein

The authentication controller is a server for providing an automatic login function, if the command to execute the automatic login function received from the terminal, the token generation unit for generating the authentication token.
The method of claim 4, wherein

The token generation unit, the server for providing an automatic login function, characterized in that for generating an authentication token using the identification information of the terminal, the user account information and the identification information of the application in which the authentication information is input.
The method of claim 4, wherein

When the authentication token provided to the terminal is received from the terminal, an authentication request processing unit for notifying the terminal whether the authentication token stored in the server and the authentication token stored in the server are identical to each other.

Server providing an automatic login function further comprising.
The method of claim 7, wherein

And the authentication request processing unit compares the received authentication token and a checksum value of the authentication token stored in the server, and determines that authentication is performed if the authentication is the same.
The method of claim 4, wherein

The authentication controller is a server for providing an automatic login function, characterized in that to expire the authentication token by changing the status information of the authentication token.
A plurality of terminals including at least one application capable of automatic login, and each storing an authentication token for automatic login of each application and an authentication token according to a change; And

When receiving an automatic login authentication request from each terminal, an authentication token is generated and provided to each terminal, and when receiving a request for changing authentication information from a first terminal of the plurality of terminals, the first terminal and the first terminal. The server for changing both the status information of the authentication token provided to the second terminals with the same user account information

System providing automatic login function comprising a.
The method of claim 10,

The server,

When the authentication information change request is received from the first terminal, a new authentication token is generated and provided to the first terminal.