WO2015105289A1

WO2015105289A1 - User security authentication system and method therefor in internet environment

Info

Publication number: WO2015105289A1
Application number: PCT/KR2014/012664
Authority: WO
Inventors: 조준호
Original assignee: 주식회사 이베이코리아
Priority date: 2014-01-09
Filing date: 2014-12-22
Publication date: 2015-07-16
Also published as: KR101633965B1; KR20150083334A

Abstract

The present invention relates to a user security authentication system and a method therefor in an internet environment. The system newly generates encrypted unique member authentication data each time by combining a validation key corresponding to current time information together with biometric information (for example, fingerprint, iris, etc.) of a user when the user logs in, as a member, to any web service provider system, such that the present invention has an effect of simply enhancing security as well as increasing the complexity of a password in a step of random access to any web service provider system.

Description

User Security Authentication System and Method in Internet Environment

The present invention relates to a user security authentication system and method thereof in an Internet environment, and more particularly, when a user logs in to any web service provider system, the user's body information (eg, fingerprint, iris, etc.). By creating a new encrypted unique authentication data each time by combining the validity key corresponding to the current time information, you can not only increase the password complexity at the connection stage of any web service provider system, but also provide simple and secure security. The present invention relates to a user security authentication system and method thereof in an Internet environment.

In general, the Internet is composed of computers that are separated from each other and can communicate with each other based on the Transmission Control Protocol / Internet Protocol (TCP / IP). Can be shared with each other.

Initially, the Internet provided services such as electronic mail, gopher, telnet, and File Transfer Protocol (FTP), but it was not widely spread due to limited services based on text.

However, the Internet has grown rapidly with the development of a new Internet service technology called the World Wide Web ("Web").

The web may provide various types of information (eg, text, images, video, audio, etc.) based on a communication protocol called HTTP (HyperText Transfer Protocol) and a language called HyperText Markup Language (HTML).

In addition, the web initially provided a hypertext for simply connecting text information by a hyperlink technique that enables direct movement from one information to another. It implements hypermedia that directly connects images, videos, and voices according to the demand for.

Accordingly, the use of the Internet and the number of networks connected to the Internet have been rapidly increased, and thus the range and contents of the information contained on the Internet have also been extensively increased.

Under such an Internet environment, various web services, such as electronic commerce, which have been conventionally applied, are being applied to the Internet using the above-mentioned advantages, and new types of web services are also being developed.

Here, in such an Internet environment, any web service provider system operates a certain user identification (member ID and password) and authentication mechanism for user management and security reasons. Therefore, each user is given certain identification information for use of any web service provider system, and a separate authentication procedure for the identification information is performed every time.

On the other hand, in the conventional user identification and authentication in the Internet environment, the user identification may be given readability in a form for remembering itself, which may lead to the exposure of personal information depending on the situation.

In addition, in the conventional user identification and authentication, personal infringement may occur due to password exposure, and password management is required for a long or difficult character combination configuration to periodically change the password or increase the complexity of the password for password management. Receive.

In particular, long character strings can be created to protect against attempts to steal random letters for account stealing through a specific program, thereby increasing the complexity against security threats from account stealing attempts. There is a problem that is difficult to do.

[Preceding technical literature]

[Patent Documents]

(Patent Document 1) Domestic Patent Publication No. 10-2007-0107395

The present invention has been made to solve the above-described problems, the object of the present invention is to provide a user with a user's body information (eg, fingerprint, iris, etc.) when the user log-in to any web service provider system (Login) By creating a new encrypted unique authentication data each time by combining the validity key corresponding to the current time information, not only can increase the password complexity at the connection stage of any web service provider system, but also can be simple and secure. An object of the present invention is to provide a user security authentication system and a method thereof.

In order to achieve the above object, a first aspect of the present invention, a user terminal is mounted a web browser; Connected to the user terminal through the Internet to transmit a web page in response to the access of the user terminal, and in response to a web service request, transmits the member authentication means to the web page of the user terminal, encrypted member from the user terminal A web server providing a web service to the user terminal in response to receiving authentication data; A member authentication information DB in which member information of users registered as members in order to receive a web service provided by the web server and member authentication data for authenticating a member are stored; And receiving encrypted member authentication data from the user terminal through the web server, decrypting it, and comparing and analyzing the decrypted member authentication data and member authentication data stored in the member authentication information DB to determine whether the user is authenticated. It includes a member authentication server to determine, wherein the member authentication means is made of a body information recognition module for receiving the user's specific body information, the member authentication data transmitted from the user terminal is a member login with the user's specific body information It is to provide a user security authentication system in the Internet environment, characterized in that the combination of the validity key corresponding to the current time information of the city consisting of newly encrypted data each time.

Here, the body information recognition module is preferably made by calling the body information recognition means pre-installed in the user terminal to receive the user's body information through the user's fingerprint or iris recognition.

Preferably, the member authentication means may be further provided with a password input module to receive a password registered during the initial membership registration with the body information recognition module.

Preferably, the member authentication data transmitted from the user terminal is composed of non-toxic encrypted digital code data arranged by randomly combining the order of the valid body key and the specific body information data of the user converted into a specific character string. Can be.

Preferably, the member authentication server receives the encrypted member authentication data from the user terminal, decrypts the user's specific body information data and the valid key, and then separates the user's specific body information data and the member. If the user's authentication data is stored in the authentication information DB and the same is compared with the specific body information data of the registered user at the time of initial membership registration, check whether the separated validity key is included within a predetermined time range, and whether the user's membership authentication is performed. You can judge.

Preferably, when the member authentication data transmitted from the user terminal further includes a password along with the user's specific body information data and the validity key, the member authentication server receives the encrypted member authentication data from the user terminal and decrypts it. After separating the user's specific body information data, validity key and password, the user's specific body information data and password and the user's specific body information registered during the initial membership registration in the member authentication data stored in the member authentication information DB If the data and the password are the same, it is possible to determine whether the user is authenticated by checking whether the separated validity key is included within a predetermined time range.

Preferably, the member authentication server, if the separated valid key is not included within a predetermined predetermined time range, may reject the member authentication of the user.

Preferably, the user terminal, when accessing the web server and logging in as a member, calls a dedicated app for recognizing the user's body information from the plug-in built in the web browser, receives the user's specific body information, and delivers the user's specific body information to the web browser. The encrypted member authentication data may be transmitted to the web server by combining the validity key together with the specific body information of the user transmitted through the web browser.

Preferably, the validity key may include digital code data that encrypts time information including a current date (year / month / day) and a time (hour / minute / second) when a user logs in.

Preferably, the user terminal is made of a smart phone that performs a shopping mall related application service, and may be configured to be connected to the web server through the shopping mall related application service.

According to a second aspect of the present invention, there is provided a method of performing user security authentication using a system including a web server and a member authentication server connected to a user terminal on which a web browser is mounted and an Internet to provide a web service. Requesting a web service to the web server through the user terminal; (b) transmitting member authentication means to a web page of a corresponding user terminal in response to the web service request in step (a) through the web server; (c) transmitting the encrypted member authentication data to the web server using the member authentication means transmitted in the step (b) through the user terminal; (d) receive the encrypted member authentication data transmitted in step (c) through the member authentication server and decrypt it, and compare the decrypted member authentication data with the member authentication data previously stored in a separate member authentication information DB. Analyzing the user to determine whether the user is authenticated; And (e) providing a web service to the user terminal through the web server when the user is authenticated as a member as a result of the determination of the step (d), in the step (b), the member The authentication means is composed of a body information recognition module for receiving the user's specific body information, in step (c), the member authentication data transmitted from the user terminal is the current time information at the time of member login with the user's specific body information To provide a user security authentication method in the Internet environment, characterized in that the combination of the validity key corresponding to the new encrypted data every time.

Preferably, in the step (c), the member authentication data transmitted from the user terminal is a non-toxic, arranged by randomly combining the order of the valid body and the specific body information data of the user converted into a specific character string It may consist of encrypted digital code data.

Preferably, in the step (d), the member authentication server receives encrypted member authentication data from the user terminal and decrypts it to separate the user's specific body information data and the valid key, and then specify the separated user's In the case where the physical information data and the member authentication data stored in the member authentication information DB are compared with the specific body information data of the user registered at the time of initial membership registration, it is checked whether the separated validity key is included within a predetermined time range. It is possible to determine whether the user is authenticated.

Preferably, when the user authentication data transmitted from the user terminal further includes a password along with the user's specific body information data and validity key, in step (d), the member authentication server is encrypted member authentication from the user terminal After receiving and decrypting the data to separate the user's specific body information data, validity key and password, and registered at the first membership registration from the member's specific body information data and password and the member authentication data stored in the member authentication information DB When comparing the specific body information data and the password of the user is the same, it is possible to determine whether the user is authenticated by checking whether the separated validity key is included within a predetermined time range.

Preferably, in the step (c), the user terminal accesses the web server and calls a dedicated app for recognizing the user's body information in a plug-in built in the web browser to log in a member to input specific body information of the user. After receiving and forwarding to the web browser, the encrypted member authentication data can be transmitted to the web server by combining the validity key with the specific body information of the user through the web browser.

Preferably, the user terminal is made of a smartphone that performs a shopping mall-related application service, it may be made to be connected to the web server through the shopping mall-related application service.

A third aspect of the present invention is to provide a recording medium on which a program for executing the user security authentication method in the above-described Internet environment is recorded.

The user security authentication method in the Internet environment using the Internet according to the present invention can be implemented in a computer-readable code on a computer-readable recording medium. Computer-readable recording media include all types of recording devices that store data that can be read by a computer system.

For example, a computer-readable recording medium may be a ROM, a RAM, a CD-ROM, a magnetic tape, a hard disk, a floppy disk, a removable storage device, a nonvolatile memory (Flash memory). Optical data storage.

According to the user security authentication system and method in the Internet environment of the present invention as described above, the user's body information (eg, fingerprint, iris, etc.) when the user logs in to any web service provider system (Login) By creating a new encrypted unique authentication data each time by combining the validity key corresponding to the current time information, you can not only increase the password complexity at the connection stage of any web service provider system, but also provide simple and secure security. There is an advantage that can be.

1 is an overall block diagram illustrating a user security authentication system in an Internet environment according to an embodiment of the present invention.

2 is a flowchart illustrating a user security authentication method in an internet environment according to an embodiment of the present invention.

3 and 4 are diagrams illustrating various methods of member login for accessing a web service provider system applied to an embodiment of the present invention.

5 is a diagram conceptually illustrating a process of encrypting member authentication data transmitted from a user terminal applied to an embodiment of the present invention.

Advantages and features of the present invention, and a method of achieving them will be apparent from the following detailed description with reference to the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but will be implemented in various forms, and only the present embodiments are intended to complete the disclosure of the present invention, and the general knowledge in the art to which the present invention pertains. It is provided to fully convey the scope of the invention to those skilled in the art, and the present invention is defined only by the scope of the claims. Like reference numerals refer to like elements throughout. “And / or” includes each and all combinations of one or more of the items mentioned.

Although the first, second, etc. are used to describe various elements, components and / or sections, these elements, components and / or sections are of course not limited by these terms. These terms are only used to distinguish one element, component or section from another element, component or section. Therefore, the first device, the first component, or the first section mentioned below may be a second device, a second component, or a second section within the technical spirit of the present invention.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. In this specification, the singular also includes the plural unless specifically stated otherwise in the phrase. As used herein, “comprises” and / or “comprising” refers to the presence of one or more other components, steps, operations and / or elements. Or does not exclude additions.

Unless otherwise defined, all terms (including technical and scientific terms) used in the present specification may be used in a sense that can be commonly understood by those skilled in the art. In addition, the terms defined in the commonly used dictionaries are not ideally or excessively interpreted unless they are specifically defined clearly.

In describing the embodiments of the present invention, when it is determined that a detailed description of a known function or configuration may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. In addition, terms to be described below are terms defined in consideration of functions in the embodiments of the present invention, which may vary according to intentions or customs of users and operators. Therefore, the definition should be made based on the contents throughout the specification.

1, a user security authentication system in an internet environment according to an embodiment of the present invention includes at least one user terminal 100-1 to 100 -N, a web server 200, and a member authentication information DB. 300, and a member authentication server 400.

Here, the user terminals 100-1 to 100 -N are connected to the web server 200 through the Internet 10, and web such as various Hyper Text Markup Language (HTML) documents provided by the web server 200. A conventional web browser is provided to take a page and display it on a screen.

That is, the user terminals 100-1 to 100 -N are connected to the Internet 10 to access a plurality of websites, for example, the web server 200, search for web pages transmitted therefrom, or view the corresponding web pages. It includes a web browser that can process the information provided by the web page or send the document.

On the other hand, the Internet 10 is a TCP / IP protocol and a number of services existing in the upper layer, that is, Hyper Text Transfer Protocol (HTTP), Telnet, File Transfer Protocol (FTP), Domain Name System (DNS), Simple Mail (SMTP). It refers to a global open computer network structure that provides a transfer protocol (SNMP), a simple network management protocol (SNMP), a network file service (NFS), a network information service (NIS), and the like, and user terminals 100-1 to 100-N. It provides an environment that allows any user of to be connected to the web server 200 to be described later. Meanwhile, the Internet 10 may be a wired or wireless internet, or may be a core network integrated with a wired public network, a wireless mobile communication network, or a portable internet.

The user terminals 100-1 to 100 -N are, for example, a computer such as a desktop PC (Personal Computer, PC), a notebook PC, but are not limited thereto. The web server 200 may be connected through the Internet 10. It may be any kind of wired / wireless communication device capable of accessing various web services by accessing the service.

For example, the user terminals 100-1 to 100 -N may be a cellular phone, a PCS phone (PCS phone), or a synchronous / asynchronous IMT- that communicates through a wireless Internet or a portable Internet. Including a mobile terminal such as 2000 (International Mobile Telecommunication-2000), in addition to a Palm Personal Computer (PDA), a Personal Digital Assistant (PDA), a Smart Phone, a WAP phone (WAP phone) phone, mobile play-station, PDA phone or any DMB (Digital Multimedia Broadcasting) phone with a communication function, such as a tablet PC, iPad (iPad), etc. All have a user interface for connecting to the web server 200 Wired and wireless home appliances / communication devices may mean comprehensively.

In particular, when the user terminals 100-1 to 100 -N are implemented as ordinary smart phones, the smart phones are various applications desired by the user, unlike ordinary mobile phones (also known as feature phones). (Application) A phone based on an open operating system that can be downloaded, used and deleted freely. It is a mobile phone that has not only functions such as voice / video call and internet data communication but also mobile office function. It is preferable that the present invention be understood as a communication device including all Internet phones or tablet PCs without a phone or voice call function but with Internet access.

Such a smart phone may be implemented as a smart phone equipped with various open operating systems, and the open operating systems may include, for example, Nokia, Symbian, Nokia, RIM, Blackberry, Apple, iPhone, Microsoft's Windows Mobile, Google's Android, and Samsung's Sea.

As such, since the smartphone uses an open operating system, a user may arbitrarily install and manage various application programs, unlike a mobile phone having a closed operating system.

That is, the smart phone basically includes a controller, a memory unit, a screen output unit, a key input unit, a sound output unit, a sound input unit, a camera unit, a wireless network communication module, a short range wireless communication module, and a battery for power supply.

The controller is a generic term for a functional configuration that controls the operation of the smartphone, and includes at least one processor and an execution memory, and is connected to each functional component provided in the smartphone through a bus.

The controller controls the operation of the smartphone by loading at least one program code included in the smartphone through the processor into the execution memory and transferring the result to the at least one function component through the bus. .

The memory unit is a generic term for a nonvolatile memory included in a smartphone, and stores and maintains at least one program code executed through the controller and at least one data set used by the program code. The memory unit basically stores a system program code and a system data set corresponding to an operating system of a smartphone, a communication program code and a communication data set for processing a wireless communication connection of the smartphone, and at least one application program code and an application data set. Program code and data sets for implementing the present invention are also stored in the memory unit.

The screen output unit includes a screen output device (for example, a liquid crystal display (LCD) device) and an output module for driving the screen output unit. The screen output unit is connected to the control unit by a bus to output a calculation result corresponding to a screen output among various calculation results of the control unit. Output to the screen output device.

The key input unit includes a key input device (or a touch screen device interlocking with the screen output unit) having at least one key button and an input module for driving the key input device, and is connected to the control unit by a bus to perform various operations of the control unit. Input a command to command or input data required for the operation of the controller.

The sound output unit includes a speaker for outputting a sound signal and a sound module for driving the speaker, and is connected to the control unit by a bus to output a calculation result corresponding to a sound output among various calculation results of the control unit through the speaker. . The sound module decodes sound data to be output through the speaker and converts the sound data into a sound signal.

The sound input unit includes a microphone for receiving a sound signal and a sound module for driving the microphone, and transmits sound data input through the microphone to the controller. The sound module encodes and encodes a sound signal input through the microphone.

The camera unit includes an optical unit, a charge coupled device (CCD), and a camera module for driving the same, and acquires bitmap data input to the CCD through the optical unit. The bitmap data may include both image data and video data of a still image.

The wireless network communication module is a general term for a communication configuration for connecting wireless communication, and includes at least one antenna, an RF module, a baseband module, and a signal processing module for transmitting and receiving radio frequency signals of a specific frequency band. Connected to a bus and transmits a calculation result corresponding to wireless communication among various calculation results of the controller through wireless communication, or receives and transmits data to the controller through wireless communication, and connects and registers the wireless communication. Maintain procedures of communication, handoff.

In addition, the wireless network communication module includes a mobile communication configuration for performing at least one connection, location registration, call processing, call connection, data communication, and handoff to a mobile communication network according to the CDMA / WCDMA standard. Meanwhile, according to the intention of the person skilled in the art, the wireless network communication module may further include a portable Internet communication configuration for performing at least one connection, location registration, data communication, and handoff to the portable Internet according to the IEEE 802.16 standard. It is apparent that the present invention is not limited by the wireless communication configuration provided by the communication module.

The short range wireless communication module is configured as a short range wireless communication module for connecting a communication session using a radio frequency signal as a communication medium within a predetermined distance, preferably, ISO 180000 series RFID communication, Bluetooth communication, Wi-Fi communication, public It may include at least one of wireless communication. In addition, the short range wireless communication module may be integrated with the wireless network communication module.

In addition, in order to implement an embodiment of the present invention, the body information recognition means (for example, made of hardware or software, etc.) to acquire specific body information (eg, fingerprint or iris) of the user in conjunction with the camera unit (eg , Apps, ActiveX programs, internal / external frameworks, etc.) are preferably installed.

The smartphone configured as described above refers to a terminal capable of wireless communication, and any device may be applied as long as the terminal is capable of transmitting and receiving data through a network including the Internet. That is, the smartphone may include at least one notebook PC, a tablet PC, and other portable and portable terminals having a short message transmission function and a network connection function.

In particular, when the user terminal (100-1 to 100-N) applied to the embodiment of the present invention is implemented as a smartphone, for example, the shopping mall-related applications (eg, auction app) that is an open market through the App Store (App Store) The program can be downloaded to perform a shopping mall related application service.

In this way, a shopping relay service such as a product or various services may be used by accessing a web server 200 of an online shopping mall system through a shopping mall related application service installed in the smart phone. That is, the seller may register various sales products or services that he or she wishes to sell through the web server 200, and the buyer may easily purchase various sales products or services registered through the web server 200 online. .

In addition, the user terminals 100-1 to 100 -N are pre-installed through, for example, a shopping mall-related application service as shown in FIG. User security authentication may be configured by a web method of calling body information recognition means (eg, an app, an ActiveX program, an internal / external framework, etc.).

In addition, the user terminal (100-1 to 100-N) is connected to the web server 200 when the member (Log-in) as shown in Figure 4 to be described later, plug-in (plug in) built in the web browser Calls a dedicated app (App) for recognizing the user's body information and receives the user's specific body information (eg, fingerprint or iris, etc.) and transmits it to the web browser, and the user's specific information is transmitted through the web browser. It is preferable to transmit the encrypted unique member authentication data to the web server 200 by combining the validity key corresponding to the current time information at the time of member login with the body information.

The web server 200 connects the user terminals 100-1 to 100 -N with an operation server (not shown) provided in an arbitrary web service provider system through the Internet 10, and provides a predetermined web. It performs a function of providing various web services of an operation server provided in an arbitrary web service provider system through a page. On the other hand, the web server 200 may perform the same function of the operation server provided in any web service provider system.

In particular, the web server 200 is connected to the user terminal (100-1 to 100-N) and the Internet 10 to transmit a web page in response to the access of the user terminal (100-1 to 100-N), Sending the member authentication means to the web page of the user terminal (100-1 to 100-N) in response to the web service request, in response to receiving encrypted member authentication data from the user terminal (100-1 to 100-N) Performs a function of providing a web service to the user terminals (100-1 to 100-N).

At this time, the member authentication means is composed of a body information recognition module for receiving the user's specific body information, as shown in Figures 3 and 4 to be described later, the body information recognition module recognizes the user's fingerprint or iris It is made by calling the body information recognition means (e.g., app, active X program, internal / external framework, etc.) pre-installed in the user terminal (100-1 to 100-N) to receive the user's body information through desirable.

In addition, the member authentication means may be further provided with a password input module (not shown) to receive a predetermined password registered during the initial membership registration with the body information recognition module.

Member authentication information DB (300) stores the member information of the users registered as members in order to receive the web service provided by the web server 200 and the member authentication data for authenticating the membership into a database (DB) for each member and Perform management functions.

In addition, the member authentication information DB 300 preferably stores a validity key corresponding to time information including a date (year / month / day) and a time (hour / minute / second) as a database (DB). .

The member authentication information DB 300 is, for example, a relational database management system (RDBMS) such as Oracle, Infomix, Sybase, DB2, Gemston, Orion, An object oriented database management system (OODBMS) such as O2 can be implemented for the purposes of the present invention, and has suitable fields to achieve its function.

Then, the member authentication server 400 is connected to each other through the web server 200 and the wired / wireless communication means, and is encrypted and transmitted from the user terminal (100-1 to 100-N) through the web server 200 It receives the member authentication data, decrypts it, and compares and decrypts the decrypted member authentication data with member authentication data stored in the member authentication information DB 300 to determine whether the user is authenticated.

At this time, the unique member authentication data transmitted from the user terminals (100-1 to 100-N) is composed of newly encrypted data each time by combining the specific key information of the user and the validity key corresponding to the current time information at the time of member login. .

In addition, the unique member authentication data transmitted from the user terminals (100-1 to 100-N) is the non-toxic user's specific body information data converted into a specific character string as shown in FIG. It is preferably made of non-toxic encrypted digital code data arranged by randomly combining the order of validity keys corresponding to the visual information.

In this case, the validity key is preferably made of digital code data that encrypts time information including a current date (year / month / day) and a time (hour / minute / second) when a user logs in.

In particular, the member authentication server 400 receives encrypted member authentication data from the user terminals 100-1 to 100 -N, decrypts it, separates the user's specific body information data and the validity key, and then separates the user. When the specific body information data of the member authentication data stored in the member authentication information DB (300) is the same by comparing the specific body information data of the user registered during the initial membership registration, the separated validity key is a predetermined time (recent 5) Minutes) to determine whether the user is authenticated.

That is, if the separated validity key is included within the predetermined time range, the user authentication of the corresponding user is accepted. If the separated validity key is not included within the preset time period, the user authentication of the corresponding user is rejected. . As a result, specific body information data of a user who may be previously generated, stored, and stolen out of the predetermined predetermined time range may be rejected.

In addition, if the member authentication data transmitted from the user terminals 100-1 to 100 -N further includes a password (eg, name, date of birth, telephone number or address) together with the user's specific body information data and validity key, The member authentication server 400 receives encrypted member authentication data from the user terminals 100-1 to 100 -N, decrypts the user's specific body information data, validity key, and password, and then separates the user. When the specific body information data and password of the user and the authentication information stored in the member authentication information DB (300) is the same by comparing the specific body information data and password of the user registered during the initial membership, the separated validity key is a predetermined schedule It may be determined whether the user is authenticated by checking whether it is included in the time range.

That is, if the separated validity key is included within the predetermined time range, the user authentication of the corresponding user is accepted. If the separated validity key is not included within the preset time period, the user authentication of the corresponding user is rejected. .

Hereinafter, a user security authentication method in an internet environment according to an embodiment of the present invention will be described in detail.

2 is a flowchart illustrating a user security authentication method in an Internet environment according to an embodiment of the present invention, and FIGS. 3 and 4 are members for accessing a web service provider system applied to an embodiment of the present invention. 5 is a diagram illustrating various methods of login, and FIG. 5 is a diagram conceptually illustrating a process of encrypting member authentication data transmitted from a user terminal applied to an embodiment of the present invention.

1 to 5, in the user security authentication method in the Internet environment according to an embodiment of the present invention, first, the user is any web service provider system through the user terminal (100-1 to 100-N) The user accesses a predetermined web page provided by the web server 200 and registers as a member.

At this time, when the user is registered as a member as shown in Figure 3 and 4, the user's specific body information (for example, fingerprint or iris) data through the body information recognition module of the member authentication means provided by the web server 200 To be stored in the member authentication information DB (300).

At this time, the body information recognition module is a body information recognition means (for example, app, active pre-installed in the user terminal (100-1 to 100-N) to receive the user's body information through the user's fingerprint or iris recognition) X program, internal / external framework, etc.) is preferable.

In addition, when a user registers as a member additionally register a password, the registered password can be stored in the member authentication information DB (300), the date (year / month / day) and time in the member authentication information DB (300) Preferably, the validity key corresponding to the time information including (hour / minute / second) is stored in advance in a database.

Then, when the user requests a web service to the web server 200 through the user terminals (100-1 to 100-N) (S100), the web server 200 in response to the web service request in step S100 The member authentication means is transmitted to the web pages of the corresponding user terminals 100-1 to 100 -N (S200). At this time, the member authentication means is preferably made of a body information recognition module for receiving the user's specific body information, as shown in FIG.

Thereafter, the encrypted member authentication data is transmitted to the web server 200 by using the member authentication means transmitted in step S200 through the user terminals 100-1 to 100 -N (S300).

At this time, the member authentication data transmitted from the user terminals (100-1 to 100-N) is preferably composed of newly encrypted data each time by combining the specific key information of the user and the validity key corresponding to the current time information at the time of member login. Do.

The validity key is preferably made of digital code data obtained by encrypting time information including a current date (year / month / day) and a time (hour / minute / second) when a user logs in.

Then, the member authentication server 400 receives the encrypted member authentication data transmitted in step S300 and decrypts it, and the member authentication data previously stored in the member authentication information DB 300 separate from the decrypted member authentication data. Comparative analysis is performed to determine whether the user is authenticated (S400).

That is, the member authentication server 400 receives encrypted member authentication data from the user terminals 100-1 to 100 -N, decrypts it, separates the user's specific body information data and the validity key, and then separates the user. When the specific body information data of the member authentication data stored in the member authentication information DB (300) is the same by comparing the specific body information data of the user registered during the initial membership registration, the separated validity key is a predetermined time (recent 5) Minutes) to determine whether the user is authenticated.

If the separated validity key is included within the predetermined time range, the user authentication of the corresponding user is accepted. If the separated validity key is not included within the preset time period, the user authentication of the corresponding user is rejected. .

In addition, when the user authentication data transmitted from the user terminals 100-1 to 100 -N further includes a password together with the user's specific body information data and the validity key, the member authentication server 400 is the user terminal 100-1. 100-N) receives encrypted member authentication data and decrypts it to separate the user's specific body information data, validity key and password, and then separates the user's specific body information data and password and member authentication information DB ( In the member authentication data stored in 300), if the same physical information data and password of the registered user are compared in the initial membership registration, the user is authenticated by checking whether the separated validity key is included within a predetermined time range. Can be determined.

Subsequently, as a result of the determination in step S400, when the decrypted member authentication data and the member authentication data stored in the member authentication information DB 300 are identical to each other and the corresponding user is authenticated as a member, the web server 200 corresponds to the corresponding member authentication data. It provides a web service to the user terminal (100-1 to 100-N) (S500).

On the other hand, the user security authentication method in the Internet environment according to an embodiment of the present invention can also be implemented as computer-readable code on a computer-readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored.

For example, the computer-readable recording medium may be a ROM, a RAM, a CD-ROM, a magnetic tape, a hard disk, a floppy disk, a removable storage device, a nonvolatile memory (Flash memory). Optical data storage.

The computer readable recording medium can also be distributed over computer systems connected over a computer network so that the computer readable code is stored and executed in a distributed fashion.

Although a preferred embodiment of a user security authentication system and a method thereof in an Internet environment according to the present invention has been described above, the present invention is not limited thereto, but is within the scope of the claims and the detailed description of the invention and the accompanying drawings. It is possible to carry out various modifications and this also belongs to this invention.

Claims

A user terminal equipped with a web browser;

Connected to the user terminal through the Internet to transmit a web page in response to the access of the user terminal, and in response to a web service request, transmits the member authentication means to the web page of the user terminal, encrypted member from the user terminal A web server providing a web service to the user terminal in response to receiving authentication data;

A member authentication information DB in which member information of users registered as members in order to receive a web service provided by the web server and member authentication data for authenticating a member are stored; And

Receive encrypted member authentication data from the user terminal through the web server, decrypt it, and compare the decrypted member authentication data with member authentication data stored in the member authentication information DB to determine whether the user is authenticated. Including a member authentication server,

The member authentication means is composed of a body information recognition module for receiving the user's specific body information, the member authentication data transmitted from the user terminal is a validity key corresponding to the current time information at the time of member login with the user's specific body information User authentication system in the Internet environment, characterized in that consisting of newly encrypted data every time.
According to claim 1,

The body information recognition module is a user security authentication system in the Internet environment, characterized in that made by calling the body information recognition means pre-installed in the user terminal to receive the user's body information through the user's fingerprint or iris recognition .
According to claim 1,

The member authentication means is a user security authentication system in the Internet environment, characterized in that the password input module is further provided to receive the registered password at the first membership registration with the body information recognition module.
According to claim 1,

Member authentication data transmitted from the user terminal is characterized in that the non-toxic encrypted digital code data arranged by randomly combining the order of the specific body information data and the validity key of the user converted into a specific character string User security authentication system in the Internet environment.
According to claim 1,

The member authentication server receives the encrypted member authentication data from the user terminal, decrypts the separated user specific body information data and the valid key, and then separates the user's specific body information data and the member authentication information DB. In the case of the same in comparison to the specific body information data of the user registered during the initial membership registration in the membership authentication data stored in the to check whether the separated validity key is included within a predetermined time range to determine whether the user authentication of the user A user security authentication system in an internet environment.
According to claim 1,

If the user authentication data transmitted from the user terminal further includes a password along with the user's specific body information data and validity key,

The member authentication server receives the encrypted member authentication data from the user terminal, decrypts the user's specific body information data, the validity key and the password, and then separates the user's specific body information data and password and the In the member authentication data stored in the member authentication information DB, when comparing the same physical information and password of the registered user at the time of initial membership registration, the user of the user by checking whether the separated validity key is included within a predetermined time range User security authentication system in the Internet environment, characterized in that for determining whether authentication.
The method according to claim 5 or 6,

The member authentication server, if the separated valid key is not included within a predetermined predetermined time range, user security authentication system in the Internet environment, characterized in that for rejecting the member authentication of the user.
According to claim 1,

When the user terminal accesses the web server and logs in a member, the user terminal calls a dedicated app for recognizing the user's body information from the plug-in built in the web browser, receives the user's specific body information, and transmits the user's specific body information to the web browser. A user security authentication system in an Internet environment, characterized in that to transmit the encrypted member authentication data to the web server by combining the validity key with the specific body information of the user transmitted through a web browser.
According to claim 1,

The validity key is a user in the Internet environment, characterized in that the time information when the user login the user's login consists of digital code data encrypted with the time information including the current date (year / month / day) and time (hour / minute / second) Security authentication system.
According to claim 1,

The user terminal is made of a smart phone for performing a shopping mall-related application service, the user security authentication system in the Internet environment, characterized in that configured to be connected to the web server through the shopping mall-related application service.
A method of performing user security authentication using a system including a web server and a member authentication server connected to a user terminal equipped with a web browser and providing a web service through the Internet,

(a) requesting a web service to the web server through the user terminal;

(b) transmitting member authentication means to a web page of a corresponding user terminal in response to the web service request in step (a) through the web server;

(c) transmitting the encrypted member authentication data to the web server using the member authentication means transmitted in the step (b) through the user terminal;

(d) receive the encrypted member authentication data transmitted in step (c) through the member authentication server and decrypt it, and compare the decrypted member authentication data with the member authentication data previously stored in a separate member authentication information DB. Analyzing the user to determine whether the user is authenticated; And

(e) providing a web service to the user terminal through the web server when the user is authenticated as a result of the determination of step (d),

In the step (b), the member authentication means is made of a body information recognition module for receiving the user's specific body information,

In the step (c), the member authentication data transmitted from the user terminal is composed of the newly encrypted data each time by combining the user's specific body information and the validity key corresponding to the current time information at the time of member login How user security authentication works in your environment.
The method of claim 11, wherein

The body information recognition module is a user security authentication method in the Internet environment, characterized in that the call made by the body information recognition means pre-installed in the user terminal to receive the user's body information through the fingerprint or iris recognition of the user .
The method of claim 11, wherein

The member authentication means is a user security authentication method in the Internet environment, characterized in that the password input module is further provided so as to receive a registered password at the first membership registration with the body information recognition module.
The method of claim 11, wherein

In the step (c), the member authentication data transmitted from the user terminal is a non-toxic encrypted digital arranged by randomly combining the order of the user's specific body information data and the validity key converted into a specific character string. User security authentication method in the Internet environment, characterized in that consisting of code data.
The method of claim 11, wherein

In the step (d), the member authentication server receives encrypted member authentication data from the user terminal, decrypts it, separates the user's specific body information data and the valid key, and then separates the user's specific body information data. And the user's member by checking whether the separated validity key is included within a predetermined time range when comparing the user's specific body information data of the registered user at the time of initial membership from the member authentication data stored in the member authentication information DB. User security authentication method in the Internet environment, characterized in that for determining the authentication.
The method of claim 11, wherein

If the user authentication data transmitted from the user terminal further includes a password along with the user's specific body information data and validity key,

In the step (d), the member authentication server receives encrypted member authentication data from the user terminal, decrypts the user's specific body information data, validity key and password, and then separates the specific body of the user. If the same information is compared with the specific body information data and password of the user registered at the time of initial membership registration in the information data and password and the member authentication data stored in the member authentication information DB, whether the separated validity key is included within a predetermined time range. Checking whether the user authentication of the user, characterized in that the user security authentication method in the Internet environment.
The method according to claim 15 or 16,

The member authentication server, if the separated valid key is not included within a predetermined time period, the user security authentication method in the Internet environment, characterized in that for rejecting the user authentication.
The method of claim 11, wherein

In the step (c), the user terminal accesses the web server and calls a dedicated app for recognizing the user's body information in a plug-in built in the web browser when the member logs in to receive the user's specific body information and receive the web. And transmitting the encrypted member authentication data to the web server by combining the validity key together with the specific body information of the user through the web browser.
The method of claim 11, wherein

The validity key is a user in an Internet environment, characterized in that the time information when the user login the user is made of digital code data, including the current date (year / month / day) and time (hour / minute / second) is encrypted Security authentication method.
The method of claim 11, wherein

The user terminal is made of a smart phone for performing a shopping mall-related application service, the user security authentication method in the Internet environment, characterized in that the connection to the web server through the shopping mall-related application services.
A computer-readable recording medium having recorded thereon a program capable of executing the method of any one of claims 11 to 20.