WO2019132214A1

WO2019132214A1 - Method and system for hybrid password authentication

Info

Publication number: WO2019132214A1
Application number: PCT/KR2018/012842
Authority: WO
Inventors: 박영경
Original assignee: 주식회사 엘핀
Priority date: 2017-12-28
Filing date: 2018-10-26
Publication date: 2019-07-04
Also published as: KR20190079964A; KR102088523B1

Abstract

The disclosed technology relates to a method and a system for hybrid password authentication, the method comprising the steps in which: a smart terminal receives authentication information from an authentication terminal disposed at a first base station having the current location in a communication range among a plurality of base stations; the smart terminal generates, by using an application communicating with the authentication terminal, a password on the basis of terminal information thereof and a code value included in the authentication information; the smart terminal transmits the password to the authentication terminal before a validation period included in the authentication information passes; the authentication terminal transmits the password and location information of the first base station to an authentication server; and the authentication server receives the password and the location information and verifies whether the password is valid. Therefore, by generating a hybrid password which is temporarily valid only in a specific space, the risk of password exposure can be prevented and a user can be securely authenticated.

Description

Hybrid password authentication method and system

The disclosed technique relates to a method and system for generating a hybrid password based on a specific location and time and thereby performing authentication.

Despite the increased investment in security for personal passwords and the protection of information, various types of hacking have caused large-scale damage cases continuously, and the secondary damage caused by exposed information is also expanding. These hacking techniques continue to evolve and technologically advance, and it is difficult to know where the user's password is hacked, so there is a limit to minimizing timely response and damage.

To overcome these problems, the authentication method using a universal password uses a method of adding additional authentication such as a mobile phone authentication, but there is still a possibility to suffer from the same method as snooping.

In recent years, new authentication schemes such as block chains and biometrics have been introduced, but there are potential risks such as private key management issues.

With reference to Korean Patent Laid-Open No. 10-2005-0118457 (entitled " user location authentication system and control method thereof "), a technique for verifying information that existed at a specific location and a specific time and authenticating the user is disclosed have. There is still a risk of hacking if there are other users in the same space and at the same time.

The disclosed technique is to provide a method and system for generating a hybrid password based on a specific location and time and thereby performing authentication for a user for a predetermined time.

According to a first aspect of the present invention, there is provided a smart terminal, comprising: receiving authentication information from an authentication terminal disposed at a first base station, the smart terminal including a current position among a plurality of base stations in a communication radius; Generating a password based on a code value included in the authentication information and an own terminal information by using an application communicating with the authentication terminal; and before the effective time included in the authentication information reaches the smart terminal, Transmitting the password and the location information of the first base station to the authentication server, and transmitting the password and the location information to the authentication server, &Lt; RTI ID = 0.0 > And to provide a sword authentication method.

According to a second aspect of the present invention, there is provided a communication system including a plurality of authentication terminals, each of which is disposed in each of a plurality of base stations and transmits authentication information to terminals located within a communication radius of a base station in which the base stations are located, A smart terminal for generating a password on the basis of a code value included in the authentication information and the terminal information of the terminal, and transmitting the password before the expiration time included in the authentication information passes, And an authentication server that receives location information on the deployed base station and receives the password from the smart terminal to verify validity of the password.

Embodiments of the disclosed technique may have effects that include the following advantages. It should be understood, however, that the scope of the disclosed technology is not to be construed as limited thereby, since the embodiments of the disclosed technology are not meant to include all such embodiments.

According to an embodiment of the disclosed technology, the hybrid password authentication method and system have the effect of securely authenticating a user by generating a hybrid password temporarily valid only in a specific space.

Also, even if they have the same space and time, they generate different hybrid passwords and use them for authentication to prevent the risk of password exposure.

1 is a flowchart of a hybrid password authentication method according to an embodiment of the disclosed technique.

2 is a block diagram of a hybrid password authentication system according to an embodiment of the disclosed technique.

3 is a diagram of a smart terminal receiving authentication information from an authentication terminal located at a base station in accordance with an embodiment of the disclosed technique.

4 is a diagram illustrating an authentication server for preventing duplication of code values using a data list according to an embodiment of the disclosed technology.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

The terms first, second, A, B, etc., may be used to describe various components, but the components are not limited by the terms, but may be used to distinguish one component from another . For example, without departing from the scope of the present invention, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component. And / or < / RTI > includes any combination of a plurality of related listed items or any of a plurality of related listed items.

It is to be understood that the singular < RTI ID = 0.0 > terms < / RTI > used herein should be interpreted to include a plurality of representations unless the context clearly dictates otherwise. And "comprises ", when used in this specification, specify the presence of stated features, numbers, steps, operations, elements, parts, or combinations thereof, Or combinations thereof, as a matter of course.

Before describing the drawings in detail, it is to be clarified that the division of constituent parts in this specification is merely a division by main functions of each constituent part. That is, two or more constituent parts to be described below may be combined into one constituent part, or one constituent part may be divided into two or more functions according to functions that are more subdivided.

In addition, each of the constituent units described below may additionally perform some or all of the functions of other constituent units in addition to the main functions of the constituent units themselves, and that some of the main functions, And may be carried out in a dedicated manner. Accordingly, the presence or absence of each component described in this specification should be interpreted as a function.

1 is a flowchart of a hybrid password authentication method according to an embodiment of the disclosed technique. Referring to FIG. 1, the hybrid password authentication method includes the following steps.

In step 110, the smart terminal 220 receives the authentication information 211 from the authentication terminal 210 disposed in the first base station including the current position among the plurality of base stations in the communication radius. As shown in FIG. 3, each base station is provided with authentication terminals for communicating with the smart terminal. When the user's smart terminal 220 is located within the communication coverage of the base station in which the authentication terminals are located, And may transmit the authentication information 211 to the terminal 220. [ The smart terminal which is out of the communication radius can not receive the authentication information 211 transmitted from the authentication terminal 210 and can not receive the authentication including the code value ABE from the authentication terminal 210 of the base station covering its position Information can be received. That is, the authentication terminals installed in each base station may broadcast their authentication information with a communication radius equal to the communication radius of the base station as in conventional cell broadcasting.

Here, the smart terminal 220 includes a mobile terminal capable of freely moving the communication radius of various base stations, as well as a terminal that can be used in a fixed state within a communication radius of a specific base station such as a PC or a notebook.

Meanwhile, the authentication information 211 broadcasted by the authentication terminal 210 includes a code value 211a and a validity time 211b. The code value 211a is information on which the authentication terminals generate the same rule or the same type of value, and transmit the generated value to the smart terminal. It is a principle that each authentication terminal generates a unique code value that does not overlap with each other. The validity time 211b indicates a time when the generated code value is in a valid state. For example, if the validity time is set to 1 hour, since the generated code value becomes meaningless data after one hour or more, a new code value is generated with reference to each offset 212 thereof. Therefore, each authentication terminal changes its code value based on the valid time.

The smart terminal 220 generates a password 222 based on the code value 211a included in the authentication information and the terminal information 221 of the smart terminal 220 using the application communicating with the authentication terminal 210. [ The code value 211a included in the authentication information 211 is used in generating the password 222. The code value 211a is used not only in the code value 211a but also in the smart terminal 220 receiving the code value 211a, And generates a password 222 by combining the terminal information 221 with the terminal information 221. Here, the terminal information 221 indicates information unique to the smart terminal 220. For example, it may be wake-up information, a serial number, or personal information or bio information of a terminal user. Based on such information, it is possible to generate a password by borrowing one of various conventional encryption methods. For example, a password may be encrypted by encrypting the terminal information with a code value, or by mixing two values according to a certain rule, and then applying a hash function. Can be generated.

Here, it is assumed that the smart terminal 220 has installed an application communicating with the authentication terminal 210 in advance. It is possible to generate the password 222 using the terminal information 221 and the code value 211a by using the password generation algorithm of the application.

In step 130, the smart terminal 220 transmits the password 222 to the authentication terminal 210 before the valid time 211b included in the authentication information 211 is displayed. As described above, the authentication information 211 includes not only the code value 211a but also the valid time 211b, and the system 200 determines that the password is valid only for the password processed before the valid time 211b passes The application installed in the smart terminal 220 automatically transmits the password 222 to the authentication terminal 210 that has provided the authentication information before the validity time 211b passes.

In step 140, the authentication terminal 210 transmits the password 222 received from the smart terminal 220 and the location information 213 of the base station of which the authentication terminal 210 is located, to the authentication server 230. Hereinafter, the base station in which the authentication terminal 210 is located is referred to as a first base station.

As described with reference to FIG. 3, only the smart terminals 220 located within the communication radius of the base station can receive the authentication information 211. At this time, it is necessary to confirm whether the smart terminal 220 actually exists in the area. For example, the hacker may falsely manipulate the GPS information of the terminal or arbitrarily change other location-based information to be located within the communication radius of the first base station, so that the authentication terminal 210 determines whether the smart terminal 220 is actually located in the field In order to primarily verify, the server 222 itself receives the password 222 from the smart terminal 220, not the server. The password 222 received from the smart terminal 220 and the location information 213 of the first base station are transmitted to the authentication server 230 to support the reliability of the password.

In step 150, the authentication server 230 receives the password 222 and the location information 213 from the authentication terminal 210 disposed in the first base station. And verifies the validity of the received password (222). In one embodiment, if the code value 211a included in the received password 222 matches the code value 211a generated by the authentication terminal 210 that transmitted the position information 213, the password 222 is valid . The authentication server 230 may communicate with the authentication terminal 210 in a wired or wireless manner and may receive the authentication information 211 generated by the authentication terminal 210 in advance.

That is, reliability is already secured between the authentication server 230 and the authentication terminal 210, and the reliability of the user's smart terminal 220 can be further confirmed. In the meantime, It is possible to perform a kind of notarization role by receiving and transmitting the password 222 of the smart terminal 220 together with the password 213. Therefore, the authentication server 230 can verify whether the user of the smart terminal 220 is a legitimate user through the authentication terminal 210. [ If the authentication fails, a message can be sent to it to restart the procedure or to block access for authentication.

Meanwhile, the authentication server 230 can communicate with a plurality of authentication terminals disposed in each base station by wire or wireless, and can monitor the authentication information generated by each authentication terminal, and if necessary, It is possible to change the information directly.

In one embodiment, the authentication server 230 wirelessly communicates with the authentication terminals located in the plurality of base stations, and can set the code values included in the authentication information for each of the authentication terminals to unique values that do not overlap with each other have. That is, the initial code value of the authentication information generated by the authentication terminal can be generated and transmitted so that the authentication servers do not overlap each other. The subsequent code value is changed according to the valid time and offset of each authentication terminal. The authentication server periodically grasps such information through the data list, thereby preventing code values from being duplicated.

In another embodiment, the authentication server 230 may communicate with wired or wireless authentication terminals disposed in a plurality of base stations, and may set the valid time included in the authentication information for each of the authentication terminals to the same cycle . That is, since each of the authentication terminals generates the authentication information including the unique code value, if the validity time is set to the same, it is possible for each authentication terminal to generate its own code value which is not duplicated at a time.

In another embodiment, the authentication server 230 may communicate wired or wirelessly with the authentication terminals disposed in the plurality of base stations to record the authentication information received from the authentication terminals, store the data list 231, It is possible to search duplicate code values by comparing the authentication information recorded in the data list 231 according to the preset cycle.

Referring to FIG. 4, assuming that the code value 401 of the authentication terminal A01 is ABC and that after the validity time 1 hour, the code value of the authentication terminal B02 is changed to DEF according to the offset, There may be a situation in which they have the same code value for two hours and for one hour.

If the duplicated code value is detected as described above, the authentication server 230 sends a control signal to the corresponding authentication terminal so as to change the code value and the validity time of the at least one authentication terminal that generated the duplicated code value to an arbitrary value Lt; / RTI > That is, the authentication server 230 can change the code value and effective time of A01 to an arbitrary value or change the code value and effective time of B02 to an arbitrary value. When the authentication server 230 confirms that the code value is duplicated in the received authentication information according to the order of receiving the authentication information, the authentication server 230 transmits a control signal to the authentication terminal that has transmitted the authentication information, Can be changed. Thus, it is possible to generate a hybrid password valid only for a specific time in a specific place and use it for authentication, thereby preventing the risk of password exposure and securely performing authentication for the user.

2 is a block diagram of a hybrid password authentication system 200 according to an embodiment of the disclosed technique. Referring to FIG. 2, the hybrid password authentication system 200 includes an authentication terminal 210, a smart terminal 220, and an authentication server 230.

The authentication terminal 210 broadcasts a code value 211a in an area which is disposed in each of a plurality of base stations and which is the same as the communication radius of the base station in which the base station is located. In one embodiment, a code value 211a may be transmitted to a smart terminal 220 located within a communication radius, such as transmitting a message in a cell broadcasting manner.

The smart terminal 220 generates a password 222 based on the code value 211a and the terminal information 221 thereof using an application communicating with the authentication terminal 210 and broadcasts the password 222 together with the code value 211a And transmits the password 222 before the validity time 211b is displayed. In one embodiment, the terminal information such as the wicket information may be encrypted with a code value or the code value may be encrypted with terminal information to generate a password. The password generation technique can be variously generated by applying various conventional password generation techniques.

The authentication server 230 receives the location information 213 from the authentication terminal 210 and receives the password 222 from the smart terminal 220. 1, the authentication terminal 210 receives and transmits the password 222 of the smart terminal 220. Since the smart terminal 222 is also a terminal having a built-in communication function, The password 222 can be transmitted. Of course, it would be appropriate to transmit the password 222 after the authentication server 230 is connected in advance or the authentication server 230 is requested to transmit the password 222.

It is also possible that the smart terminal 220 receives the location information 213 together with the authentication information 211 from the authentication terminal 210. That is, the authentication server 230 directly performs communication with the authentication server 230, and transmits the password generated by the authentication server 230 and the location information 213 received from the authentication terminal 210 together.

The location information 213 is information indicating the location of the base station where the authentication terminal 210 is located. For example, it may be a coordinate point of the base station or an ID value of the base station. The location information 213 is information for verifying whether the password 222 received from the smart terminal 220 is valid or not. The code value 211a used for generating the password 222, for example, If it matches the one generated by the terminal 210, it can be verified that the password 222 is valid. The authentication server 230 communicates with a plurality of authentication terminals by wire or wireless before receiving the password 222 from the smart terminal 220 and receives the respective authentication information, It is possible to verify whether the password 222 is generated by receiving the authentication information 211 from the authentication terminal 210 of the base station covering the point where the smart terminal 220 actually exists. Therefore, it is possible to verify whether the password 222 is generated by the normal access, and furthermore, it is possible to cope with the place and time when the password 222 can be utilized, even if it is leaked to the outside.

Although the hybrid password authentication method and system according to an embodiment of the disclosed technology has been described with reference to the embodiments shown in the drawings for the sake of understanding, it is to be understood that those skilled in the art It will be appreciated that variations and equivalents of other embodiments are possible. Accordingly, the true scope of protection of the disclosed technology should be determined by the appended claims.

Claims

The smart terminal receiving authentication information from an authentication terminal located at a first base station including a current location among a plurality of base stations in a communication radius;

Generating a password based on a code value included in the authentication information and the terminal information of the smart terminal using an application communicating with the authentication terminal;

The smart terminal transmitting the password to the authentication terminal before the effective time included in the authentication information ends;

The authentication terminal transmitting the password and the location information about the first base station to an authentication server; And

And the authentication server receiving the password and the location information and verifying validity of the password.
The method according to claim 1,

Wherein the authentication terminal changes the code value based on an offset stored in advance when the validity time of the authentication information exceeds the validity time.
The method according to claim 1,

The authentication server communicates with the authentication terminals located in the plurality of base stations in a wired or wireless manner and performs a hybrid password authentication in which code values included in the authentication information for each of the authentication terminals are set to unique values that do not overlap with each other Way.
The method according to claim 1,

Wherein the authentication server communicates wired or wirelessly with the authentication terminals disposed in the plurality of base stations and sets the valid time included in the authentication information for each of the authentication terminals to the same cycle.
The method according to claim 1,

Wherein the authentication server stores a data list in which authentication information for each of the authentication terminals is communicated by wired or wireless communication with the authentication terminals disposed in the plurality of base stations, Comparing the authentication information with each other, and if a duplicate code value is found, transmitting a control signal to change the code value and the validity time of the at least one authentication terminal that generated the duplicate code value to an arbitrary value.
2. The method of claim 1, wherein verifying the validity comprises:

Wherein the authentication server verifies that the password is valid if the code value included in the password received by the authentication server matches a code value generated by the authentication terminal that transmitted the location information, and performs a hybrid password authentication Way.
A plurality of authentication terminals arranged in each of a plurality of base stations and transmitting authentication information to terminals located within a communication radius of a base station in which the base stations are located;

A smart terminal for generating a password based on a code value included in the authentication information and an own terminal information by using an application communicating with the authentication terminal and transmitting the password before a valid time included in the authentication information is reached; And

And an authentication server for receiving location information on the base station from which the authentication terminal is located and receiving the password from the smart terminal to verify validity of the password.
8. The method of claim 7,

Wherein the authentication terminal changes the code value based on an offset stored in advance when the validity time of the authentication information exceeds the validity time.
8. The method of claim 7,

Wherein the authentication server communicates with the plurality of authentication terminals in a wired or wireless manner and sets a code value included in the authentication information of each of the plurality of authentication terminals as a unique value that does not overlap with each other.
8. The method of claim 7,

The authentication server may previously store a data list in which authentication information for each of the plurality of authentication terminals is recorded by communicating with the plurality of authentication terminals in a wired or wireless manner, And transmits a control signal to change a code value and an effective time of at least one authentication terminal that has generated the duplicated code value to an arbitrary value.
8. The method of claim 7,

Wherein the authentication server verifies that the password is valid if the code value contained in the received password matches that generated by the authentication terminal that transmitted the location information, and performs authentication using the password.