KR100563544B1 - Method for authenticating a user with one-time password - Google Patents

Abstract

A user authentication method using a one time password is disclosed. As the authentication ID of the user pre-registered in the authentication server is transmitted from the user's phone to the authentication server using SMS, the authentication server generates a one-time password. The authentication server sends a one-time password to the user's phone using SMS. The user can know the one-time password through the user's phone, and the user enters the one-time password on the user's computer and sends it to the authentication server. The authentication server determines whether the received one-time password matches the one-time password generated by the authentication server and authenticates the user if the authentication password matches. According to this, since a randomly generated one-time password is input at the time of authentication, the theft authentication by hacking or exposure of a password is prevented. In addition, since the one-time password generation path is separated from the connection path to the website requiring authentication, theft is inherently prevented.

Authentication, Password, Disposable, Short Message, Phone

Description

How to authenticate a user using a one-time password {Method for authenticating a user with one-time password}

1 shows a system for user authentication in accordance with the present invention, and

FIG. 2 is a diagram illustrating a user authentication process performed by the system of FIG. 1.

The present invention relates to a user authentication method using a one-time password, and more particularly, to accurately authenticate a user in a field requiring verification of a true user, such as Internet banking or payment for purchase of an item in an online shopping mall. It is about a method.

Due to the development of the Internet, various activities on the web are possible, and the user's authentication is often required depending on the importance of the activities. For example, if you want to make a payment using a credit card or a mobile terminal for a purchase price in an online shopping mall, or if you want to perform a wire transfer of money deposited in a user's account in Internet banking, or sign up for the website itself. Even if allowed, the real name verification of the individual is strictly required, or even a registered web site may require a real user confirmation on subsequent access. As such, as the activity on the Internet is diversified, authentic user authentication becomes an increasingly important prerequisite.

The most common and basic method of authentication is to enter a connection ID and password when connecting online. Furthermore, in areas where authentication is very important, such as Internet banking, a separate security card can be issued to enter a code assigned to a specific serial number on the security card to identify a user who has a security card as a true user. This may be used in combination. In addition, in recent years, the user has to store the certificate issued to each individual by the state or an authorized institution on the computer, and the user accesses only by using the computer where the certificate is stored, and also requires the user to input the certificate number. Sometimes a method of verifying authenticity is used in combination.

By the way, it was found that it was possible to access and steal outsiders through hacking, etc., and this became a social problem. In other words, it is possible to access the computer of another person through hacking and to monitor the whole process that the other person inputs through the keyboard, so that the user can enter into the hacked public authentication number or the number on the security card. do. In addition, it is also possible to monitor the work of others while displaying the same screen on their own monitor and the same screen displayed on the monitor of another person's computer. Even if the software for security is developed and the process necessary for authentication is doubled, there is a limitation that it is very difficult to prevent the theft of others.

As a viable alternative to this problem, a one-time password hiring method has been proposed. The one-time password is randomly generated and assigned to the user as a different number or code each time. By creating a one-time password generation route from the user's access to the Internet, it prevents the one-time password from being hacked by others.

At this time, generation of the one-time password is performed by a device made exclusively. That is, the user has a device for exclusive use of generating a one-time password, and generates a one-time password through this device. At this time, the device transmits the one-time password generated by the device to the authentication server that performs authentication, or by synchronizing the device and the authentication server by hardware or software configuration, the device generates a random one-time password by the authentication server side. Make a mechanism to know Therefore, when a user receives a randomly generated one-time password using his device and inputs the one-time password thus obtained from a website requiring authentication, the website is inputted by the user through the authentication server side. The user is authenticated by verifying that the password is the same as the one-time password generated for authentication.

In this manner, authentication is performed only for a user who has a device for generating a one-time password, and the generation of the one-time password is irrelevant to the website access path. Therefore, even if hackers hack other authentication passwords of the user, it is impossible to detect a one-time password generated as a different number every time, thereby enabling user authentication that is secured from risks such as hacking.

However, such a conventional one-time password authentication method has various problems apart from the reliability of authentication.

That is, from the user's point of view, a device for generating a one-time password must be provided as an auxiliary means of authentication, and a certain price (typically about $ 100 to $ 150) must be paid for the device purchase. This is very expensive in view of the statistics that a typical Internet banking user performs a wire transfer through the Internet banking several times a month.

In addition, since the user can carry out Internet banking and the like only while carrying the device separately, the use thereof becomes very inconvenient. Since a device such as a mobile phone is used for always-on communication, it may not be inconvenient for the mobile device itself, but carrying a separate device for generating a password for authentication is very inconvenient. In the case of a security card, it does not cause much inconvenience because it only has one more credit card sized card, but it is very inconvenient to carry such a device that must be configured as an electronic device.

In addition, the one-time password generation method using such a device should be provided separately to enable the authentication server to know the one-time password randomly generated by the device in any form. As a means of this, there may be a method of enabling the device itself to communicate with the authentication server, but when implementing such a communication device, the price of the device is greatly increased. In addition, even if the device itself is synchronized with the authentication server, the password generated by the device and the password generated or recognized by the authentication server do not match due to synchronization failure or any other error. Can not be made successfully, the reliability of the operation can be lowered.

The present invention has been made to solve the above problems, an object of the present invention is to generate a one-time password to be input at the time of authentication randomly, but it is possible to give the reliability of authentication by separating the generated path from the web access path In addition, the present invention provides an authentication method capable of reliable accuracy authentication, low cost implementation, and no inconvenience such as carrying a specific device.

The user authentication method using a one-time password according to the present invention for achieving the above object, (a) the authentication ID of the user pre-registered in the authentication server is transmitted from the user phone to the authentication server using the SMS, the The authentication server generating a one-time password; (b) the authentication server transmitting the one-time password to the user's phone or a phone designated by the user using SMS; (c) the authentication server is transmitted as the one-time password is transmitted from the user computer to the authentication server by inputting the one-time password received through the user telephone or the telephone designated by the user to the user computer. Determining whether the one-time password matches that generated in step (a); (d) if it is determined to match in step (c), authenticating the user by the authentication server.

The authentication server stores the telephone number of the user's telephone in advance with the authentication ID from the user. In this case, the method may further include determining whether the correspondence with the stored telephone number corresponds to the authentication ID. In the step (a), the authentication server generates the one-time password when it is determined that the corresponding in the step (a-1).

In the step (a-1), it is preferable that the correspondence is determined by comparing the telephone number recognized using the CID function of the user telephone with the telephone number stored corresponding to the authentication ID.

As another example, in step (a-1), whether or not the correspondence is determined may be determined by comparing the number input by the user as the originating telephone number of the SMS with the telephone number stored corresponding to the authentication ID. have.

According to a preferred embodiment of the present invention, the authentication server additionally performs a step of transmitting a request for performing an auxiliary authentication procedure for the user to the user computer. Preferably, the user authentication in step (d) is performed when the user is further verified by the auxiliary authentication procedure performed by the user.

According to the present invention, since a randomly generated one-time password is input at the time of authentication, the theft authentication due to hacking or exposure of the password is prevented. In addition, since the one-time password generation path is separated from the connection path to the website requiring authentication, theft is inherently prevented.

On the other hand, according to the present invention, there is provided a recording medium recording a computer-readable program recording a program for performing a user authentication method using a one-time password as described above.

Hereinafter, the present invention will be described in more detail with reference to the accompanying drawings.

In the description of the present invention, each server, computer, terminal, telephone, etc. may be replaced by other equivalent devices that perform the same function. Therefore, it should be understood that the case where a device such as a server or a computer is replaced with another device that performs the same function without being included in the technical spirit of the present invention. In addition, each server or the like may be implemented as one server, or may be configured as a plurality of servers each performing its detailed function, and those shown by several servers may be implemented as one server.

1 is a view showing a system for user authentication according to the present invention, a view showing an example in which the technical spirit of the present invention is most concise. In other words, the present invention focuses on a process for authentication, where such authentication method is implemented depending on its use, for example, for internet banking or for allowing subscription or access to a website. Process will vary.

The system for user authentication according to the present invention is configured as an authentication server 100, a user computer 200, a user telephone 300, and a telecommunications company server 400. The authentication server 100, the user computer 200, and the mobile communication server 400 are connected to each other to enable mutual data communication through a network such as a wired or wireless Internet network.

The authentication server 100 is a server that ultimately performs authentication for a user. The authentication server 100 may be a server that requires authentication of a user, or may require authentication such as an account management server of a bank. It may be a server that performs an authentication operation in association with another server.

The user computer 200 is a terminal that allows a user to access a website and perform a specific task on the web. The user computer 200 may be a desktop computer or a notebook computer, as well as a PDA or a wireless Internet access mobile phone. It is to be understood as a generic term for the same device.

The user phone 300 is a user's phone using the user computer 200, and it will be most typical to be implemented as a general mobile phone. However, in the present invention, the user phone 300 is used as a device that collectively refers to a terminal capable of providing a short message service (SMS), and thus, a general landline telephone having a short message transmission / reception function in addition to a mobile phone. Or the like. In addition, as another example, the user telephone 300 of the present invention may be configured as a data communication terminal such as a general computer. That is, recently, a service for transmitting a text message to a specific phone number by using a messenger or accessing a specific website has been provided, and when such a service is used, the user telephone 300 may be implemented as a data communication terminal. will be.

Mobile communication server 400 is a server that functions to send a short message between the user phone 300 and the authentication server (100). That is, the mobile communication server 400 allocates a special number (for example, a phone number such as 010-2000-1234) to the authentication server 100, and the target phone number of the text message transmitted from the user's phone 300 is In the case of this special number, the text message is transmitted to the authentication server 100. Conversely, the mobile communication server 400 transmits the text message transmitted by the authentication server 100 to the phone of the target phone number.

Hereinafter, a user authentication process performed by the system of FIG. 1 will be described with reference to FIG. 2. Since the telecommunications company server 400 manually performs only a short message transmission function between the user phone 300 and the authentication server 100, the illustration is omitted for convenience of description.

S10  step :

A user joins the authentication server 100 as a member using the user computer 200. Here, although illustrated and described as a member to the authentication server 100 for convenience of explanation, for example, in the case of Internet banking, membership will be performed for the bank server (not shown), the authentication server 100 will be later When performing the authentication operation, personal information registered in the bank server will be inquired.

In order to register as a member, the user first accesses the authentication server 100 (or a bank server, etc.) and enters information for membership. When signing up, the user specifies the basic access ID and password, and also enters the personal information required by the website.

In the present invention, the identification ID is specified separately and inputted separately from such personal information. The ID for authentication is an ID that a user must input in order to generate a one-time password later. Therefore, the ID is actually a password.

As the authentication ID, the access ID itself may be used, or the access password itself may be used. However, when considering the characteristic of additional information for authentication, it is preferable that the authentication server 100 manages the security level as separate data by generating a separate authentication ID in addition to the access ID and the access password. In addition, in the case of setting a separate ID for authentication as described above, the operation of inputting the ID for authentication is performed only once at the time of membership registration, so that there is no risk of being hacked since no re-entry of the ID for authentication is involved. .

In addition, the present invention requires that the user enters the telephone number of the user's telephone 300 as the personal identification information that the user inputs when registering. The user phone 300 should be a phone capable of transmitting and receiving SMS, and since it should be used for authentication according to the present invention, information on this should be managed by the authentication server 100 as a very high security level.

S20  step :

After completing the membership, the user later accesses a specific website. At this time, the specific website to be accessed will be a bank server in the case of Internet banking as described above, and for convenience of explanation, it is assumed that the present embodiment connects to the authentication server 100.

In order to connect to the authentication server 100, a user inputs a connection ID and a connection password specified by the user when registering. When the connection ID and the connection password are confirmed to be registered members, the authentication server 100 allows the user to access.

S30  step :

When a user who is permitted to access requires authentication as a premise of performing a specific task, such as when a user wants to perform a specific task such as a wire transfer or the like, the user must perform basic authentication. This basic authentication operation is performed as any one or a combination of conventional general authentication operations. That is, the basic authentication may be performed in such a manner as to allow the user to input a code corresponding to a specific serial number in the security card previously issued or to have a public certificate and enter a public certification number. In addition, it may be performed in a manner of inputting a password provided separately for an account transfer operation.

This basic authentication operation is added to the one-time password input method of the present invention as described below, which is employed to guarantee more complete authentication, this process is omitted and only authentication by the one-time password input method of the present invention is performed. You can also

S40  step :

When the authenticity of the user is verified to some extent as a result of performing the basic authentication process, the authentication server 100 performs the authentication operation by the one-time password according to the present invention.

This authentication operation is initiated by requiring the authentication server 100 to enter a one-time password into the user computer 200. That is, the authentication server 100 provides a one-time password input window with a guide phrase for inputting a one-time password to the user computer 200. In this case, the instructions include a method of generating a one-time password (for example, "transfer the authentication ID specified by the member at the time of registration using a member's phone to the text message to 010-2000-1234, and will be returned after the transmission. It is desirable to include a phrase such as "Please enter the number listed in the text message in the window below."

S50  step :

The user transmits the authentication ID as a text message to the special number designated according to the contents guided by the guide phrase using the user's telephone 300. The transmitted authentication ID is transmitted to the authentication server 100 by the mobile carrier server 400.

The authentication server 100 recognizes the telephone number of the user's telephone 300 which transmitted the text message using the CID (Caller Identification) function. At this time, the CID function may be provided in the authentication server 100 itself, or may be implemented by receiving the telephone number of the caller by the authentication server 100 in advance requesting the mobile communication server 400.

In addition, the authentication server 100 extracts the contents included in the text message.

S60  step :

The authentication server 100 is a user phone 300 that the user specified at the time of membership registration in step S10 to the content (that is, the ID for authentication) extracted from the phone number and the text message of the user phone 300 recognized through the CID function Compare with phone number and ID for authentication. If both of them match the previously registered and transmitted, the user phone 300 is verified, accordingly, the authentication server 100 is that the current user of the user phone 300 is the same as the user registered in step S10 To judge.

S70  step :

As the user phone 300 is verified, the authentication server 100 generates a one-time password. At this time, it is preferable that the one-time password is generated in a random manner. Alternatively, one-time password pool of several hundred thousand pieces may be provided and generated by selecting any one of them.

In addition, the one-time password may be generated as only numbers, or may be generated as numbers, letters, special characters, or the like, or a combination thereof.

S80  step :

The authentication server 100 transmits the generated one-time password to the phone number of the user phone 300. Accordingly, the one-time password is transmitted to the user phone 300 by the telecommunication company server 400. Therefore, the user can know the one-time password to be entered by inquiring the text message received on his phone 300.

S90  step :

The user manipulates the user computer 200 to input the one-time password included in the text message received by the user's phone 300, and transmits it to the authentication server 100 when the input is completed.

S100  step :

The authentication server 100 determines whether the one-time password inputted by the user matches the one-time password generated in step S70 and transmitted to the user phone 300 in step S80. If the result of the determination is identical, the currently connected user is authenticated as a true user. Accordingly, authentication of the user according to the present invention is completed. For the authenticated user, measures such as allowing wire transfer transfer in Internet banking, allowing payment of a purchase price, or allowing access to a website are taken.

According to the present invention, since a one-time password that is used only once and discarded is generated in a random manner, a password or the like is exposed by hacking, thereby preventing the possibility of hackers maliciously impersonating another person to authenticate. In particular, since the generation and transmission route of the one-time password is different from the access path of the website, the possibility of one-time password hacking is fundamentally blocked.

In addition, compared to the conventional method of generating a one-time password using a specific device, there is no inconvenience incurred by the cost burden and possession of a specific device purchase, and can be authenticated using a mobile phone that is always carried. easy.

In the present invention, even if the authentication ID is exposed to others by hacking or carelessness, it is impossible to perform malicious authentication by another person as long as the user owns the mobile phone. Malicious authentication will not be possible unless you know it.

Therefore, by additionally performing a simple operation of sending an SMS, the user can receive a complete authentication with little possibility of hacking and theft, thereby preventing problems such as security or theft, which are recently caused by Internet banking. do.

Such a preferred embodiment of the present invention can be implemented by modifying in the following manner.

Variant  One.

In the above-described embodiment, in step S10, the phone number of the user's phone 300 to be used for authentication along with the ID for authentication is entered. However, it is also possible to input only the ID for authentication without inputting the telephone number of the user telephone 300.

In this case, since authentication does not have to be performed using only one phone 300 designated by the user in advance, the reliability of the authentication itself may be somewhat lowered, but the convenience of the user is increased.

That is, the user transmits the authentication ID as a text message to the authentication server 100 by using any phone other than a specific registered phone after receiving the authentication password input request from the authentication server 100 in step S40. Then, the authentication server 100 identifies the user who registered the authentication ID using only the received authentication ID, and recognizes the telephone number of the phone that transmitted the authentication ID using the CID function, and then recognizes it in step S80. A one-time password to your phone number. Since the authentication server 100 knows the user of the authentication ID corresponding to the one-time password transmitted, it is possible to authenticate the authenticity of the currently connected user when the one-time password matches in step S100.

Variant  2.

In the above-described embodiment, the telephone number of the user's telephone 300 is recognized using the CID function and compared with the telephone number in the registered user's personal information. However, it is possible to take a way to confirm that the user knows the registered phone number while enabling the user to transmit the ID for authentication using a phone other than the phone of the registered phone number.

For example, in step S50, the user can transmit a text message including the ID for authentication by using a mobile phone of another person, and at this time, input the phone number registered at the time of membership registration in step S10 as the sending phone number of the text message sender. Adopt a method to send it. Normally the sender's phone number is automatically displayed on the text message recipient's mobile phone, but if the user sends a different number as the sender's outgoing phone number when sending a text message, the sender's phone number is changed. Is indicated as. This modified example 2 utilizes this point, even when the sender's telephone number is changed to match the telephone number registered in the authentication server 100 and sent (that is, the telephone number of the registered telephone number is directly owned by the user. Although the phone number you registered is indirectly proved to be remembered), you will be allowed to authenticate.

According to the second modified example, even if the mobile phone is not temporarily carried, there is an advantage that transfer operations such as urgent money transfer can be performed without difficulty.

On the other hand, the present modification 2 is to prepare for the case that you do not have a mobile phone temporarily in this way, in the case of the second variation 2, the target of the authentication server 100 to transmit the one-time password in step S80 is the user S10 It is preferable to use the telephone number of the telephone (which can be known using the CID function) that transmits the text message instead of the telephone number previously registered in the step.

Variant  3.

In step S80, the one-time password may be sent to the phone number registered by the user in step S10 as in the above-described embodiment, and transmits the current authentication ID as in the above-described modifications 1. and 2. The phone number of a telephone can be recognized and transmitted to the recognized telephone number using the CID function. Furthermore, in the third modified example, the modified example is transmitted to the one-time password specified by the user.

At this time, the designation of the telephone number to be transmitted by the user may be made in various ways.

For example, when transmitting an ID for authentication as a text message, a method of including a phone number to receive a one-time password in a text message may be included. In this case, the authentication server 100 extracts the authentication ID and at the same time extracts the telephone number added and added to the authentication ID to determine the transmission target of the one-time password.

As another example, when performing the member registration procedure in step S10, it is possible to designate a phone number to receive a one-time password to be generated for later authentication along with the registration of the authentication ID. According to this method, the generated one-time password is transmitted as a text message to the telephone of the telephone number previously designated by the user. In this case, the number of telephones designated by the user may be one or several. In addition, if there are several people, the priority is set to send the one-time password to the high priority phone number, and then the phone of the next rank under certain conditions (for example, if the step S90 is not performed by the user even after a predetermined time). You can also send a one-time password to the number.

As described above, according to the present invention, since a randomly generated one-time password is input at the time of authentication, theft authentication due to hacking or exposure of the password is prevented. In addition, since the one-time password generation path is separated from the connection path to the website requiring authentication, theft is inherently prevented.

In addition, since it is possible to generate a one-time password using a mobile phone that is usually carried without the inconvenience and cost of purchasing a specific device, it is provided with the advantage of low cost and convenience.

Although the above has been illustrated and described with respect to the preferred embodiment of the present invention, the present invention is not limited to the specific specific embodiment described above, and those skilled in the art will be various within the scope without departing from the scope of the present invention. Modifications may be made and such modifications are within the scope of the claims of the present invention.

Claims (6)

(a-1) storing, by the authentication server, the telephone number of the user's telephone with the authentication ID designated by the user in advance and received from the user; (a-2) As the authentication ID of the user is transmitted from the user's telephone to the authentication server using SMS, the authentication server transmits the telephone number of the user's telephone using the CID function. Recognizing; (a-3) Step (a-1), wherein the authentication server recognizes the authentication ID and the telephone number recognized using the CID function, which are included in the SMS in step (a-2) and transmitted. Determining whether the authentication ID and the telephone number of the user's telephone stored in advance match with the user's telephone; (a-4) generating a one-time password when the authentication server is determined to match in step (a-3); (b) the authentication server transmitting the one-time password to the user's telephone using SMS; (c) the one-time password is transmitted from the user computer to the authentication server by inputting the one-time password received through the user telephone to the user computer, so that the authentication server returns the one-time password to (a- Determining whether it matches with the one generated in step 4); And and (d) authenticating the user by the authentication server when it is determined to be matched in the step (c). delete delete delete The method of claim 1, The authentication server further comprises the step of transmitting a request for performing a secondary authentication procedure for the user to the user computer, The user authentication in the step (d) is a user authentication method using a one-time password, characterized in that the user is further verified by the secondary authentication procedure performed by the user. A recording medium having a computer readable program recorded thereon, which records a program to be performed, using the one-time password according to claim 1 or 5.

Images