KR100664680B1 - Method for managing plural kind of passwords and portable apparatus implementing the method - Google Patents

Abstract

A method for managing multiple passwords and a portable management device for the same are provided to enable a user to check the desired password by transmitting a password list to a management terminal including a password management program while storing the password list to an accessory type portable password management device. A memory(210) stores a user certification number for accessing the program and the password list of management targets. A communication(230) interface exchanges various kinds of data with the management terminal. A controller(240) receives the password through an input part(220) and transmits the received password to the management terminal if the management terminal requests the user certification number, and transmits the stored password list to the management terminal by a password list request of the management terminal. If a self-certification request is received from the management terminal, the controller compares the received password with the user certification number, and informs the management terminal of a self-certification success or failure.

Description

Method for managing plural kind of passwords and portable apparatus implementing the method

1 is a schematic configuration diagram of a password management system according to the present invention.

2 is an internal configuration block diagram of a password management device according to the present invention.

3 is a block diagram illustrating an internal configuration of a relay device of a password management system according to the present invention.

4 is a flowchart showing sequentially each step of the password management method according to the present invention.

Figure 5 is a screen of one embodiment of a reference information setting step of the password management method according to the present invention.

Figure 6 is a screen of an embodiment of a user authentication step of the password management method according to the present invention.

Figure 7 is a screen example of the password list output step of the password management method according to the present invention.

The present invention relates to a method for reading a desired password through a portable password management device (hereinafter referred to as "managing device") and a terminal (hereinafter referred to as "managed terminal") installed a predetermined password management program.

As the communication environment has evolved, many sites can be accessed through the Internet to provide desired services. Some of the services provided online can be used by anyone without any special user restrictions. However, in some sites such as e-commerce or home banking, membership registration is essential. In order to distinguish each user during registration, registration of member ID and password is required. Is asking.

In the latter case, the same ID and password may be used to sign up each site, but this is a security problem because it is possible to invade all the sites used by the user by identifying only one ID and password. When registering different ID and password for every site, apart from the enhanced security, there was a hassle of forgetting the ID or password when not connected for a long time.

Moreover, given the addition of various authentication codes for electronic transactions, passwords for bank transactions, and passwords set in electronic documents, in addition to these websites, the number of passwords to be remembered by users is out of reach. Although it can be seen, it is true that there is no disclosure about means for verifying and managing regardless of location while managing the various types of ID and / or password related information.

The present invention has been proposed to solve the above problems, while storing the password list in the portable type password management device of the accessory type, if necessary, by transmitting the list to the management terminal that is provided with a predetermined password management program desired password The purpose is to make sure that.

Another object of the present invention is to be able to modify or add a password list through a password management program installed in the management terminal.

Another object of the present invention is to enhance security by encrypting data exchanged between a portable password management device and a management terminal.

Another object of the present invention is to simplify the input unit of the portable password management device and to generate various combinations of passwords through a key input pattern.

The present invention for achieving the above object relates to a method for reading and managing a desired password through a portable password management device (hereinafter referred to as "management device") and a terminal (hereinafter referred to as "management terminal") is installed a predetermined password management program. In addition, a first step in which a password management program is executed in a management terminal and a user authentication number (hereinafter referred to as 'first authentication number') received from a management device are stored in advance in the management terminal (hereinafter referred to as “second authentication number”). And a third step of authenticating whether or not the user is a party user, and a third step of receiving a password list from the management device and outputting the password list to the screen only when the user is authenticated as a party user.

In this case, when the second authentication number is not stored in the management terminal in advance, the method may further include the step of requesting self-authentication to the management device and performing the third step only when the self-authentication success is notified from the management device. Here, the self-authentication in the management device is a step of receiving a predetermined password through the input unit of the management device, comparing the input password and the user authentication number stored in advance in the management device, and if both match the management terminal Notifying the self-authentication success, and if it does not match may be to the step of notifying the self-authentication failure to the management terminal.

The method may further include modifying a specific field of a specific record among the password list output to the management terminal, and transmitting the backup of the modified password list to the management device, adding a new record to the password list, and The method may further include transmitting a password list to which the new record is added to the management device to back up the password list.

Here, each record of the password list includes a description field and a password field of the password.

Meanwhile, the modification of the specific field or the addition of a new record may be performed through the input means of the management terminal or may be performed through the input unit of the management device.

The method may further include setting a communication interface type and a communication speed for performing communication between the management terminal and the management device, requesting a user authentication number from the management device according to the set communication interface type and the communication speed, and setting the communication. The reference information setting step of storing the interface type and the communication speed and the user authentication number received by the request in the management terminal may be further included. Here, before the user authentication number request step, the step of requesting the serial number of the device to the management device, and proceeding to the next step only if the serial number received from the management device and the serial number previously stored in the management terminal is the same; May be further included.

In addition, the authentication information comprising the step of receiving a user authentication number (hereinafter referred to as 'third authentication number') received through the input unit of the management device, and providing the received third authentication number to a specific application requiring user authentication An intermediary step may be further included.

Meanwhile, the communication between the management terminal and the management device may be encrypted by a predetermined algorithm, and the communication between the management terminal and the management device may be performed wirelessly through a predetermined relay device connected to the management terminal through a wired communication interface. It may be wired through a direct connection between the communication interface of the management terminal and the communication interface of the management device.

In addition, the user authentication number may be generated by selecting two or more keys provided in the input unit of the management device according to a specific pattern.

Hereinafter, exemplary embodiments will be described in detail with reference to the accompanying drawings. First, in adding reference numerals to the elements of each drawing, it should be noted that the same elements are denoted by the same reference numerals as much as possible even if they are shown in different drawings. In the following description of the present invention, if it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

1 shows a schematic configuration of a password management system according to the present invention.

The management terminal 100 receives a password list from the management device 200 and outputs it to the screen, and a password management program for adding a new password to the password list or modifying a specific password is installed. The password management program may be downloaded and installed from a predetermined server (not shown in the drawing) through the Internet as needed, or may be downloaded and installed by the program stored in the management apparatus 200. In the latter case, the management device 200 to determine whether the password management program is installed in the management terminal 100 connected to the communication, and if not installed, the user is asked to install it and then the program is downloaded and installed automatically. It is desirable that certain applications with algorithms be further loaded.

The management terminal 100 may include a memory unit for storing a password management program such as a PC, a PDA, a notebook computer, a cellular phone, a PCS, a control unit for executing the program, and a communication for performing data communication with the management device 200. An electronic terminal including an interface and a display unit for outputting an execution process of the program may be used. In the present embodiment, a PC is described. Meanwhile, an embodiment of a specific interface and operation of the password management program will be described with reference to FIG. 4.

The management device 200 transmits a password list to a specific management terminal 100 in which a password management program is installed so as to check a desired password, and is preferably implemented in a portable accessory shape. In addition, in combination with a mobile communication terminal such as a PDA, a cellular phone, a PCS, a notebook, it can also be implemented as a part of the function. 2 illustrates an internal configuration of the password management apparatus 200 as a block. Referring to this, a detailed role of each component will be described below.

The memory unit 210 stores a password list, which is a set of a user authentication number for authenticating whether the user has a legitimate authority to view the password list and passwords that the user wants to manage. In addition, preferably, a predetermined installation program for accessing the management terminal 100 to determine whether a password management program is installed and, if not installed, to download the program to the management terminal 100 and automatically install it, is further installed. Can be stored. Since the user authentication number, the password list, and the installation program must be maintained regardless of whether the power is supplied or not, the memory 210 of the present invention should include an EEPROM or a flash memory. Meanwhile, in the case of performing user authentication through fingerprint data, fingerprint data may be stored instead of the user authentication number.

The input unit 220 generates a predetermined number / letter code or various control codes according to a user's selection. In the present invention, four to five alphanumeric input buttons for inputting a password field value of the user authentication number or password list, a transmission button for commanding to transmit the various password data received to the management terminal 100, Switching button for selecting a character input or numeric input and up and down movement button for moving each record of the password list to output the desired ID or password to the display unit 250 is provided. Here, the configuration of the key button is only one embodiment, and a predetermined key button may be further included or some of the buttons may not be included within the scope of the present invention where portability is emphasized.

In the present embodiment, in particular, it is assumed that four alphanumeric input buttons B1, B2, B3, and B4 are provided, and a user generates a user authentication number, ID, and password by pressing the buttons according to a specific pattern. can do. For example, when "B1-B1-B2-B4-B2-B2-B4-B2-B1-B3-B3-B3" is pressed, B1-B1, B2, B4, B2-B2, B4, B2, B1, B3 A specific code corresponding to -B3-B3 may be combined to generate an 8-byte password. In addition, when a specific code corresponding to each of B1, B2, B3, and B4 exists simply and "B1-B1-B2-B3-B1-B4-B3-B3" is pressed, the eight-byte password combined according to the order is entered. May be generated. On the other hand, if a combination of numbers and letters is enforced as a password, the "switch" button is repeatedly pressed to toggle the input mode and then enter a letter or number to generate a password.

When the generated password is temporarily stored in the memory unit 210 and the "transfer" button is pressed until the transmission to the management terminal 100 is started. Of course, if only a predetermined number of buttons B1, B2, B3, B4, B5 are provided unlike the above embodiment, the code of the corresponding key is transmitted to the management terminal 100 whenever a specific button is pressed and the management terminal ( The password management program of 100) may receive the key codes thus transmitted by a predetermined number of digits and combine them into one password.

However, the user authentication does not necessarily need to be based on a password, but the biometric information of the user may be used, but a fingerprint recognition sensor may be further provided on the input unit 220.

The communication interface 230 serves as a path for exchanging various data with the management terminal 100. The communication interface 230 may be a wireless communication interface such as IrDA, Bluetooth, or a wired communication interface such as USB or RS-232C. In this embodiment, it is assumed that the wired / wireless communication interface is installed at the same time, and the IrDA 231 port is used for wireless communication and the USB 232 port is used for wired communication. However, various communication interface methods as described above are well known in the art, and thus detailed description thereof will be omitted.

The controller 240 receives a predetermined password through the input unit 220 when the user terminal requests a user authentication number from the management terminal 100, and transmits the predetermined password to the management terminal. Receives a predetermined password through the user unit and compares it with a pre-stored user authentication number and notifies the management terminal 100 of its own authentication success or self-authentication failure accordingly, and manages the pre-stored password list according to the password list request of the management terminal. Transmit to the terminal 100.

In addition, when accessing an Internet site that requires user authentication or when a specific application requires user authentication, the management device 200 requests a password (hereinafter referred to as 'third authentication number') for user authentication, and requests the management device ( 200 may be further provided with a function of receiving a specific record of the password list corresponding to the request or receiving input information by the user and automatically inputting the user authentication information input box of the corresponding site or application. In this case, when the control unit 240 requests, the management device 200 receives a third authentication number from a user and temporarily stores it, and the management device 200 connects to the wired communication interface 232 of the management terminal 100. When the third authentication number is temporarily stored in the user authentication information input box of the corresponding site or application.

As a result, the password can be directly unlocked using the management apparatus 200 according to the present invention. Such a unlocking function can be performed by the system booting when the PC is booted, the unlocking of a password set in a specific document file, and a password of an authorized certificate for financial transactions. It can be applied in various ways.

The display unit 250 outputs the ID field value or the password field value in a specific record of the password list so that the user can quickly check the desired information without going through the management terminal 100, and the key received through the input unit 220. The code value is displayed to check whether a particular button is properly pressed, and outputs various guide messages in the data communication process with the management terminal 100 to allow the user to complete the process and to prepare for the start of the next process. To check. In order to select the type of information output to the display unit 250, a separate selection button may be added to the input unit 220, but it is more preferable to perform by pressing the existing key for a predetermined time or longer.

The power supply unit 260 is responsible for supplying power to the elements constituting the management device, a battery 262 including a primary battery or a secondary battery may be used, or may use an external power source. In the present embodiment, it is assumed that the battery 262 and an external power source are used at the same time. In particular, as an external power source, a power source of an external electronic device applied through the USB port 232 is used, and between the battery 262 and the external power source. A predetermined switching circuit 261 is provided in the power supply unit so that the external power supply and the battery 262 power supply are exclusively supplied to each other. Of course, if a secondary battery is used as the battery 262, it is preferable that a predetermined charging circuit is further provided.

In the present invention, when a PDA, a notebook, etc. having a wireless communication interface by itself is used as the management terminal 100, since there is no problem because direct data communication with the management device 200 is possible, there is generally only a wired communication interface. When a PC or the like is used as the management terminal 100, a relay for converting communication protocols between the management terminal 100 and the management device 200 as a method for utilizing the wireless communication interface of the management device 200. The apparatus 300 should be further provided. 3 illustrates an internal configuration of the relay apparatus 300 in blocks, and with reference to this, the specific roles of the components are as follows.

The relay device 300 is provided with a wired communication interface (USB port or RS-232C port) 312 and a wireless communication interface (IrDA port) 311 at the same time, the data received from one interface to the other interface. Forward it.

The data converter 310 is responsible for converting data received by a communication protocol supported by one interface according to the communication protocol supported by the other interface, and the power supply unit 320 is such a data converter 310. ) May be implemented in the same manner as the power supply unit 260 of the management apparatus 200.

On the other hand, the communication between the management terminal 100 and the management device 200 is encrypted and performed by a predetermined algorithm, in particular, it is possible to prevent the risk that the password transmitted due to wireless communication is intercepted in the middle to leak to others. To this end, the management terminal 100 transmits a predetermined request control signal or a modified password list to the management apparatus 200, converts it into a predetermined encryption algorithm, and simultaneously converts a predetermined encryption code (public key) into a predetermined encryption algorithm. Generate and transmit it together, and the management device 200 decrypts the received data using a predetermined encryption code stored in advance.

Now, a procedure of viewing and managing a password list through the management terminal 100, the management device 200, and the relay device 300 as described above will be described in detail. For reference, FIG. 4 is a flowchart sequentially illustrating each step of the password management method according to the present invention.

A user who wants to know the ID and password of the Internet site wants to view the above information using a PC (management terminal) 100 nearby. For this purpose, a predetermined password management program must be installed in the PC. Such a password management program can be downloaded from a predetermined server through the Internet or downloaded from a management device according to the present invention.

When the password management program is executed (S401), if the execution is executed for the first time after the installation of the program (S402), first, the information necessary for communicating with the user's management apparatus and various information for user authentication ( Reference information) should be set (S403). An embodiment of a screen for setting such reference information is illustrated in FIG. 5.

The communication port setting box 501 allows the user's management device 200 to select COM1, COM2, USB, IrDA, Bluetooth, etc. according to whether to use the wired communication interface or the wireless communication interface. 503 may set a data transmission rate with the management apparatus 200 at 9600 bps, 15600 bps, and the like. Subsequently, when the management apparatus serial number button 505 is selected, a control signal for requesting the serial number is transmitted to the management apparatus 200 according to the set communication port and the communication speed, and the information according to the request is transmitted within a predetermined time. Receives it and outputs it to the management device serial number setting box. At this time, the management device side transmits the manufacturing serial number of the device previously stored in the memory unit 210 in response to the request to the management terminal 100 according to the set communication port and communication speed. Next, when the user authentication number button 507 is selected and set through the same process as the manufacturing serial number, each reference information set through the above process is selected by the "save" button at the bottom of the management terminal 100 ) Is stored in the reference information table.

The above-mentioned reference information setting procedure (S403) may be executed not only to be executed when the corresponding program is first executed and the reference information table of the management terminal 100 is initialized, but also to change a specific reference information item.

Next, prior to receiving the password list from the management device 200, a user authentication procedure for checking whether the user has the right to receive the password list and read it is performed. An embodiment of such a screen for requesting user authentication is shown in FIG. 6, where an authentication procedure is initiated by selecting a user authentication number button 601.

At this time, if the user authentication number (hereinafter, the first authentication number) is registered in the reference information table of the management terminal 100 (S404), the user authentication number (hereinafter, the second authentication number) in the management device 200 By transmitting a control signal requesting a second authentication number is received (S405). At this time, the management device 200 received the first authentication number from the management terminal 100 receives a password according to a predetermined pattern through the input unit 220 and transmits it to the management terminal 100.

If, for some reason, the first authentication number is not registered in the reference information table of the management terminal 100, a control signal for requesting self authentication is transmitted to the management apparatus 200 to receive a self authentication result value ( S409). In this case, the management device 200 that has received a self-authentication request from the management terminal 100 receives a predetermined password through the input unit 220, and the user authentication number previously stored in the memory unit 210. After comparing with the same, if both are the same, the self-authentication success is transmitted to the management terminal 100 informing the self-authentication failure if both are different (S411).

In the case where the first authentication number and the second authentication number are the same in step S407 or when the result of the successful self-authentication is received in step S411, this means that the corresponding user has the right. The control signal for requesting the password list is transmitted (S413), and the received password list is output to the screen (S415). 7 illustrates an embodiment of such a password list output screen.

In the present invention, the password list is a database including IDs, passwords, and related information to be managed, and field values for each record are sequentially displayed on the output screen of the password list. Such fields may include a record number field 701, a password content description field 703, a combination key ID field 705, a combination key password field 707, and a password hint field 709.

The user can not only check the specific ID and password desired through the password list output screen above, but also select a specific item of the password list through the combination key information input screen 710 and the password list management screen 720 provided at the bottom. It is possible to modify (S421) or add a new record (S419).

That is, the user can add a new "Password in D document file" record 730 in the password content description field 703, the combination key ID field 705, the combination key password field 707, and the password hint field 709. Are sequentially selected, and the contents of the selected specific field are input through the input means (keyboard, touch screen, etc.) of the management terminal 100. In addition, the key pattern input through the virtual management device input unit 220 may be performed by using the combination key information input screen 710. In this case, after selecting a specific field to be input, “B1”, “B2”, The "B3" and "B4" buttons can be selected according to a specific pattern, but the input mode can be switched using the "number / letter switching" button. As the number or letter is selected as described above, the selected key values are output in the lower display column. When the input is completed, the "OK" button is selected to finally input the value in the corresponding field. This record addition procedure is equally applicable to the procedure for modifying the contents of the combination key ID field 705 and the combination key password field 707 for a specific record.

Meanwhile, the input unit 220 of the management device may be directly used as a means for inputting content in the selected field. In this case, the input means can be changed by selecting the "change input means" button on the password list management screen 720. When the "change input means" button is selected again, the input means is toggled back to the input means of the management terminal.

The password list in which a specific record is added or modified through the above procedure may be transmitted to the management apparatus 200 by selecting the "send password" button to back up the password list. In addition, when it fails to receive the password list from the management apparatus 200 for some reason, the user may select the "receive password" button to perform re-receipt.

If the user authentication fails in step S407 or step S411, or if the "end" button is selected, the password management program terminates.

As described above, in the detailed description of the present invention, specific embodiments have been described. However, various modifications may be made without departing from the scope of the present invention. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be defined not only by the scope of the following claims, but also by those equivalent to the scope of the claims.

According to the present invention, a user can easily check a desired password anywhere using an accessory type portable password management device in which a password list is stored, and a predetermined password management program corresponds to a specific management terminal from the password management device or through the Internet. The purpose is to send a list so that you can check the password you want.

Another object of the present invention is to be able to modify or add a password list through a password management program installed in the management terminal.

Another object of the present invention is to enhance security by encrypting data exchanged between a portable password management device and a management terminal.

Another object of the present invention is to simplify the input unit of the portable password management device and to generate various combinations of passwords through a key input pattern.

Claims (23)

In a method of viewing and managing a desired password through a portable password management device (hereinafter referred to as a "management device") and a terminal (hereinafter referred to as "management terminal") is installed, a predetermined password management program, A first step of executing a password management program in the management terminal; A second step of receiving a user authentication number (hereinafter referred to as 'first authentication number') from the management device and comparing the user authentication number previously stored in the management terminal (hereinafter referred to as 'second authentication number') to authenticate whether the user is a party user; ; A third step of receiving a list of passwords from a management device and outputting the password list only when the user is authenticated as a party user; Password management method comprising a. The method of claim 1, If the second authentication number is not stored in advance in the management terminal, requesting self-authentication from the management device, and performing the third step only when the self-authentication success is notified from the management device. How to manage passwords. The method of claim 2, wherein the self-authentication in the management device, Receiving a predetermined password through an input of a management device; Comparing the input password with a user authentication number stored in advance in a management device; If both match, notify the management terminal of the self-authentication success, and if not, notify the management terminal of the self-authentication failure. Password management method characterized in that consisting of. The method of claim 1, Modifying a specific field of a specific record of the password list output to the management terminal, and transmitting the modified password list to the management device to back up the password management method characterized in that it further comprises. The method of claim 1, Adding a new record to the password list, and transmitting a backup of the password list to which the new record is added to the management device further comprising the step of backing up. The method according to claim 4 or 5, Each record of the password list includes a description field and a password field of the password. The method of claim 6, The modification of the specific field or the addition of a new record is password management method characterized in that is performed through the input means of the management terminal. The method of claim 6, Modifying the specific field or entering a password field of a new record is performed through an input unit of a management device. The method of claim 1, Receiving a communication interface type and a communication speed for performing communication between the management terminal and the management device; Requesting a user authentication number from a management device according to the set communication interface type and communication speed; Storing the set communication interface type and communication speed and a user authentication number transmitted by the request in a management terminal; Password management method characterized in that it further comprises the step of setting the reference information. 10. The method of claim 9, wherein before the user authentication number request step, Requesting the managed device's serial number; Proceeding to the next step only when the serial number received from the management device and the serial number previously stored in the management terminal are the same Password management method characterized in that it further comprises. The method of claim 1, Authentication information intermediate step consisting of receiving a user authentication number (hereinafter referred to as 'third authentication number') received through the input unit of the management device, and providing the received third authentication number to a specific application requiring user authentication Password management method characterized in that it further comprises. The method according to any one of claims 1 to 5 or 9 to 11, Communication between the management terminal and the management device is a password management method characterized in that the encryption is performed by a predetermined algorithm. The method of claim 12, wherein the communication between the management terminal and the management device, Password management method characterized in that it is made wireless through a predetermined relay device connected to the management terminal and a wired communication interface. The method of claim 12, wherein the communication between the management terminal and the management device, And a wired connection through a direct connection between the communication interface of the management terminal and the communication interface of the management device. The method of claim 1, The user authentication number is generated by selecting at least two keys (key) provided in the input unit of the management device according to a specific pattern. In a portable password management device (hereinafter referred to as "management device") for reading a specific password desired through a terminal (hereinafter referred to as "management terminal") is installed a predetermined password management program, A memory unit for storing a user authentication number for accessing the program and a password list of a management target; An input unit for receiving the user authentication number and password; A communication interface for exchanging various data with the management terminal; And A control unit that receives a predetermined password from the management terminal, receives a predetermined password through the input unit, transmits the predetermined password to the management terminal, and transmits a pre-stored password list to the management terminal according to a password list request of the management terminal; Portable password management device comprising a. The method of claim 16, wherein the control unit, If there is a self-authentication request from the management terminal receives a predetermined password through the input unit and compares it with a pre-stored user authentication number and accordingly characterized in that it further comprises a function for notifying the management terminal of the self authentication success or self authentication failure. Portable password management device. The method of claim 16, wherein the control unit, And a function of backing up a password list in which a specific record is modified or added from a management terminal. The method of claim 16, wherein the control unit, And a function of transmitting a manufacturing serial number previously stored in a memory unit to the management terminal when a manufacturing serial number request of the management device for setting reference information is made from the management terminal. The method of claim 16, And a display unit for outputting an ID field value or a password field value among specific records of the password list stored in the memory unit. The method according to any one of claims 16 to 20, And each record of the password list includes a description field and a password field of the password. The method of claim 21, The user authentication number is a portable password management device, characterized in that generated by selecting two or more keys (key) provided in the input unit of the management device according to a specific pattern. The method of claim 21, And a communication between the management terminal and the management device is performed by being encrypted by a predetermined algorithm.

Images