KR100743564B1 - Authenticating system and method - Google Patents

Abstract

The present invention relates to a non-face-to-face identity verification method and a lost password processing method,

Using the image card linked with the server-side database and serial number, the survey image in the image card is deeply imprinted in the member's memory, and the image card is immediately destroyed so that the image exists only in the user's memory.

Over time, when identity verification, such as re-issuance of an accredited certificate, is introduced, a method and system for verifying the identity of the user based on whether the image is recognized in an image group mixed with other strange images is introduced.

Description

Identity verification system and method {AUTHENTICATING SYSTEM AND METHOD}

1 is an example of a survey image card.

2 is an example of an answer input window.

3 is a diagram illustrating an example of a first question-answer-hint combination group.

4 is an example of a question-answer combination confirmation screen.

5 is an example of a hint transmitted via a mobile phone.

6 is an example of providing a temporary questionnaire image card instant printing button.

The present invention is a technique related to identity verification. More specifically, it is not a password that is commonly referred to as a login password, but rather a technology to verify the identity of the user in order to retrieve the lost password or to verify the identity of the user in an important service such as recertification of a certificate. In other words, authentication techniques in this area are much less frequently used than login passwords.

In the conventional technology, the security question and answer are the most common, and this is a technology such as VISA. However, the above-described method has a problem such that it is easy to forget the answer, failing in identity verification, or vulnerable to the person who knows the personal information of the user. Accordingly, the present applicant filed "Method for OPERATING AND AUTHENTICATING PASSWORD SYSTEM, AND STORAGE MEDIA HAVING PROGRAM SOURCE THEREOF}-Patent application 10-2005-0041431" completely solves such a problem. It was.

By the way, although the password operation method has a definite effect on recovering a general password, it can be said that the authentication for recovering when a password for a financial transaction is lost is somewhat inclined to a strong and persistent hacker. That is, the system according to the password operation method, after regaining the lost password, will always set a new questionnaire-answer-hint combination for the next identity verification. I could steal it by capturing the image and hacking the keyboard, and then stealing myself to get my password again. Of course, it's very rare to wait a long time and steal it, and not just all of the passwords, but only some hints, so the password isn't completely exposed, but it's a little less secure.

Accordingly, it is an object of the present invention to improve the password operation method, to propose a password management method and identity verification method that is safe in any form of hacking.

Password operation method and identity verification method according to the present invention in order to achieve the above object, the principle is the same as the password management method filed previously, but do not present a survey image on the screen to prevent hacking using image capture It is presented through other media, and also the answer is inserted into the questionnaire image presented through the other media in order to prevent keyboard hacking, and the computer selects an appropriate fingerprint to input only the number.

Hereinafter, with reference to the accompanying drawings will be described in more detail.

Example 1

An embodiment to be described below is an embodiment of a password operation method implemented using a questionnaire consisting of a graphic image, and in particular, a graphic image printed on a paper medium in the password operation method according to the present invention.

The process of searching for a password by the password operation method according to the present invention is largely divided into four steps: "password hint setting step", "password hint provision step", "password step above", and "password confirmation step".

● Password Hint Setting Steps

First, in the password hint setting step, each member of the membership system site prepares to receive a password hint in case a future password is lost.

Then, after a certain time has elapsed and the user has forgotten the password for his or her ID on the site, the member can provide a part of his / her password with the help of the password hint set in the password hint setting step through the password hint providing step. Will receive. For example, keycap information corresponding to any character designated by the site among the characters constituting the password or a specific character selected by the member himself is provided as a hint for the character. Since there is no limit to the number of characters provided with a hint among the characters constituting the password, either one or three or more characters can be used. However, in the present embodiment, a password hint is provided for two characters. Explain.

It is common for most people to use a limited number of passwords on multiple sites, so at the password level above, the member can easily remember all of their passwords for the site using the password hint provided in the password hint provisioning step. It becomes possible.

The member sets a password hint at the time of joining the member system site. In the first process, the serial number 11 of the first question image 10 is input into the input window 20 in the server of the site.

1 is an example of a survey image card.

The survey image card 1 is characterized in that it is securely packaged so that its contents 10, 11, 12 are not known at all before use. Examples of security packaging include scratch-based masking, individual packaging using opaque packaging materials, and the entire card with an opaque material that can be easily removed. .

The server checks whether the serial number 11 of the inputted first survey image 10 is a valid serial number registered in the survey database, and if it is valid, the member selects 12 in the first survey image card 1. Select an appropriate fingerprint and present the input window 22 to input the number.

2 is an example of an answer input window.

The member selects one of the optional fingerprints 12 and submits it to the site as the first answer.

When the first answer is sent, the server checks the member's password by referring to the member information database. The reason for confirming the password is that a first question-answer-hint combination should be generated for the first question. That is, in the password confirmation step, the first character (as described above, does not have to be the first character of the password) is extracted from the member's password.

The first questionnaire obtained in this process, the first answer, and the extracted password first letter are generated as a first question-answer-hint combination as a whole. In this embodiment, the keycap of the keyboard corresponding to the first letter of the password is generated. (key cap) The image is created to be linked as a hint.

By adding another question-answer-hint combination to the first question-answer-hint combination, the server generates a first question-answer-hint combination group and stores it in the member information database.

Other question-answer-hint combinations are randomly selected from another member's question-answer-hint combination already stored in the membership database, with additional question-answer-hint combinations added to the member's first question-answer Include the information corresponding to the keycap, not the keycap corresponding to the hint combination. In general, since the number of keycaps representing characters is about 48, in this embodiment, a total of 48 question-answer-hint combinations including the first question-answer-hint combination include the first question-answer-hint combination group. Can be configured.

Of course, the member only confirmed the first question-answer-hint combination, and the remaining 47 question-answer-hint combinations remain unviewed.

After the setting of the first question-answer-hint combination and the first question-answer-hint combination group is completed in this manner, the second question-answer-hint combination and the second question-answer-hint combination group are similarly performed. Since only the setting of the description thereof will be omitted.

Through the above process, the member finishes setting the password hint.

● Password Hint Providing Step

Next, after the password hint is set, the procedure for receiving the password hint according to an example of the password operation method according to the present invention is described when a password forget situation occurs.

The member who has forgotten the password initiates the password hint providing step by requesting to provide the password hint through an appropriate menu on the membership site. At this time, the password hint to be provided by selecting the member ID of the member together is selected.

The server receiving the request for providing the password hint from the member searches for the first question-answer-hint combination group corresponding to the member ID by referring to the member information database, and provides the same to the member.

3 is a diagram illustrating an example of a first question-answer-hint combination group.

As shown in FIG. 3, as many as 48 key-cap question-answer-hint combinations are output on the member's PC screen, and among them, the question-answer-including the first answer directly written by the member. There is only one hint combination 30.

4 is an example of a first question-answer combination confirmation screen.

5 is an example of a second question-answer combination confirmation screen.

When the member selects his first question-answer-hint combination 30 among the first question-answer-hint combination group, the selected questionnaire 40, the answer 41, and the hint 42 can be checked on the screen. have.

In the same way, the member identifies and confirms the second question-answer-hint combination (ie, the second password hint) from the second question-answer-hint combination group presented on the PC screen.

● Password reminder

6 is an example of a password confirmation screen.

Through the above-described process, the member is provided with a hint of a keycap corresponding to the first two letters of his forgotten password, thereby inferring the complete password known by the hint.

6 shows a process 60 to infer its lost password.

● Password Confirmation Step

If you think that you forgot your lost password through the above process, confirm your password.

As shown in FIG. 6, the confirmation screen discloses an input window 62 for confirming the last completed hint 61 and the found password.

If the password is correct, the server causes the member to set a new password and starts a reservation screen for reserving a new survey image. The reservation process is a password hint setting step described above. Setting a new password is because some hints are exposed on the screen, making the new password more secure. In addition, setting a new questionnaire image, so that the password can be safely found even when the next password is lost, and once used, the questionnaire image is immediately destroyed and no one but the user can see the hint.

The first embodiment was described through the above description.

As can be seen from the description, the survey image card (1) will be destroyed immediately after use once, so it remains only in your head so that no one can know your survey image (10) and is also commonly used in banks, etc. While the security card has a disadvantage that others can steal when exposed to the other person, while the survey image card 1 according to the present invention (not reserved in the server) questionnaire image 10 is still specific Because you are not connected to a member, there is a big advantage that no one will be harmed if someone steals it.

In addition, the answer is also the choice fingerprint 12 is printed on the questionnaire image card, and when the answer is input only the number 22 of the choice fingerprint is shown on the screen, there is no hint for the question image in any process. Therefore, the possibility of hacking by techniques such as image capture or keyboard hacking is completely blocked. Only if you forget the password and check the question-answer-hint combination to get a hint, it will be displayed completely on the screen. This is because it has already consumed the reserved survey image 10, and after this process a new survey image 10 will be reserved again.

Example 2

The following is a description of an embodiment instead of the question image card (1).

In the case of Example 1, a temporary questionnaire image card is provided so that a member who has consumed all the questionnaire image cards 1 or a member who does not currently possess the password can find a password and reserve a new questionnaire image 10 for the next time. That's how. Of course, according to the embodiment, it is obvious that the service can be sufficiently provided by only the temporary survey image card without operating the survey image card 1.

In Example 1, the server receives the questionnaire image card (1) serial number (11) and then introduces a method of receiving one of the optional fingerprints 12 in the questionnaire image card (1) as answers (22, 41). , Providing a 'prompt printing of the temporary survey image card' button 21 for the member who does not have the survey image card 1 in a proper place on the screen to receive the serial number 11 of the survey image card 1.

6 is an example of providing a temporary questionnaire image card instant printing button.

When the member clicks this button 21, the server immediately extracts a survey image from the survey database at random. The extracted survey image is sent directly to the member's printer so that the member can view the survey image without being displayed on the screen. This makes it safe for hacking using image capture.

In addition, for members without a printer can be configured to be sent to the mobile phone instead of the printer. Transferring the extracted image to a mobile phone is a generalized technology, and thus a detailed description thereof will be omitted.

Example 3

The following is an embodiment of the identity verification service using the present invention.

Other identity verification services in the present invention can be usefully used when you need to immediately reissue a certificate online without having to verify yourself at the window.

Identity verification service consists of a question-answer setting step and a question-answer checking step.

In the questionnaire-response setting step, a first questionnaire-answer combination is generated using the questionnaire image card 1, and the first questionnaire-answer combination group is stored in a database together with other questionnaire-answer combinations as in Example 1. In the same manner, the second question-answer combination group is generated and stored in a database.

Then, when the identity needs to be verified, the questionnaire-response confirmation process is performed, and the first and second questionnaire-response combinations are checked in the first and second questionnaire-combination groups, respectively. You can confirm that.

Also, after the identity is confirmed, the next step is to reserve a new survey image for identity verification.

[System configuration example]

The system implementing the embodiments described above,

Questionnaire image card, the questionnaire image, the optional fingerprint for the answer to the questionnaire image, and the questionnaire image card ID is printed, and the above contents must be securely packed,

In connection with the survey image card ID, the information of the survey image card is stored and a survey image card database capable of transmitting information according to a request of the server should be established.

Self-identification setting means for storing the member's answer corresponding to the questionnaire image card in the database in the form of question-answer combination corresponding to the member information should be configured in the server.

A survey-response database must be established to store the question-answer combinations and the question-answer combination groups and to transmit information according to the needs of the server.

Self-identification means for verifying the identity of the member according to whether the member to present the questionnaire-answer combination group including the questionnaire-answer combination to the member of the question-answer combination should be configured in the server.

The present invention has a safe effect from hacking of any technique that may occur in a user side PC in a method of recovering a lost password and a method of verifying identity for important services such as reissuing an authorized certificate.

Claims (10)

A first step of confirming predetermined identity information according to a request for setting identity verification of a member accessing the site; A second step of receiving a serial number of an image card linked with a server-side database as a serial number; A third step of receiving an appropriate answer to a questionnaire image in the image card; The questionnaire image is found in the database by referring to the serial number of the image card, and a questionnaire and answer combination is generated together with the inputted answer. Then, any questionnaire and answer combination other than the questionnaire and answer combination in the database is generated. A fourth step of generating and storing a questionnaire and answer combination group in combination with the questionnaire and answer combination; Identity verification setting step; A fifth step of verifying predetermined identity information in accordance with a request for identity verification of a member accessing the site; A sixth step of providing the questionnaire and answer combination group generated in the fourth step to a member's screen; Selecting a questionnaire and answer combination of the members created in the fourth step in the questionnaire and answer combination group and treating it as a successful authentication, and if not, selecting the questionnaire and answer combination as a failed authentication; Identity verification method characterized in that consisting of the identity verification step. The method of claim 1, The second step is a self-identification method characterized in that the temporary image card is issued on the fly through another medium such as a printer or a mobile phone, not the member's screen. The method of claim 1, If the authentication is successful in the seventh step, the identity verification method characterized in that to perform the second step, the third step, the fourth step again. The method of claim 1, The third step, the identity verification method characterized in that for inputting the selected fingerprint displayed in the questionnaire image as an answer. A first step of confirming a password of a member accessing the site; A second step of receiving a serial number of an image card linked with a server-side database as a serial number; A third step of receiving an appropriate answer to a questionnaire image in the image card; The questionnaire image is found in the database by referring to the serial number of the image card, and a combination of a questionnaire, an answer, and a hint is generated together with the first letter among the characters forming the password and the inputted answer, and then in the database. And a fourth step of generating and storing a questionnaire, answer, and hint combination by combining the questionnaire, answer, and hint combination other than the answer and hint combination together with the questionnaire, answer, and hint combination; A password hint setting step; A fifth step of confirming predetermined personal information according to a request for providing a password hint for a member who accesses the site; A sixth step of providing the questionnaire, the answer, and the hint combination group generated in the fourth step to the member's screen; Selecting a questionnaire, answer, and hint combination of the members created in step 4 within the questionnaire, answer, and hint combination group and providing the corresponding hint to the member; Password management method characterized in that consisting of the provided password hint providing step. The method of claim 5, The second step is a password operation method, characterized in that the step of issuing the temporary image card on the fly through another medium such as a printer or a mobile phone, not the member's screen. The method of claim 5, Subsequent to the seventh step, the password operation method characterized in that the second step, the third step, and the fourth step to perform again. The method of claim 5, The third step is a password management method, characterized in that for inputting the selected fingerprint displayed in the questionnaire image as an answer. The method of claim 5, The hint provided to the member in the seventh step is a password operation method, characterized in that other characters except for the hint in the password are provided as masked by the * mark. In identity verification system, A questionnaire image, an optional fingerprint for answering the questionnaire image, a questionnaire image card ID is printed, and a questionnaire image card securely packaged so that the above contents are not visible; A survey image card database in which information of the survey image card is stored in association with the survey image card ID; Identity verification setting means for storing a member's answer corresponding to the questionnaire image card in a questionnaire and answer database in the form of a questionnaire and answer combination in response to the member information; A survey and answer database; As a verification means for presenting the questionnaire and answer combinations to the member with any question-answer combination to confirm the identity according to the member's own question and answer combinations; Identity verification system, characterized in that made.

Images