KR100757982B1 - Method for authenticating a user using a one-time authentication - Google Patents

Abstract

A method for authenticating a user with one-time authentication information is provided to intensify user authentication by sharing the one-time authentication information between a server and a client, and transceiving encrypted data based on the one-time authentication information through the network. A server receives an authentication request message including an authentication key, which is operated by a random number included in the one-time authentication information and current time based on a predetermined rule, from the client(S23). The server decrypts the received authentication request message by using a one-time encryption key(S27). The authentication key is extracted from a decryption result. The current time and the random number included in the one-time authentication information are operated by the predetermined rule. The extracted authentication key is compared with an operation result(S29). If extracted authentication key is identical with an operation result, the server authenticates the client.

Description

Method for authenticating a user using a one-time authentication}

1 is a network configuration diagram of a user authentication system using one-time authentication information according to an embodiment of the present invention;

2 is a block diagram of a client according to an embodiment of the present invention;

3 is a block diagram of an authentication server according to an embodiment of the present invention;

4 is a flowchart illustrating a process in which a client first receives one-time authentication information from an authentication server in a user authentication method using one-time authentication information according to an embodiment of the present invention;

5 is a flowchart illustrating an overall authentication process in a user authentication method using one-time authentication information according to an embodiment of the present invention;

6 is a flow chart for explaining in more detail the step of generating the authentication request message shown in FIG.

7 is a flow chart for explaining in more detail the step of verifying the full authentication request shown in FIG.

8 is a flowchart for explaining in more detail the step of determining whether the authentication success shown in FIG.

9 is a flow chart for explaining in more detail the step of generating the authentication response message shown in FIG.

FIG. 10 is a flowchart for explaining in more detail the step of verifying the authentication response message shown in FIG. 5.

*** Explanation of symbols for the main parts of the drawing ***

100: client 110: control unit

111: RAM for operation 113: Operating system

120: information storage unit for the authentication request 130: encryption / decryption module

140: hash function generation module 150: random number generation module

160: key input unit 170: information transmitting and receiving unit

200: authentication server 210: control module

211: RAM for Operation 213: Operating System

220: database 221: DB for authentication processing

223: user DB 230: encryption / decryption module

240: hash function generation module 250: random number generation module

260: information transmission / reception module

The present invention relates to a user authentication method using one-time authentication information, and in particular, by using a one-time authentication information shared in advance between the server and the client so that different data is transmitted / received every time, thereby making it safer than an authentication method using only a statically determined password. It relates to a user authentication method using one-time authentication information to enable user authentication.

In order to protect the password, the one-time password generation method through a specific synchronization method between the client and the server when the user password is input, the user generally has to have a terminal for generating a one-time password, in which case the user The purchase or distribution of the service provider to the user to buy the terminal bar, there is a problem in the rejection of the purchase of the terminal due to the cost and there is a problem that the utilization is lowered. Furthermore, there is a problem in that when a user uses various systems online that process authentication, each system does not generate a password by the same password generator, and has a separate terminal for each system.

On the other hand, a method of transmitting a one-time authentication key randomly generated by the server to the user using the short message service (SMS) of the mobile communication terminal is used, but in this case, a separate communication cost is added for each user authentication and the mobile communication company The performance is determined by the concurrent processing power of the system, which may cause unexpected communication failures. Therefore, it is inconvenient to use in a web site that many users access from time to time, and may cause problems in terms of cost and performance.

On the other hand, although the user authentication method using a public certificate is currently used in the financial sector, in order to use this method, a user must be issued a public certificate and must be registered after verifying his / her identity in a system to use the issued public certificate. Accredited certificates should not be compromised because they have a complicated process, such as obtaining parental consent when issuing minors, especially information used in financial transactions. In addition, as can be seen in the case of foreigners difficult to obtain a domestic certificate, the authentication system using the certificate is limited to the user can be used. Furthermore, considering the asymmetric key method (public key method) where the encryption and decryption processes are not the same in terms of system efficiency, and the many system resources used in the processing according to the PKI protocol, There is a problem to be provided.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problem, and by sharing the one-time authentication information between the client and the server and allowing the encrypted data based on the authentication information to be transmitted / received through the online network, the one-time user authentication is enhanced. Its purpose is to provide a user authentication method using authentication information.

In addition, another object of the present invention is to generate and encrypt all the authentication information in the client and server, and then to be transmitted and received through the online network, the institution using the authentication system according to the present invention and the authentication-related systems of other organizations and It is to provide a user authentication method using one-time authentication information to have an independent authentication system that is not linked.

In addition, another object of the present invention is to provide a user authentication method using one-time authentication information that allows a user to request authentication through a portable computer such as a general computer or a USB memory, without the user having a separate communication terminal for authentication processing. To provide.

In addition, another object of the present invention is to provide a user authentication method using one-time authentication information so that it is possible to configure a server or a client at low cost because it is possible to perform authentication processing by mounting only software without providing a separate authentication processing hardware. It is.

In order to achieve the above object, the user authentication method using the one-time authentication information of the present invention is connected to the client through an online network, the time synchronization with the client is maintained, and the one-time authentication information including a random number and one-time encryption (A) receiving an authentication request message including an authentication key which is a result of calculating a random number included in the one-time authentication information and a current time according to a predetermined rule from the authentication server sharing a key with the client; Receiving step; (b) decrypting the full text of the authentication request received in step (a) using the one-time encryption key; (c) extracting the authentication key from the decrypted result of step (b); (d) calculating a random number included in the current time and the one-time authentication information by a predetermined rule; (e) comparing the authentication key extracted in step (c) with the result calculated in step (d); and (f) authenticating the client if the comparison value in step (e) is the same. It provides a user authentication method using a one-time authentication information comprising the step.

In the above-described configuration, the authentication request message received from the client includes the one-time encryption key and another new encryption key, and (g) is included in the authentication request message when the comparison value in step (e) is the same. Preferably, the method further comprises the step of storing the new encryption key.

In addition, (h) if the comparison value in step (e) is the same, generating new authentication information different from the one-time authentication information, and (i) including new authentication information generated in the step (h) Preferably, the method further comprises encrypting the entire authentication response message and transmitting the encrypted message.

In addition, the authentication server stores the previous authentication information generated before the one-time authentication information and the previous encryption key received before the one-time encryption key separately, (j) the comparison value in step (e) is not the same. If not, decrypting the full text of the authentication request received in step (a) using the previous encryption key; (k) extracting the authentication key from the decrypted result of step (j); (l) calculating a current time and a random number included in the previous authentication information by a predetermined rule; (m) comparing the authentication key extracted in step (k) with the result calculated in step (l); and (n) authenticating the client if the comparison value in step (m) is the same. It is preferable that the step further comprises a step.

In addition, the authentication request message received from the client includes a request integrity code for authenticating the integrity of the authentication request message, (o) calculating a predetermined value related to the integrity check included in the one-time authentication information by a predetermined rule And (p) comparing the operation result of step (o) with the request integrity code.

The authentication response message may include a response integrity code for authenticating the integrity of the authentication response message. The authentication response message may be encrypted using the request integrity code, and the request integrity code and the response integrity code may be hashed. It is preferably written using a function.

Hereinafter, a user authentication method using one-time authentication information will be described in detail with reference to the accompanying drawings.

1 is a network diagram of a user authentication system using one-time authentication information according to an embodiment of the present invention.

As shown in FIG. 1, the network configuration of the user authentication system of the present invention is an online network 300, a client 100 requesting user authentication to an arbitrary server through the online network 300, and an online network 300. It is connected to the client 100 through), and comprises an authentication server 200 for processing user authentication based on any data transmitted by the client 100.

In the above-described configuration, the online network 300 may include a local area network (LAN), a wide area network (WAN), a value added network (VAN), a mobile radio communication network, It can be a network based on all kinds of wired / wireless such as wireless internet network or satellite communication network.

Next, the client 100 may be a separate user authentication device having a connection means with the online network 300, a personal computer such as a laptop or a desktop, or a mobile communication terminal. Here, the mobile communication terminal is a wireless communication device that guarantees portability and mobility, and includes a personal communication system (PCS), a global system for mobile communications (GSM), a personal digital cellular (PDC), a personal handyphone system (PHS), and a personal digital assistant (PDA). All types of handheld based wireless communication devices such as Digital Assistant (IMT), International Mobile Telecommunication (IMT) -2000 terminal, Digital Multimedia Broadcasting (DMB) phone, and Smart Phone.

2 is a block diagram of a client according to an exemplary embodiment of the present invention. As shown in FIG. 2, the block configuration of the client 100 of the present invention may be variously authenticated with an authentication server 200 through an online network 300. Information transmitting / receiving unit 170 for transmitting / receiving information, authentication request information storing unit 120 for storing various information transmitted / received through the information transmitting / receiving unit 170, symmetry with the same encryption and decryption process An encryption / decryption module 130 for encrypting or decrypting various types of information transmitted / received through the information transmitting / receiving unit 170 based on a key method, and transmitting the information through the information transmitting / receiving unit 170. / Hash function generation module 140 for generating a predetermined hash value used for the integrity (integrity) check of the various information received, random number generation module 150 for generating a random number required for user authentication request (150) ) And the overall control of these It includes a fisherman 110. In addition, the client 100 includes an operation RAM 111 for storing temporary data generated through various logical operations or arithmetic operations performed by the controller 110, and an operating system (OS) 113 of the client 100. A predetermined memory device for storing and a key input unit 160 for generating various key signals for controlling the control unit 100 as a user interface device are further provided.

In the above configuration, the authentication request information storage unit 120 is removable from the client 100, and thus may be a USB memory or other portable storage device that the user can carry.

Next, the authentication request information storage unit 120 stores the list of Table 1 below.

User separator password Encryption key Authentication key Integrity Check Key Certification time Certification Number Index for encryption / authentication key (hereafter key index) Index for integrity key (hereafter referred to as integrity index) Additional number Random number table

Here, the user identification key is a value that can uniquely distinguish a user from the authentication server 200. This value may be a user ID or a card number stored in the server system.

Next, the 'password' and 'encryption key' is a key used when encrypting information (hereinafter, authentication request text) transmitted from the client 100 to the authentication server 200 for the authentication request, in particular, the encryption key is an authentication request. It is a one-time value generated by the random number generation module 150 each time.

Next, 'authentication reference time', 'authentication number', 'key index' and 'integrity index' (hereinafter, collectively referred to as 'authentication information') is a value received from the authentication server 200, authentication request This is a one-time value needed when creating a full text.

Next, the 'authentication key' is a hash value obtained by subtracting the authentication reference time transmitted by the authentication server 200 from the specific time synchronized between the authentication server 200 and the client 100 to the hash function. This is a one-time value needed when creating a full text.

Next, the 'random number table' is a table in which arbitrary values are arranged in a predetermined form and is received from the authentication server 200 and is associated with a key index and an integrity index.

Next, the 'integrity test key' is a hash value obtained by applying a predetermined value required for generating an authentication request message to a hash function, and is a one-time test for checking whether an authentication request message is transmitted / received through the online network 300. Value. Hereinafter, the integrity check key will be referred to as a request integrity key.

Next, the 'additional number' is a one-time value required when generating an authentication request message, and is a value added to the authentication number.

3 is a block diagram of an authentication server according to an embodiment of the present invention. As shown in FIG. 3, the block configuration of the authentication server 200 may include a client 100 through an online network 300. An information transmission / reception module 260 for transmitting / receiving various information, an authentication processing DB 221 for storing various information transmitted / received through the information transmission / reception module 260, and a user requesting authentication. A database 220 including a user DB 223 storing various information, and encrypting or decrypting various information transmitted / received through the information transmission / reception module 260 based on a symmetric key method. Encryption / decryption module 230, hash function generation module 240 for generating a predetermined hash value used to check the integrity of the various information transmitted / received through the information transmission / reception module 260, user authentication request Random number required at the time of certification Number, "" comprises a key index, "and" random number generator that randomly generates a value for the integrity index "module 250 and control module 210 for controlling them collectively. In addition, the authentication server 200 stores the operation RAM (211) for storing the temporary data generated through the operation performed by the control module 210 and the operating system (OS) 213 of the authentication server 200. A predetermined memory device is further provided.

In the above configuration, the user DB 223 stores the user identification key, password, and other credit information for each user.

Next, the authentication processing DB 221 stores the list shown in Table 2 below.

One Encryption key used for last authentication 2 Standard time used for last certification 3 Authentication number used for last authentication 4 Key index used during last authentication 5 Integrity index used during last authentication 6 The encryption key to use for next authentication 7 Standard time to use for next certification 8 Certification number to use for next certification 9 Key index to use for next authentication 10 Integrity Index to Use for Next Authentication

Meanwhile, if the authentication server 200 successfully verifies the authentication request message received from the client 100, the authentication server 200 generates new 'authentication information' to be used for the next authentication and transmits the generated authentication information to the client 100. At this time, due to the failure of the online network 300, the client 100 may not receive new authentication information, and may transmit the authentication request message based on the previously used authentication information to the authentication server 200 even when the next authentication request is made. Therefore, the authentication server 200 needs to store not only newly generated authentication information but also immediately previous authentication information.

As can be seen from the above, the values of 1 to 5 in Table 2 are referred to as 'successful authentication information' through the authentication information that has been successfully verified and the encryption key (hereinafter, referred to as 1 to 5 values) received from the client 100. The value of 6 to 10 is the most recently transmitted authentication information and the encryption key received from the client 100 (hereinafter, referred to as 'final authentication information' collectively, the values of 6 to 10). Here, the encryption key of 5 is a value received and stored from the client 100 before the encryption key of 6.

4 is a flowchart illustrating a process in which a client first receives one-time authentication information from an authentication server in a user authentication method using one-time authentication information according to an embodiment of the present invention.

First, in step S11, the client 100 requests 'authentication information' from the authentication server 200. Here, the client 100 and the authentication server 200 preferably share the 'user identification key', the 'password' and the 'encryption key' prior to step S11.

Next, in step S15, the authentication server 200 generates a predetermined receiving key for receiving authentication information, and proceeds to step S17 to transmit the authentication information receiving key to the client 100. Here, it is preferable that the authentication server 200 temporarily stores the generated reception key in the operation RAM 111.

Next, the client 100 first encrypts the received authentication information receiving key using the encryption / decryption module 130 in step S19, and secondly encrypts the authentication information receiving key using a password in step S21. In step S23, the second encrypted authentication information receiving key and the user identification key are transmitted to the authentication server 200.

Next, the authentication server 200 checks the password and the authentication number receiving key corresponding to the user identification key received from the client 100 in step S25, and in step S27 receives the encrypted receiving key received using the confirmed password. In step S29, the reception key decrypted in step S27 is compared with the reception key checked in step S25. If the two values compared in step S29 are the same, the process proceeds to step S31 to generate a new authentication information and a random number table. In step S33, the authentication information and the random number table generated in step S31 are encrypted using the password confirmed in step S25. In step S35, the value encrypted in step S33 is transmitted to the client 100 requesting the authentication information. Here, when the authentication server 200 does not share an encryption key with the client 100, it is preferable to generate an encryption key and transmit the generated encryption key to the client 100.

Next, the client 100 stores the received encrypted authentication information and the random number table in the authentication request information storage unit (hereinafter, the information storage unit) 120 in step S37, and receives the above information in step S39. The full text informing that the received message is transmitted to the authentication server 200. Here, the client 100 preferably stores the encrypted authentication information and the random number table in the information storage unit 120 without decrypting the received authentication data.

Next, in step S41, the authentication server 200 prevents re-request of authentication information due to hacking of the reception key by deleting the authentication information reception key.

5 is a flowchart illustrating an overall authentication process in a user authentication method using one-time authentication information according to an embodiment of the present invention. Before describing FIG. 5, the time is preferably synchronized between the client 100 and the authentication server 200. However, when synchronization between the two devices is impossible, the authentication server 200 periodically transmits information of a specific time. Synchronization may be maintained.

First, in step S100, the client 100 generates an authentication request message using the authentication information and other information stored in the information storage unit 120, and in step S200, the authentication request message and the user distinguishing key are converted into a certificate server ( 200).

Next, in step S300, the authentication server 200 verifies the authentication request message received from the client 100 using various information stored in the DB for authentication processing 221, and in step S400 generates new authentication information, Generate a 'authentication response message' containing newly generated authentication information as a message informing that the verification is successful, and in step S500 transmits the authentication response message generated in step S400 to the client (100).

Next, in step S600, the client 100 verifies the authentication response message using various information stored in the information storage unit 120, and if the verification is successful, proceeds to step S700 and writes to the information storage unit 120. Delete the stored authentication information and save new authentication information included in the authentication response message.

Meanwhile, in step S800, the authentication server 200 deletes any one of 'success authentication information' or 'final authentication information' previously stored in the authentication processing DB 221, and transmits the authentication to the client 100 in step S500. The authentication information included in the response message is newly stored in the authentication processing DB 221.

FIG. 6 is a flowchart illustrating in more detail a step of generating an authentication request message shown in FIG. 5. That is, FIG. 6 is a flowchart illustrating the above-described step S100 in detail, and it is clear that the subject is the controller 110 of the client 100.

First, in step S101 the authentication information previously stored in the information storage unit 120 is decrypted. In step S103, the additional number is set to an initial value, for example, '0'.

Next, in step S105, the additional number is set to a predetermined value (1) larger than the initial value and then stored, and in step S107, an authentication number for security of the authentication number synchronized between the client 100 and the authentication server 200. The additional number newly set in step S105 is added. Here, the value obtained in step S107 is referred to as a new authentication number (2).

Next, in step S109 to generate a new encryption key different from the encryption key stored in the information storage unit 120 to transmit a new encryption key to the authentication server 200 to be used in the next authentication request. Here, the encryption key generated in step S109 is referred to as a new encryption key (3).

Next, in step S111, the authentication key is obtained by applying the hash function to a value obtained by subtracting the authentication reference time stored in the information storage unit 120 from the specific time. In this case, the authentication key cannot be obtained unless the authentication reference time is known. Furthermore, even if the authentication key is obtained through hacking, the authentication key is obtained based on a specific time, and thus has a different value every time.

Next, in step S113, the value designated by the key index is confirmed on the random number table. In step S115, the value specified by the key index and the authentication key obtained in step S111 are XORed. Here, the value obtained in step S115 is referred to as an XOR authentication key 4.

Next, in step S117 using the hash function to check the damage of the authentication request message sent / received through the online network 300, the additional number (1), the new authentication number (2), the new encryption key (3 ) And request integrity keys up to the authentication key.

Next, in step S119, a value designated by the integrity index on the random number table is checked, and in step S121, the value specified by the integrity index and the request integrity key generated in step S117 are XORed. Here, the value obtained in step S121 is referred to as an XOR request integrity key 5.

Next, in step S123, the value specified by the encryption key and the key index stored in the information storage unit 120 is XORed. Here, the value obtained in step S123 is referred to as the XOR encryption key 6.

Next, in step S125, the authentication number stored in the information storage unit 120 and (1) to (5) are first encrypted using the XOR encryption key, and in step S127, the first step is finally used in step S125 using a password. Secondly encrypts the encrypted value. In other words, the value encrypted in step S127 is the authentication request message transmitted through the online network 300.

FIG. 7 is a flowchart illustrating in more detail the step of verifying the full authentication request message shown in FIG. 5. That is, FIG. 7 is a flowchart illustrating the above-described step S300 in detail, and it is clear that the subject is the control module 210 of the authentication server 200.

First, in step S310, the first decryption of the received authentication request message is first decrypted using a password corresponding to the received user identification key, and in step S320, the final authentication information corresponding to the password is checked in the authentication processing DB 221. do.

Next, in step S330, the final authentication information is used to determine whether the authentication request text is a legitimate text.

As a result of the determination in step S330, if the certification request professional is a legitimate professional, the process proceeds to step S370, while if the certification request professional is not a legitimate professional, the preamble based on the authentication information previously generated in the certification request professional. The flow proceeds to step S350 to determine recognition.

Next, in step S350, the authentication processing DB 221 confirms the 'success authentication information' corresponding to the password, and proceeds to step S360 to determine whether the authentication request professional is a legitimate professional using the success authentication information.

As a result of the determination in step S360, if the authentication request message is legitimate, the process proceeds to step S370. If the authentication request message is legitimate, the process proceeds to step S380, and an error process is performed.

On the other hand, if the success of the certification request professional verification of step S300 is the result of the confirmation of the 'final authentication information' when the authentication information update in step S800 of FIG. In the case of the result of the confirmation of the successful authentication information, 'final authentication information' is deleted when the authentication information is updated in step S800 of FIG. In addition, the above-described steps S320 and S330 may be reversed from S350 and S360, respectively.

FIG. 8 is a flowchart for describing in more detail the step of determining whether the authentication shown in FIG. 7 is successful. That is, FIG. 8 is a flowchart illustrating the above-described step S330 in detail, and it is clear that the subject is the control module 210 of the authentication server 200.

First, in step S331, the value designated by the key index is checked on the random number table. In step S332, an XOR operation is performed on the encryption key and the value designated by the key index. In step S333, an authentication request is made using the value obtained through the XOR operation in step S332. Second-decode the full text.

Next, in step S334, the XOR authentication key is extracted from the information obtained through the decryption in step S33, and the authentication key is extracted by performing an XOR operation on the extracted XOR authentication key and the value designated by the key index.

Next, in step S335, the authentication key is obtained by applying the hash function to a value obtained by subtracting the authentication reference time of the final authentication information from the specific time, similarly to the method of step S111 of FIG.

Next, in step S336 it is determined whether the authentication key extracted in step S334 and the authentication key obtained in step S335 are the same.

As a result of the determination in step S336, if the authentication keys are not the same, the flow proceeds to step S350. On the other hand, if the authentication keys are the same, the flow goes to step S337 to extract the XOR request integrity key from the information obtained through the decryption of step S333. The request integrity key is extracted by performing XOR operation on the extracted XOR request integrity key and the value specified by the integrity index.

Next, in step S338, using the hash function, a request integrity key up to the additional number, the new authentication number and the new encryption key obtained through the decryption of step S333, and the authentication key obtained in step S335 are generated.

Next, in step S339, it is determined whether the request integrity key extracted in step S337 and the request integrity key obtained in step S338 are the same.

As a result of the determination in step S339, if the request integrity key is not the same, the process proceeds to step S350. If the request integrity key is the same, the process proceeds to step S340. To judge. If it is determined that the new authentication number is equal to or smaller than the authentication number, the process proceeds to step S350. On the other hand, if the new authentication number is larger than the authentication number, the process proceeds to step S341. It is determined whether the authentication number of the award is the same. As a result of this determination, if it is not the same, as described above, the process proceeds to step S350 and, if the same, the process proceeds to step S370 to perform the authentication process as shown in FIG.

On the other hand, Figure 8 is also shown in the detailed flow chart for the above step S330 or the same applies to the above-described step S360. However, in step S360, the control module 210 refers to 'success authentication information' stored in the authentication processing DB 221 when determining whether to authenticate.

FIG. 9 is a flowchart for describing in more detail the steps of generating an authentication response message shown in FIG. 5. That is, FIG. 9 is a flowchart illustrating the above-described step S400 in detail, and it is clear that the subject is the control module 210 of the authentication server 200.

First, new authentication information is generated through the process of steps S401 to S407, and in step S409, an XOR operation is performed on the successful authentication key, that is, the authentication key obtained in the above-mentioned step S335 and the value specified in the key index. . Here, the value XOR calculated in step S409 is referred to as XOR authentication key 12.

Next, in step S411, an integrity key of newly generated authentication information is generated using a hash function. Here, the value generated in step S411 is referred to as a 'response integrity key'.

Next, in step S413, an XOR operation is performed on a value designated by the response integrity key and a successful integrity index when verifying the authentication request message. The value calculated in step S413 is referred to as an XOR response integrity key 13.

Next, in step S415, (8) to (13) are first encrypted using the request integrity key that is successful in verifying the authentication request message, and in step S417, the first encrypted value is secondly encrypted using the password. In other words, the value encrypted in step S417 is an authentication response message transmitted through the online network 300.

FIG. 10 is a flowchart for explaining in more detail the step of verifying the authentication response message shown in FIG. 5. That is, FIG. 10 is a flowchart illustrating the above-described step S600 in detail, and it is clear that the subject is the controller 110 of the client 100.

First, in step S601, the first decryption of the received authentication response message is first decrypted. In step S603, the first decryption is performed using the request integrity key previously stored, that is, the request integrity key generated in step S117 of FIG. Second-decode the value.

Next, in step S605, the XOR authentication key 12 is extracted from the information obtained through the decryption of step S603, and the authentication key is extracted by performing an XOR operation on the extracted XOR authentication key and the value specified by the pre-stored key index.

Next, in step S607, it is determined whether the authentication key extracted in step S605 is the same as the previously stored authentication key, that is, the authentication key generated in step S111 of FIG.

As a result of the determination in step S607, if the authentication keys are not the same, the process proceeds to step S615 and an error is processed. On the other hand, the process proceeds to step S609 in which the XOR response integrity key 13 is obtained from the information obtained through the decryption of step S603. Extracts the response integrity key by performing XOR operation on the extracted XOR response integrity key and the value specified by the pre-stored integrity index.

Next, in step S611, a response integrity key of an authentication response message is generated in the same manner as in step S411 of FIG.

Next, in step S613, it is determined whether the response integrity key extracted in step S609 and the response integrity key generated in step S611 are the same. If the determination result is the same, the flow advances to step S700, and if not, the flow proceeds to step S615.

The user authentication method using the one-time authentication information of the present invention is not limited to the above-described embodiment, and may be variously modified and implemented within the range allowed by the technical idea of the present invention.

According to the user authentication method using the one-time authentication information of the present invention as described above, the one-time authentication information is shared between the client and the server, and the encrypted data based on the authentication information is transmitted through the online network with a different value every time. By receiving, there is an effect that user authentication is more secure online. In particular, because the server and the client encrypt the mutually transmitted / received information on the basis of the synchronized time, they have different values every hour. When requesting authentication with the information obtained, it is not time-synchronized with the server.

In addition, according to the present invention, since the encryption technology based on the symmetric key method is used, both the client and the server can perform user authentication with only a small system load. In addition, by storing the one-time authentication information using a USB, such as the current generalized, it is possible to configure a system to protect the user authentication information without supplying a separate device or card to the user.

Claims (9)

It is connected to the client through an online network, the time synchronization with the client is maintained, the one-time authentication information including a random random number and one-time encryption key is performed in the authentication server sharing the client, (a) receiving, from the client, an authentication request message including an authentication key which is a result of calculating a random number included in the one-time authentication information and a current time by a predetermined rule; (b) decrypting the full text of the authentication request received in step (a) using the one-time encryption key; (c) extracting the authentication key from the decrypted result of step (b); (d) calculating a current time and a random number included in the one-time authentication information by a predetermined rule; (e) comparing the authentication key extracted in step (c) with the result calculated in step (d); and and (f) authenticating the client if the compared values in step (e) are the same. The method of claim 1, The authentication request message received from the client includes the new encryption key different from the one-time encryption key, (g) if the comparison value in step (e) is the same, the user authentication method using the one-time authentication information, characterized in that further comprising the step of storing a new encryption key included in the full text of the authentication request. The method of claim 2, (h) generating new authentication information different from the one-time authentication information when the comparison value in step (e) is the same; and (i) encrypting an authentication response message including the new authentication information generated in step (h) and transmitting the encrypted authentication response message to the client. The method of claim 3, wherein The authentication server stores the previous authentication information generated before the one-time authentication information and the previous encryption key received before the one-time encryption key separately, (j) if the comparison value in step (e) is not the same, decrypting the full authentication request message received in step (a) using the previous encryption key; (k) extracting the authentication key from the decrypted result of step (j); (l) calculating a current time and a random number included in the previous authentication information according to a predetermined rule; (m) comparing the authentication key extracted in step (k) with the result calculated in step (l); and (n) If the comparison value in the step (m) is the same, the user authentication method using the one-time authentication information, characterized in that further comprising the step of authenticating the client. The method of claim 4, wherein The authentication request message received from the client includes a request integrity code for authenticating the integrity of the authentication request message, (o) calculating a predetermined value related to the integrity check included in the one-time authentication information according to a predetermined rule; and (p) comparing the operation result of step (o) with the request integrity code, wherein the user authentication method using one-time authentication information is made. The method of claim 5, The authentication response message is a user authentication method using the authentication information, characterized in that it comprises a response integrity code for authenticating the integrity of the authentication response message. The method of claim 6, The authentication response message is a user authentication method using the authentication information, characterized in that the encryption using the request integrity code. The method of claim 7, wherein And the request integrity code and the response integrity code are generated using a hash function. A computer-readable recording medium in which a user authentication method using the one-time authentication information according to any one of claims 1 to 8 is recorded.

Images