KR100889250B1 - An apparatus for recognizing otp automatically - Google Patents

Abstract

The present invention relates to an OTP (One Time Password) security system input method used in internet banking business, and more particularly, to a method and apparatus for automatically inputting a query value into an OTP and recognizing a response password.

In order to achieve the object of the present invention, the OTP automatic recognizer for automatically reading the response password of the OTP (One Time Password) of the present invention is the response password output from the OTP and OTP located in a specific part of the OTP automatic recognizer And a reading device for reading the message, the response password of the OTP is changed over a predetermined period of time, and the OTP automatic recognition identifier is connected to the computer and transmits the response password read by the reading device to the computer.

OTP, Internet Banking

Description

ＯＴＰ Automatic Identification System {AN APPARATUS FOR RECOGNIZING OTP AUTOMATICALLY}

1 is a flowchart illustrating a process of performing Internet banking using a question-and-answer OTP.

2 is a flowchart illustrating a process of performing Internet banking using Time OTP.

3 is a diagram illustrating an embodiment of an OTP automatic recognizer.

4 is a view showing another embodiment of an OTP automatic recognizer.

5 shows a system for performing automated internet banking using an OTP automatic recognizer.

6 illustrates an embodiment including a method of performing automated internet banking using an OTP automatic recognizer.

* Description of the symbols for the main parts of the drawings *

300: OTP automatic recognizer 302: camera

304: cylinder 314: QTP

502: Computer 508: Internet Banking Server

408: Time OTP

The present invention relates to an OTP (One Time Password) security system input method used in internet banking business, and more particularly, to a method and apparatus for automatically inputting a query value into an OTP and recognizing a response password.

Recently, as the utilization of Internet banking has increased in addition to visiting banks in person, the security of customers has emerged as a more important issue in Internet banking. Several security programs on the Internet, including keyboard hacking prevention and certificates, have been developed, but additional security systems were required for money transfers and payments.

It is the security card that is used because of this need. A security card is the size of a business card and has 30 or 35 four-digit numbers listed on the back of the card. The user performs internet banking by searching for the security card and inputting a 4-digit response password corresponding to the two-digit number transmitted from the Internet banking server to the user's computer. The user could be protected by a security card even if the computer was hacked to reveal the response password of the Internet banking account or if the public certificate could be used by a third party. However, since the security card is copyable and the code values are fixed, there is still a security problem for the corporate customers who trade large amounts, and OTP was developed to solve this problem.

OTP stands for One Time Password, which means a one-time response password. That is, OTP does not input one of 35 response passwords like a conventional security card, but outputs a response password that changes at a predetermined time interval or outputs a different response password according to a query value input to the OTP. The output response password is used as the response password of Internet banking. There are two types of questions: OTP and Time OTP.

The question-and-answer type OTP is an OTP that outputs the corresponding response password according to the query value input to the OTP. The user accesses the Internet banking server and receives a query value from the Internet banking server immediately before the transfer while performing the Internet banking. The received query value may be any letter or number. However, the commonly used question-and-answer OTP uses a series of six digits as the query value. When the received query value is inputted to the OTP, a response password corresponding to the response is output, and the response password can be transmitted to the Internet banking server to be authenticated and then transferred. For example, if a user subscribed to the OTP service accesses the Internet banking homepage, specifies a transfer amount and a transfer account, and clicks the transfer command button, a message “Question value 345678” is displayed in a browser window. When the user enters 345678 in the question-and-answer OTP, a response password such as 532456 is output. When the user enters this value into the computer, the Internet banking server performs the transfer through the authentication process.

Question-and-answer OTP went through several steps and the user had to enter a six-digit query value. The improvement is Time OTP. Time OTP is an OTP that outputs a response password that changes in accordance with a predetermined period of time. Therefore, it is different from the Q & A OTP in that the user does not need to directly enter the query value into the OTP. However, the user is authenticated by transmitting the OTP response password output to the Internet banking server. same. Specifically, in order to operate Time OTP, turn on the power of Time OTP during transfer, and input the OTP operation password for operating Time OTP into Time OTP. When the OTP activation password is entered, a small hourglass-like icon is displayed on the Time OTP screen with a six-digit response password that changes over time. Since the hourglass shows the valid time of the response password displayed on the current screen, the current response password must be entered into the Internet browser window and authenticated by the Internet banking server before the response password of the next time period is displayed on the OTP screen. .

Although the input procedure is simplified by the time OTP no need to input the query value, there is still the inconvenience of having to enter the OTP operation password at the start. The improvement was RSA OTP. RSA OTP differs from Time OTP in that it is always on without the power button, so the user does not have to enter an OTP activation password each time.

According to the use of OTP, the security is further increased, but the user's convenience is inferior due to the need to go one step further for internet banking. In particular, it is very inconvenient to input the OTP response password every time in a company with a large number of accounts to be processed, which takes a lot of time and has a problem of increasing the probability of error.

Meanwhile, Korean patent application 10-2000-0084977 is an applicant's patent application entitled "Integrated Financial Services System and Method for Integrating Financial Services of Multiple Financial Institutions" and is scattered among a plurality of financial institutions. Disclosed is an invention that provides the financial information of a user at the same time within a short time, thereby enabling the user to integrate the financial information of the individual financial institutions scattered.

The method of providing integrated financial services in the above application is as follows. The user inputs and stores the authentication number and password in the integrated financial service program in advance. When the user logs in to the integrated financial services program and selects the type and target of the desired financial services, the web browser embedded in the program automatically connects to the web server of the individual financial institution. The web browser obtains the necessary financial information from the web servers of the individual financial institutions by using the authentication number and password inputted in advance. The obtained financial information is processed in the user's program and displayed on the user's terminal screen, so that the user can use the desired financial service.

In the above application, the password of the certificate and the password information of the security card must be input in advance, so that the automatic processing can be performed. OTP has a problem that it is difficult to perform automated Internet banking when authenticating using OTP because a person must directly input a response password obtained by inputting a query value or a response password that changes over time.

According to the use of OTP, the security is further increased, but the convenience of the user is inferior due to the need to go one step further for internet banking. In particular, entering an OTP response password every time is very inconvenient for companies with a large number of accounts to be processed, which takes a lot of time and increases the probability of error. In addition, there is a high probability that an error occurs while the user enters a query value into the OTP and reads the 6-digit response password that is changed every time and inputs it into the computer. Time OTP has a inconvenience that the response password must be entered within a valid time because the response password changes over time.

An object of the present invention is an apparatus for automating the process of inputting a query value to OTP and recognizing a response password, thereby reducing the probability of an input error caused by a user's wrong input and error, thereby increasing the convenience of Internet banking. To provide. In addition, the process of recognizing the response password from the OTP is automated, providing a system that can be collectively handled even in the case of a large number of financial services such as account transfer in the integrated financial services.

In order to achieve the object of the present invention, the OTP automatic recognition identifier for automatically reading the response password of the OTP (One Time Password) of the present invention is provided with a reading device for reading the response password output from the OTP, the response password of the OTP Is changed according to a predetermined period of time, the OTP automatic identification device is connected to the computer, and transmits the response password read by the reading device to the computer.

In addition, in the OTP automatic recognizer of the present invention, an input device for inputting a query value to the OTP; And a reading device for reading the response password outputted from the OTP, and the OTP automatic recognition device is connected to a computer, inputs an inquiry value transmitted from the computer into the OTP, and then reads the response password output corresponding thereto by the reading device. Then transfer it to your computer.

Preferably, in the OTP automatic recognizer of the present invention, the input device is a pneumatic cylinder for pressing the input button of the OTP; A pneumatic compressor for maintaining the pressure of the pneumatic cylinder; And a pneumatic controller for controlling the pneumatic cylinder, wherein the pneumatic controller is connected to a computer to control the pneumatic cylinder according to a signal transmitted from the computer.

Preferably, in the OTP automatic recognizer of the present invention, the input device is a cylinder for pressing the input button of the OTP; And a magnetic switch connected to the computer to control the cylinder according to the signal transmitted from the computer.

Preferably, in the OTP automatic recognizer of the present invention, the reading device comprises a camera for capturing an image output from the OTP; And a camera reader for reading the captured image.

Preferably, in the OTP automatic recognizer of the present invention, the OTP automatic recognizer is connected to a computer by USB.

Preferably, in the OTP automatic recognizer of the present invention, the OTP automatic recognizer is connected to a computer by a serial cable.

Preferably, in the OTP automatic recognizer of the present invention, the OTP automatic recognizer is connected to the computer by a parallel cable.

Preferably, in the OTP automatic recognizer of the present invention, the OTP automatic recognizer is wirelessly connected to the computer.

In addition, the automated Internet banking system for achieving the object of the present invention, in the OTP automatic recognizer of the present invention, by storing a computer connected to the OTP automatic recognizer, a server connected through a computer and a network and one or more financial information An automated internet banking system including a database provided to a computer, wherein the computer obtains a response password from an OTP automatic recognizer and performs internet banking on a server based on one or more financial information and response password of the database.

Preferably, the automated Internet banking system of the present invention, the financial information includes one or more of a login ID, account password, deposit account number, withdrawal account number and withdrawal password.

Internet banking method for achieving the object of the present invention, a method for performing the Internet banking using a device that automatically recognizes the response password output by the OTP, OTP outputs a response password that changes at a predetermined time period Doing; Reading the response password so that the computer can recognize the response password; Transmitting the read response password to a computer; And transmitting the response password transmitted to the computer to the internet banking server.

Another Internet banking method for achieving the object of the present invention is a method for performing the Internet banking using a device that automatically recognizes the response password output by the OTP in response to the query value, the computer from the Internet banking server Receiving a query value; Transmitting, by the computer, the query value to the input device; Inputting, by the input device, the query value into the OTP; Outputting, by the OTP, a response password corresponding to the query value; Reading the response password so that the computer can recognize the response password; Transmitting the read response password to a computer; And transmitting the response password transmitted to the computer to the internet banking server.

Preferably, the reading step comprises the steps of photographing an image of the response password; And comparing the photographed image with a predetermined image stored in advance.

A computer readable medium for achieving the object of the present invention is a computer readable medium including instructions for performing Internet banking by using an apparatus for automatically recognizing a response password outputted by an OTP, wherein the OTP is provided at a predetermined time. Outputting a response password changed according to a period; Reading the response password so that the computer can recognize the response password; Transmitting the read response password to a computer; And transmitting the response password transmitted to the computer to the Internet banking server.

Another computer readable medium for achieving the object of the present invention is a computer readable medium for performing Internet banking by using a device that automatically recognizes the response password output by the OTP in response to the query value, Receiving a query value from an internet banking server; Transmitting, by the computer, the query value to the input device; Inputting, by the input device, the query value into the OTP; Outputting, by the OTP, a response password corresponding to the query value; Reading the response password so that the computer can recognize the response password; Transmitting the read response password to a computer; And transmitting the response password transmitted to the computer to the Internet banking server.

Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings.

3 is a diagram illustrating an embodiment of an OTP automatic recognizer. The OTP automatic recognition identifier 300 is a pneumatic cylinder 304 according to a query value received from a question-and-answer OTP 314, a pneumatic cylinder 304 for inputting a password to the question-answering OTP 314, and a computer 502. Camera 302 that receives the image of the response password that is output on the display screen of the pneumatic controller 310, the pneumatic compressor 312 for providing compressed air to the pneumatic cylinder 304, and the QTP O314 314 ), A camera control and reader 306 for reading the response password input to the camera 302, and controlling the camera, and a support 316 for physically supporting the above components.

Hereinafter, the operation of the OTP automatic recognizer of FIG. 3 will be described with reference to FIGS. 1 and 3. Steps 102-110 represent the steps of conventional internet banking. First, the Internet banking homepage is accessed by the user's computer, and the user logs in to the Internet banking server (step 102). Press the bank transfer button on the Internet banking homepage (step 104), and when a screen for entering the transfer information appears on the computer screen, enter the transfer information such as the recipient's account number, the transfer amount, and the passcode (step 106). If you click the 'Transfer' button, the screen to confirm the transfer contents appears again (step 108), check the transfer contents and re-enter the information if there is an error (step 110), and proceed to the next step if there is no error. .

In the query screen output step 112, the query value received from the Internet banking server 508 is output to the computer 502. Thereafter, the output query value is transmitted to a program controlling the OTP automatic recognizer 300. Such a transmission operation may be input to a program for manually controlling an OTP automatic recognizer by an Internet banking user, or may be performed without user input by an automated program. The OTP automatic recognizer 300 receives the query value, and the pneumatic controller 310 controls the pneumatic cylinder 304 to input the query value to the question-answer type OTP 314 according to the query value. That is, each piston of the pneumatic cylinder 304 is moved by the compressed air of the pneumatic compressor 312, and the key of the question-answer type OTP 314 corresponding to each number of the query value is pressed. The function of the pneumatic controller 310 and the pneumatic cylinder 304 is to enter a query value into the OTP, and may be replaced by another configuration that performs the same function. For example, pneumatic cylinder 304 may be replaced by an electric motor, pneumatic controller 310 may be replaced by a motor controller, and a rod connected to the electric motor may be moved to press a key corresponding to the query value. Alternatively, it can be replaced by a magnetic switch and cylinder to press a key. Pneumatic controller 310, pneumatic cylinder 304, pneumatic compressor 312 has been presented by way of example in order to easily describe the present invention, but the scope of the invention is not limited thereto.

When a query value is input to the question-and-answer OTP 314 by the pneumatic cylinder 304 (step 116), the question-answer OTP 314 outputs a response password corresponding to it on the display screen (step 118). The camera 302 captures an image of the response password output to the question-and-answer OTP 314. The photographed image is sent to the camera control and reader 306, and the camera control and reader 306 analyzes the photographed image and reads the output number. Since each digit of the response password displayed on the OTP 314 screen has a total of 10, ranging from 0 to 9, and each digit always has a certain shape, the camera control and reader 306 displays an image of each digit. The response password, which is stored after being stored in advance, can be read by comparing the image of each digit with the previously stored image. The camera 302 and the camera control and reader 306 read a response password that is output on the display screen of the QTP O314 314. The configuration of the camera 302 and any other reading device having the same function is different. It may be replaced. In addition, a camera control and reader 306 may be incorporated within the camera 302.

The read response password is transmitted to the computer, and the transmitted response password is inputted to the Internet banking web page and transmitted to the Internet banking server (step 120). The response password input operation may be automated by a program, similarly to the input of the query value. After entering the response password, the procedure of internet banking is terminated by entering a certificate password input which is commonly used for internet banking (step 122), and finally confirming the transfer history (step 124).

The OTP automatic identification machine is connected to a computer for the above-mentioned transmission operation. It may be connected by wire such as USB, serial cable, or parallel cable, or may be connected by a wireless communication method such as Bluetooth. Those skilled in the art can easily understand the means for connecting the OTP auto-identifier with other computers, and the present invention is not limited due to the manner of connection.

4 is a view showing another embodiment of an OTP automatic recognizer. An OTP automatic recognizer 300 for the Time OTP 408, which captures a response password output on the display screen of the Time OTP 408, and outputs an output response password that is changed at a predetermined time interval. Time OTP 408, a camera control and reader 306 for controlling the camera 302 and reading the response password output from the Time OTP 408, and a support 316 for physically supporting the above components.

Referring to Figures 2 and 4, the operation of the OTP automatic recognizer 300 will be described. Steps 202 to 210 represent the steps of conventional internet banking. First, the Internet banking homepage is accessed by the user's computer, and the user logs in to the Internet banking server (step 202). Press the account transfer button on the Internet banking homepage (step 204), and when a screen for inputting the transfer information appears on the computer screen, transfer information such as the recipient's account number, the transfer amount, and the passcode is entered (step 206). If you click on the 'Transfer' button, the screen to confirm the transfer contents appears again (step 208), check the transfer contents and reenter the information if there is an error (step 210), and proceed to the next step if there is no error. .

The Time OTP 408 changes passwords according to a predetermined time period, and since the user does not enter a query value, no means for entering the query value is required. And, except that there is no step for entering a query value, it is similar to the method of internet banking using the above-described question-and-answer OTP. If the period of a predetermined time, for example, the period of time is 1 minute, the response password displayed in the Time OTP 408 is changed every minute (step 214). The camera 300 photographs the response password, and the image of the photographed response password is input to the camera control and reader 306 to recognize the password, and the recognized response password is transmitted to the computer 502. After entering the received response password into the computer (step 216), entering the certificate password (step 218), and finally confirms the transfer history (step 220).

5 shows a system for performing automated internet banking using an OTP automatic recognizer. The OTP automatic recognizer 300 is connected to the computer 502 to transmit the OTP query value and response password. When using Time OTP, OTP query value does not need to be sent. The OTP automatic recognizer 300 and the computer 502 may be connected to a medium capable of transmitting any signal such as a serial bus, a USB, or a wireless device, and the connection method may vary depending on a specific implementation.

The computer 502 is connected to the internet banking server 508 by the Internet 504 or a dedicated line 506. The computer 502 may be a desktop computer or a mobile computer such as a personal data assistant (PDA) or a mobile phone. The computer 502 may be in the form of a computer, hardware such as a computer central processing unit, a memory, or a device driver, an operating system, or an internet banking application. The scope of the present invention is not limited by the kind. The user's computer 504 accesses the Internet banking server 508 via a network such as the Internet 504 or a dedicated line 506 to perform Internet banking. The OTP query value and response password are also transmitted through the network. The OTP query value and response password may be encrypted, and such a network can be easily configured by those skilled in the art.

6 illustrates an embodiment including a method of performing automated internet banking using an OTP automatic recognizer. The applicant's patent application 10-2002-0058120 discloses a system that can use the financial services of various financial institutions integrally, this embodiment uses this configuration.

In order to perform automated Internet banking, financial information such as a predetermined login ID, password, withdrawal and deposit account number, transfer password, account password, etc. must be registered in the database 616 in advance. Database 616 may reside on a user's local computer or may reside on another computer and be accessed over a network. When the user executes the automation program on the client computer, steps 602, 604, 606, 608, and 610 of FIG. 6 are executed internally on the computer without being visible on the screen. Microsoft's Windows operating system can use the technology of Component Object Model (COM) to perform the above process without showing the user the Internet banking execution screen.

Access the internet banking server using the user login ID and password stored in the database. (Step 602) If Internet banking is to be performed on multiple servers, the server may store the address of the server and the login ID and password of each server in a database so that the Internet banking may be performed on multiple servers.

After logging in to the Internet banking site, information such as withdrawal account, deposit account, withdrawal amount is transmitted to the Internet server. (Step 604) The Internet banking server retrieves the payee information corresponding to the transferred account number, and then sends it to the client computer. (Step 606) The client computer that has received the payee information may display it on the screen for the user to confirm, or internally store the information once and show the result of performing the Internet banking to the user after all steps are completed. It may be.

You will be asked to enter the OTP number after the confirmation of the payee step. (Step 608) In the case of a question-answering OTP, the client computer receives the query value from the Internet banking server, inputs the value into the OTP automatic recognition identifier, and then obtains the response password through the above-described process. In the case of Time OTP, there is no need to input the query value. Therefore, the client computer receives the response password from the OTP automatic recognizer and sends it to the Internet banking server.

If the transfer was successful, go to the transfer completion stage (step 610), determine whether there are more transfers to be carried out, if there is no account, perform the program termination (step 614), and if there are more accounts to transfer There is a step 604.

As described above, OTP automatic recognition according to the present invention not only provides convenience for the user directly inputting the password output to the OTP, but also can reduce the time required for the input time, It has an excellent effect on error prevention.

In addition, OTP automatic recognition recognizer can be combined with automated Internet banking service, so that even if a large number of accounts to be withdrawn and withdrawn can be processed in a batch, it is possible to increase the efficiency of the financial work performed in the enterprise.

Although the invention has been particularly shown and described with reference to the examples, it has been used for the purpose of illustration and should be understood by those skilled in the art to which the invention pertains without departing from the spirit and scope of the invention as defined in the appended claims. Various modifications can be made without

Claims (16)

delete OTP automatic recognizer that automatically reads the response password of OTP (One Time Password), An input device capable of inputting a query value to the OTP; And A reading device for reading the response password output from the OTP; The OTP automatic recognizer is connected to a computer and inputs the query value transmitted from the computer to the OTP, and then reads the response password output corresponding thereto by the reading apparatus and transmits to the computer. Cognitive discriminator. The method of claim 2, The input device Pneumatic cylinder for pressing the input button of the OTP; A pneumatic compressor for maintaining the pressure of the pneumatic cylinder; And And a pneumatic controller for controlling the pneumatic cylinder, And the pneumatic controller is connected to the computer to control the pneumatic cylinder according to a signal transmitted from the computer. The method of claim 2, The input device A cylinder for pressing the input button of the OTP; And And a magnetic switch connected to the computer to control the cylinder in accordance with a signal transmitted from the computer. The method according to any one of claims 2 to 4, The reading device A camera for capturing an image output from the OTP; And And an camera reader for reading the photographed image. The method according to any one of claims 2 to 4, The OTP automatic recognizer is connected to the computer by USB, OTP automatic recognizer. The method according to any one of claims 2 to 4, The OTP automatic recognizer is connected to the computer via a serial cable, OTP automatic recognizer. The method according to any one of claims 2 to 4, The OTP automatic recognizer is connected to the computer by a parallel cable, OTP automatic recognizer. The method according to any one of claims 2 to 4, The OTP automatic recognizer is wirelessly connected to the computer, OTP automatic recognizer. The OTP automatic recognizer according to any one of claims 2 to 4, A computer connected with the OTP automatic identification, A server connected to the computer via a network; An automated internet banking system comprising a database for storing one or more financial information to provide to the computer, And the computer obtains a response password from the OTP automatic recognizer and performs internet banking on the server based on the one or more financial information and the response password in the database. The method of claim 10, Wherein said financial information comprises at least one of a login ID, an account password, a deposit account number, a withdrawal account number, and a withdrawal password. delete A method of performing Internet banking using a device that automatically recognizes a response password that OTP outputs in response to a query value. A computer receiving the query value from an internet banking server; The computer transmitting the query value to an input device; Inputting, by the input device, the query value to the OTP; Outputting, by the OTP, the response password corresponding to the query value; Reading the response password so that the computer can recognize the response password; Transmitting the read response password to a computer; And Transmitting the response password transmitted to the computer to an internet banking server. The method of claim 13, The reading step may include taking an image of the response password; And And comparing the photographed image with a predetermined image and reading the pre-stored image. delete A computer-readable medium for performing internet banking using a device that automatically recognizes a response password output from an OTP in response to a query value. A computer receiving the query value from an internet banking server; The computer transmitting the query value to an input device; Inputting, by the input device, the query value to the OTP; Outputting, by the OTP, the response password corresponding to the query value; Reading the response password so that the computer can recognize the response password; Transmitting the read response password to a computer; And And sending the response password sent to the computer to an internet banking server.

Images