KR100996955B1 - Security method using virtual keyboard - Google Patents

Abstract

The present invention relates to a security method using a virtual keyboard. More specifically, when a user logs in to a web server while inputting a specific character such as an ID or a password, the user inputs information using a keyboard on the virtual keyboard. The present invention relates to a security method using a virtual keyboard that prevents the leakage of personal information by a keyboard hacking program and transmits the encrypted characters to a web server so that a secure connection can be made.

According to the present invention can significantly reduce the risk of personal information leakage that can occur when entering secret information such as ID and password through the keyboard of a PC or mobile phone, even if only one symmetric key is leaked Maintaining security has the effect of preventing data decryption.

Virtual keyboard, encryption, decryption, public key, symmetric key

Description

Security method using virtual keyboard {SECURITY METHOD USING VIRTUAL KEYBOARD}

The present invention relates to a security method using a virtual keyboard. More specifically, when a user logs in to a web server while inputting a specific character such as an ID or a password, the user inputs information using a keyboard on the virtual keyboard. The present invention relates to a security method using a virtual keyboard that prevents the leakage of personal information by a keyboard hacking program and transmits the encrypted characters to a web server so that a secure connection can be made.

With the recent rapid development of computers and the Internet, important tasks such as Internet banking and securities HTS (Home Trading System) can be used by using computers. However, by exploiting this, the spyware or key stroke logger can be used to acquire and record all data input through data input devices such as keyboards, and then send it externally through email or website addresses. There are a growing number of cases of sending and stealing.

For example, a malicious hacker uses a `keylogger program 'to leak personal information, which must be pre-installed on the user's computer, and the username, password, social security number, and account that the user enters through the keyboard. After recording important personal information such as numbers in the log, it has a structure to transmit to the hacker at the set time. Therefore, when such a malicious program is installed on the user's computer by the hacker, when using the Internet online banking, the sensitive user's personal information is leaked as it is.

Various techniques are used to solve such abuse cases. Generally, antivirus, spyware removal tool or PC firewall is used to detect and remove malicious programs such as spyware. However, it does not help for modified malicious programs until it finds a way to acquire, analyze and remove the program.

In order to compensate for these security weaknesses, technologies that use other devices instead of the keyboard as an input means have been disclosed, and one of them is a personal information input method using a virtual keyboard.

The virtual keyboard is intended to have the same effect as inputting characters using the keyboard when a user inputs specific characters with a mouse cursor or the like on a keyboard executed in software on the user terminal.

In the case of using a conventional keyboard, the input value is input to the user terminal through the keyboard interface after the key is pressed, and then encrypted by the control unit. Therefore, if the input value can be intercepted at the moment passing through the keyboard interface, it is encrypted. The previous input will be known.

However, if you use the virtual keyboard, you can increase the security by not knowing the input value according to the click of the mouse.However, the moment you send the input ID and password to the web server, you still have the risk of being exposed to hackers. have.

The present invention has been made to solve the above-described problem, virtual keyboard to reduce the risk of personal information leakage during keyboard input by encrypting the input value clicked with a mouse, etc. in the virtual keyboard, and then transmitted to the web server An object of the present invention is to provide a security method.

In addition, the present invention encrypts the characters entered in the virtual keyboard with the symmetric key stored in the user terminal, and encrypts the symmetric key again with the public key, and then transmits to the web server to reduce the possibility of leakage of secrets further An object of the present invention is to provide a security method.

The present invention for solving the above problems is a security method for encrypting the content input to the virtual keyboard executed on the user terminal, when the user terminal is connected to a web server via wired or wireless Internet, display of the user terminal Displaying a virtual keyboard on a screen; After the user terminal encrypts the specific character input by clicking on the letter board formed on the virtual keyboard using the symmetric key generated by the user terminal, the user terminal requests the public server to transmit the public key. The web server transmitting a specific public key to the user terminal; After the user terminal encrypts the symmetric key using the specific public key, and transmits the encrypted specific character and the encrypted symmetric key to the web server, the web server private key corresponding to the specific public key. Decrypting the symmetric key using; Decrypting, by the web server, the specific character using the decrypted symmetric key; Transmitting, by the web server, the specific character decrypted to the authentication server; And transmitting the authentication result to the user terminal and displaying the authentication result when the authentication result is received from the authentication server.

The user terminal includes both a PC, a mobile phone, and a smartphone that can be connected to the Internet through a wired or wireless communication network.

The virtual keyboard displayed on the user terminal includes an ID input window, a password input window, and a dial, and the characters displayed on the dial are one or more of Korean letters, English letters, and numbers.

The method of clicking on the dial formed on the virtual keyboard includes a method of moving a cursor by clicking one of the cursor movement buttons of a PC or a mobile phone and clicking a specific character of the dial and displaying a specific character of the dial on the touch screen. It is characterized by any one of the method of clicking the area.

The authentication server includes personal information about a user using an ID input through the user terminal, and authenticates whether the user is a legitimate user using an ID and a decrypted password input from the web server.

The virtual keyboard displayed on the user terminal further includes a rearrangement button. When the user clicks the rearrangement button, the arrangement order of the characters represented on the dial is randomly changed.

According to the present invention can significantly reduce the risk of personal information leakage that can occur when entering secret information such as ID and password through the keyboard of a PC or mobile phone, even if only one symmetric key is leaked Maintaining security has the effect of preventing data decryption.

Hereinafter, a security method (hereinafter, referred to as a 'security method') using a virtual keyboard according to an embodiment of the present invention will be described with reference to the accompanying drawings.

1 is a flow chart showing the flow of the security method of the present invention.

The user terminal 100, the web server 200, and the authentication server 300 shown in FIG. 1 are all connected through the Internet (not shown).

The user terminal 100 of the present invention includes all types of terminals that can be connected to the Internet network using a wired or wireless communication network. Generally, PCs such as desktops and laptops are included. Cell phones, PDAs, and smartphones with wireless Internet connection can be used.

Recently, a service for downloading an official certificate or inserting a user identification chip into a mobile phone to use Internet banking has been disclosed. Therefore, there is a growing need to implement a user authentication service as in the present invention.

The web server 200 of the present invention refers to an apparatus for managing a website that provides an online game, internet banking, and a government complaint processing service. In order to use such a service, a user must be authenticated by inputting user information, and the security method of the present invention can be used in the authentication process.

The authentication server 300 refers to a processing system of various personal information certification authorities. The certification authority is an organization that issues and manages public key (private key, symmetric key, etc.) used for security eligibility on the network and encryption and decryption of various messages.

The authentication server 300 stores personal information about the user, such as the user's public key, the validity period of the certificate, the user's name, ID, and password.

First, a user accesses a web server 200 of a service provider in order to use a service such as online game or internet banking. (S102) The web server 200 is accessed through a user terminal 100 connected to the Internet. .

When the web server 200 receives a request for providing a service requiring user authentication from the user terminal 100, the web server 200 executes and displays a virtual keyboard in a web browser displayed on a display screen of the user terminal 100. (S104)

2 is a conceptual diagram showing the configuration of a virtual keyboard 102 according to an embodiment of the present invention. As shown in FIG. 2, the virtual keyboard 102 of the present invention is displayed by being included in a web browser executed in the user terminal 100. Therefore, there is an advantage that does not need to run a separate interface program to configure the ID and password input window.

Even when a device such as a mobile phone is used as a terminal, it is possible to increase the security by generating a virtual keyboard 102 on the screen and inputting a password using a cursor movement button, rather than directly inputting a keypad.

Recently, with the launch of full-browsable mobile phones, Internet access has become almost the same as the Internet environment on PCs. Therefore, it is possible to apply the same method as a PC even when a user is authenticated using a mobile phone.

You can also select specific characters using the cursor movement buttons on a regular PC without using a mouse.

The virtual keyboard 102 of the present invention includes an ID input window 104, a password input window 106, a dial 108, and a rearrangement button 110.

The dial 108 displays characters such as Korean characters, English letters, and numbers, and the user can input ID, password, and other items by clicking a specific character using an input device such as a mouse, a moving button, or a jog shuttle. have. In addition, in the case of a touch pad type mobile phone, which has been widely used in recent years, a method of inputting a character may be used by pressing the virtual keyboard 102 with a finger or an input pen.

The rearrangement button 110 functions to randomly change the arrangement order of the dial 108 generated on the screen of the user terminal 100. This is to avoid the hacking method that reads the movement of the mouse or the movement button as the coordinate value and figure out which character the user inputs. It is preferable that the user presses the rearrangement button 110 once or twice before entering an ID or password to change the arrangement order of the characters of the dial 108.

The user selects one of the ID input window 104 or the password input window 106 by using a mouse or a moving button, and then moves the cursor 112 to the dial 108 to input a specific character. )

When a specific character such as an ID or password is input, the user terminal 100 generates one symmetric key for encryption and encrypts the specific character by executing the generated symmetric key. (S108, S110).

In the present invention, an example of encrypting a specific character mainly used in a user authentication process is described. However, the present invention may be applied to input other matters required for user authentication or other matters requiring security.

The symmetric key means using the same algorithm for encryption and decryption. The DES (Data Encryption Standard) protocol with a 56-bit encryption data size and the 3DES protocol with 168 bits are representative. The symmetric key algorithm and encryption module may be previously stored in the user terminal 100, or may be transmitted and executed every time the web server 200 is accessed.

The encryption / decryption scheme described in the specification of the present invention is a conventional algorithm disclosed before the filing date of the present invention, and thus detailed descriptions are omitted to avoid duplication.

When the encryption for the input character is completed, the user terminal 100 requests the public key transmission to the web server 200 (S112).

The public key is also used as the asymmetric key, which is different from the symmetric key algorithm when the keys used for encryption and decryption are different. In the public key algorithm, a pair of keys is used for encryption and decryption. The pair of keys consists of a public key and a private key.

The public key is a public key for anyone to use, and the private key must be secured so that it can be used only by the person who created the key pair while being kept in the HDD or smart card.

If the data is encrypted with the public key, it can only be decrypted with the private key paired with the public key. Therefore, even if a public key is leaked, if there is no corresponding private key, data cannot be decrypted, thereby increasing security compared to a symmetric key algorithm.

The encryption / decryption technique using the public key algorithm also uses a technique disclosed in the related art, and thus a detailed description thereof will be omitted.

When the transmission request for the public key is input from the user terminal 100, the web server 200 generates and stores the public key and the corresponding private key, and then transmits the generated public key to the user terminal. S114, S116)

The user terminal 100 encrypts the symmetric key using the public key transmitted from the web server 200. (S118) The symmetric key is used to encrypt a specific character input by the user using the virtual keyboard 102. As a key, it is a key necessary when the web server 200 decrypts an encrypted specific character. The security can be further improved by encrypting this with a public key before transmitting it to the web server 200.

The user terminal 100 transmits a specific character and a symmetric key to the web server 200 through the Internet (S120). In this case, the specific character and the symmetric key are respectively a symmetric key (key generated in the user terminal) and a public key (web Encrypted by the key sent from the server).

The web server 200 decrypts the symmetric key using the transmitted private key (S122). The private key used to decrypt the symmetric key is a key corresponding to the public key transmitted to the user terminal 100.

The web server 200 decrypts a specific character by using the decrypted symmetric key (S124).

The web server 200 requests user authentication by transmitting the decrypted specific character to the authentication server 300 (S126). The decrypted specific character includes the user's ID and password.

The authentication server 300 performs a user authentication process by comparing the user identification information stored in its database (DB) and the transmitted information (ID and password included in a specific character) (S128, S130).

The user authentication result is transmitted to the user terminal 100 through the web server 200, thereby completing the authentication process. (S132, S134) The user who completes the authentication process enjoys playing online games on the web server 200 or internet banking. Will be available.

Although the preferred embodiments of the present invention have been described above with reference to the accompanying drawings, the above-described technical configuration of the present invention may be embodied by those skilled in the art to which the present invention pertains without changing its technical spirit or essential features of the present invention. It will be appreciated that the present invention may be practiced as. Therefore, the above-described embodiments are to be understood as illustrative and not restrictive in all respects, and the scope of the present invention is indicated by the appended claims rather than the detailed description, and the meaning and scope of the claims and All changes or modifications derived from the equivalent concept should be interpreted as being included in the scope of the present invention.

1 is a flow chart showing the flow of the security method of the present invention.

2 is a conceptual diagram showing the configuration of a virtual keyboard according to an embodiment of the present invention.

Claims (6)

A security method for encrypting contents input to a virtual keyboard executed on a user terminal, which is one of a PC, a mobile phone, and a smartphone, which can be connected to the Internet through a wired or wireless communication network. When the user terminal accesses a web server through a wired or wireless internet, displaying a virtual keyboard including a dial on which one or more characters of Korean, English and numbers are arranged on a display screen of the user terminal; After the user terminal encrypts the specific character input by clicking on the letter board formed on the virtual keyboard using the symmetric key generated by the user terminal, the user terminal requests the public server to transmit the public key. The web server transmitting a specific public key to the user terminal; After the user terminal encrypts the symmetric key using the specific public key, and transmits the encrypted specific character and the encrypted symmetric key to the web server, the web server private key corresponding to the specific public key. Decrypting the symmetric key using; Decrypting, by the web server, the specific character using the decrypted symmetric key; Transmitting, by the web server, the specific character decrypted to the authentication server; And receiving the authentication result from the authentication server and transmitting the authentication result to the user terminal to display the authentication result. delete delete The method of claim 1, Clicking on the dial formed on the virtual keyboard One of a method of clicking a specific character of the dial by moving a cursor by operating one of the cursor movement buttons of a PC or a mobile phone, or a method of clicking a region where a specific character of the dial is displayed on a touch screen of the mobile phone; Security method using a virtual keyboard. The method of claim 1, The authentication server It stores the personal information about the user corresponding to the ID input through the user terminal, Security method using a virtual keyboard, characterized in that for authenticating whether or not a legitimate user using the user's ID and password included in a specific character input from the web server. The method of claim 1, The virtual keyboard displayed on the user terminal Additionally includes a rearrange button. When the user clicks the rearrangement button, the arrangement order of the characters represented on the dial is changed randomly.

Images