KR101306442B1 - Method for user authentication using token issued on portable device and system using the same - Google Patents

Abstract

A user authentication method and system using a token issued to a portable device are provided. According to the present embodiment, a user authentication method includes requesting a second token of a first SP by using a first token of a first SP issued and stored in a portable device of a user, and requesting a second token of the first SP by a user terminal. In this case, the user terminal logs in to the first SP using the second token of the first SP. As a result, security can be maintained even when the ID and password are leaked in the existing ID authentication method.

Description

Method for user authentication using token issued on portable device and system using the same}

The present invention relates to a user authentication method and system, and more particularly, to a security and user authentication / integrated authentication method and system.

Increasingly, the application of single sign-on (SSO), which allows a single login to authenticate to various services. When SSO is applied, various services and systems can be accessed through a single authentication, which saves users the trouble of having to log in multiple times, and centralized management of identity management of various application services and systems as well as ease of use for service providers. To facilitate authentication and authorization.

The existing SSO construction method can be largely divided into an authentication agency method and an authentication information delivery method.

1 is a view provided to explain the authentication agent method. As shown in FIG. 1, the authentication agent manages the user's authentication information and logs the agent (A.com, B.com, C.com and D.com) servers on behalf of the user. The server owns the user account information of each service server or authenticates the user on behalf of the user through communication with the service servers.

The problem with this type of authentication method is that the agent server directly holds the user's personal information. If the agent server is hacked or the personal information is exposed, the authentication of each service server in the agent service is also vulnerable to security. there is a problem.

2 is a view provided to explain the authentication information delivery method. As shown in Figure 2, the authentication information delivery method, the user is issued an SSO token through the authentication process for the authentication server, the service is issued SSO token (A.com, B.com, C.com and D. com) Automatically delivered to the servers to service servers to verify the user's authentication.

In the web environment, the SSO token is used as a cookie usage model. Since the SSO token is passed through the user's client, there is a risk that the SSO token is easily exposed through sniffing (stealing the packet exchange on the network). There is a problem that security is weak in that it is used.

In addition, SSO deployment requires a major modification to the authentication system of several service servers that are already built, so that the existing authentication system can be utilized to the maximum, and a plan for simple implementation can also be considered.

The present invention has been made to solve the above problems, the object of the present invention is to provide a simple authentication process to the user while ensuring strong security, and to easily provide SSO to service providers without major changes in the existing authentication system The present invention provides a user authentication method and system for performing user authentication using a token issued to a portable device.

A user authentication method according to an embodiment of the present invention for achieving the above object, using the first token of the first service provider (SP) issued and stored in the portable device of the user, the second of the first SP Requesting a token; Delivering a second token of the first SP to a user terminal; And the user terminal logging in to the first SP using the second token of the first SP.

The portable device is a portable terminal, and the user authentication method includes: obtaining an address for an authentication I / F of the first SP from an authentication G / W; And requesting and issuing and storing the first token of the first SP at the address.

The portable device may be a portable terminal, and the user authentication method may further include: requesting the user terminal to log in to the first SP; Requesting, by the first SP, a second token of the first SP from an authentication G / W; Transmitting an address for the authentication I / F of the first SP to the portable terminal to the authentication G / W; Requesting, by the portable terminal, the second token of the first SP while transferring the first token of the first SP to the address; And receiving and storing, by the portable terminal, a second token of the first SP.

The portable device may be a portable terminal, and the user authentication method may include: requesting, by the portable terminal, a first token of the second SP from a second SP that is an affiliate of the first SP; Receiving, by the portable terminal, a first token of the second SP from the second SP; Requesting, by the portable terminal, the second token of the second SP using the first token of the second SP; Receiving, by the portable terminal, a second token of the second SP from the second SP; Delivering, by the portable terminal, the stored second token of the second SP to the user terminal; And automatically logging in to the second SP by the user terminal using the second token of the second SP.

The first token requesting step of the second SP may include: receiving, by the portable terminal, an address for the authentication I / F of the second SP from the authentication G / W; And requesting, by the portable terminal, the first token of the second SP while transferring the user authentication information registered to the second SP and the user authentication information registered to the first SP to the address. Can be.

The second token request step of the second SP may include: receiving, by the portable terminal, an address for the authentication I / F of the second SP obtained from the authentication G / W; And requesting, by the portable terminal, the second token of the second SP while transferring the first token of the second SP to the address.

The portable device may be mounted on the user terminal as a portable storage medium, and the first token of the first SP may be stored and issued in an inactive state in a smart card embedded in the portable storage medium.

And obtaining, by the user terminal, an address for the authentication I / F of the first SP from the authentication G / W; Requesting, by the user terminal, to activate the first token of the first SP at the address; And commanding, by the first SP, activation of a first token of the first SP stored in an inactive state in the smart card.

The portable device may further include: requesting, by the user terminal, a first token of the second SP from a second SP, which is affiliated with the first SP, mounted on the user terminal as a portable storage medium; Receiving, by the user terminal, a first token of the second SP from the second SP and storing the received first token in a smart card embedded in the portable storage medium; Requesting, by the user terminal, a second token of the second SP using the first token of the second SP stored in the smart card; Receiving, by the user terminal, a second token of the second SP and storing the second token in the smart card; And the user terminal automatically logging in to the second SP with the second token of the second SP stored in the smart card.

The first token request step of the second SP may include: receiving, by the user terminal, an address for the authentication I / F of the second SP obtained from the authentication G / W; And requesting, by the user terminal, a first token of the second SP while transferring user authentication information registered to the second SP and user authentication information registered to the first SP to the address. Can be.

In addition, the second token request step of the second SP, the user terminal, receiving the address for the authentication I / F of the second SP obtained from the authentication G / W; And requesting, by the user terminal, a second token of the second SP while transferring the first token of the second SP to the address.

As described above, according to the present invention, user authentication and integrated authentication can be performed using a token issued to a portable device. In particular, by using the ID and password and the stored 'access right token' as a 'temporary access token' issued in real time, it is possible to maintain security even when the ID and password are leaked in the existing ID authentication method.

In order to provide such services, the SP can use the existing authentication method, database, and system as it is, but only the authentication I / F which is responsible for token generation, authentication management, and session management can be added. can do.

1 is a view provided in the description of the authentication agent scheme;
2 is a view provided to explain the authentication information delivery method,
3 is a diagram showing a user authentication system to which the present invention is applicable;
4 is a view provided to explain a user authentication method according to an embodiment of the present invention;
5 to 7 are views provided for further explanation of the user authentication method shown in FIG. 4;
8 is a view provided for explaining a process of registering an affiliate to be integrated authentication after user authentication according to FIG. 4;
9 is a view provided for explaining a process of automatically logging in to an affiliated company after registering the affiliated partner to be integrated-authenticated according to FIG. 8;
10 is a view provided to explain a user authentication method according to another embodiment of the present invention;
11 to 13 are views provided for further explanation of the user authentication method shown in FIG. 10;
14 is a view provided for explaining a process of registering an affiliate to be integrated authentication after user authentication according to FIG. 10, and
FIG. 15 is a view provided to explain a process of automatically logging in to an affiliated company after registering the affiliated partner to be integrated-authenticated according to FIG. 14.

Hereinafter, the present invention will be described in detail with reference to the drawings.

1. User Authentication System

3 is a diagram illustrating a user authentication system to which the present invention is applicable. In the user authentication system shown in FIG. 3, user authentication and integrated authentication are performed using a token issued to a portable device.

As illustrated in FIG. 3, the user authentication system includes a service provider (SP) 100, an authentication G / W 200, a user PC 300, and portable devices 400 and 500.

The SP 100 is a server operated by a service provider and includes an authentication system and authentication I / F. The authentication system is a system that performs an authentication procedure using user information (ID, password). The authentication I / F issues / manages a token, performs an authentication procedure using the token, and manages a session with a user PC 300 which is a user terminal.

The authentication G / W 200 relays the request, response and necessary information transfer between the 'SP 100, the user PC 300, and the portable devices 400 and 500'.

The smartphone 400 and the USB memory 500 are portable devices owned by a user of the user PC 300 and function as a medium in which a token issued from the SP 100 is stored. For security purposes, a security application installed in the smartphone 400 and a smart card, which is a secure element embedded in the USB memory 500, store / manage tokens.

2. Smartphone In the application  User Authentication Using Issued Tokens

Hereinafter, for a process of performing a user authentication procedure by logging in by exchanging a 'Request Token' issued / stored in a security application installed in the smartphone 400 to a 'Access Token' and logging in, This will be described in detail with reference to FIG. 4. 4 is a view provided to explain a user authentication method according to an embodiment of the present invention.

(1) First, the smart phone 400 installed the security application requests the use registration for the service "A.com" of the SP 100 to the authentication G / W 200.

The usage registration request may be performed by registering a security password in the security application and performing a verification procedure for user information (ID, password) registered in "A.com".

(2) Then, the authentication G / W 200 transmits a Uniform Resource Identifier (URI) for the authentication I / F of the "A.com" SP 100 to the security application installed in the smartphone 400.

(3) Next, the security application installed in the smartphone 400 requests the 'access token' issued to the URI received. When requesting for issuance of an access token, a user may additionally perform a verification process on user information (ID, password) registered on "A.com".

(4) If confirmed as a legitimate user, "A.com" SP (100) issues a 'access token' to the security application installed on the smartphone (400). Accordingly, the 'access token' is stored in the security application installed on the smartphone 400.

(5) After that, the user PC 300 requests a login to the "A.com" SP 100.

(6) Then, the "A.com" SP 100 requests the 'temporary access token' from the authentication G / W 200.

(7) The authentication G / W 200, which has received a request for 'temporary access token' from the SP 100, installs a URI for the authentication I / F of the "A.com" SP 100 in the smartphone 400. Push to security application

(8) Then, the security application installed on the smartphone 400 delivers the 'access token' to the pushed URI. When delivering the access token, it is desirable to additionally perform a procedure for confirming the security password of the security application installed in the smartphone 400.

(9) If the 'access token' received from the security application installed on the smartphone 400 is confirmed to have been issued in "(4)", the authentication I / F of the "A.com" SP (100) is a smartphone Issue a temporary access token to the security application installed at 400.

(10) The security application installed on the smartphone 400 delivers the 'temporary access token' issued from the authentication I / F of the "A.com" SP 100 to the user PC 300.

(11) Then, the user PC 300 transfers the received 'temporary access token' to the "A.com" SP 100, whereby the user authentication procedure is terminated and login is completed.

5 shows a security application installation process performed in step (1) of FIG. And, in Figure 6, i) security password registration process performed in step (1) of Figure 4 and the confirmation process for the user information (ID, password) and ii) in step (3) and (4) of FIG. The following shows the process of requesting / issuing / storing access tokens.

Meanwhile, FIG. 7 illustrates a login process in step (5) of FIG. 4, a security password confirmation process performed in step (8) of FIG. 4, and a login completion process in step (11) of FIG. 4.

3. Smartphone In the application  User "Integrated" Authentication Using Issued Tokens

FIG. 8 is a diagram provided to explain a process of registering an affiliate to be integrated-authenticated after user authentication according to FIG. 4.

(1) First, the security application installed in the smartphone 400 transmits the ID and security password of the application to the authentication G / W (200).

(2) And, the security application installed on the smartphone 400 delivers information about the affiliate (B.com) selected by the user to the authentication G / W (200).

(3) Then, the authentication G / W 200 transmits the URI for the authentication I / F of the "affiliate (B.com)" SP 600 to the security application installed in the smartphone (400).

(4) After that, the security application installed in the smartphone 400 requests the 'access token' issued to the received URI. When requesting for issuance of an access token, the user ID registered in "A.com" is delivered together with the user information (ID, password) registered in the affiliate (B.com). The user ID registered in "A.com" is used later to provide affiliate service.

(5) If confirmed as a legitimate user, "affiliate (B.com)" SP 600 is issued a 'access token' of the affiliate (B.com) to the security application installed on the smartphone (400).

(6) Then, the security application installed on the smartphone 400 stores the 'access token' of the issued affiliate (B.com).

FIG. 9 is a diagram provided for explaining a process of automatically logging in to an affiliated company after registering the affiliated partner to be integrated-authenticated according to FIG. 8. In FIG. 9, it is assumed that the user PC 300 is logged in to "A.com".

(1) The user PC 300 which has completed the login to "A.com" grasps that "B.com" exists as an affiliate of "A.com", and the user PC 300 to the authentication G / W 200. Request a 'temporary access token' from an affiliate (B.com) while passing the URI of

(2) The authentication G / W 200, which has received a request for 'temporary access token' of an affiliate company (B.com) from the user PC 300, authenticates I / F of the "partner company (B.com)" SP 600. Push the URI and the URI of the user PC 300 to the security application installed on the smartphone 400.

(3) Then, the security application installed in the smartphone 400, the "access rights token" of the affiliated company (B.com) stored in step (6) of Figure 8 "partner (B.com)" SP (600) Pass in URI for authentication I / F of.

(4) If it is confirmed that the 'access right token' received from the security application installed in the smartphone 400 is issued in "(5)" of FIG. 8, authentication of the "partner (B.com)" SP (100) I / F issues a 'temporary access token' of an affiliate (B.com) to a security application installed on the smartphone 400.

(5) The security application installed in the smartphone 400 transfers the 'temporary access token' issued from the authentication I / F of the "partner (B.com)" SP 100 to the URI of the user PC 300.

(6) Then, the user PC 300 transmits the 'temporary access token' of the affiliated company (B.com) to the "partner company (B.com)" SP (100).

(7) As a result, since the user PC 300 automatically logs in to the affiliate company B. com, a session between the user PC 300 and the "partner company B. com" SP 600 is established.

4. Built-in smart card USB  User authentication using token issued in memory

Hereinafter, the user registers by using the USB memory 500 in which the smart card stored the 'access right token' issued in an inactive state is activated to activate the 'access right token' and then log in by exchanging with a 'temporary access token'. A process of performing the authentication procedure will be described in detail with reference to FIG. 10. 10 is a view provided to explain a user authentication method according to another embodiment of the present invention.

(1) First, a USB memory 500 in which a smart card is stored, in which an access token is issued, which is issued in an inactive state by a service provider, is issued to a user.

(2) After that, the user PC 300 equipped with the USB memory 500 requests a login to the "A.com" SP 100.

(3) The user PC 300 transmits the smart card ID to the authentication G / W 200 to request the use registration for the USB memory 500 in which the smart card is embedded.

(4) When the smart card ID integrity is confirmed, the authentication G / W 200 delivers the URI for the authentication I / F of the "A.com" SP 100 to the user PC 300.

(5) Then, the user PC 300 requests the activation of the 'access right token' stored in the smart card embedded in the USB memory 500 with the received URI. When requesting to activate the 'access token', the verification procedure for the smart card authentication information may be additionally performed.

(6) Upon receiving a request for activating the 'access token' from the user PC 300, the "A.com" SP 100 sends a 'access token' activation command to the USB memory 500 through the user PC 300. Deliver to installed smart card. As a result, the 'access right token' stored in the smart card embedded in the USB memory 500 is activated.

(7) Afterwards, the user PC 300 delivers the activated 'access right token' stored in the smart card embedded in the USB memory 500 to the "A.com" SP 100, and issues a 'temporary access token'. Ask.

(8) When the integrity of the 'access right token' is confirmed, the "A.com" SP 100 issues a 'temporary access token' to the smart card embedded in the USB memory 500 through the user PC 300. . The issued 'temporary access token' is stored in a smart card embedded in the USB memory 500.

(9) After that, the user PC 300 transmits the 'temporary access token' stored in the smart card embedded in the USB memory 500 to the "A.com" SP 100, whereby the user authentication procedure is terminated. Login is complete.

FIG. 11 illustrates a process of issuing a USB memory 500 in which a smart card in which an inactivated 'access right token' is stored in step (1) of FIG. 10 is stored. In addition, FIG. 12 shows a process for activating the 'access right token' performed in steps (5) and (6) of FIG. 10. Meanwhile, FIG. 13 illustrates a process of logging in by steps (7) to (9) of FIG. 10.

5. Built-in smart card USB  User "integrated" authentication with tokens issued in memory

FIG. 14 is a diagram provided to explain a process of registering an affiliate to be integrated-authenticated after user authentication according to FIG. 10.

(1) First, the user PC 300 equipped with the USB memory 500 in which the smart card is embedded transmits the smart card ID and the security password to the authentication G / W 200.

(2) The user PC 300 transmits the information on the affiliated company (B.com) selected by the user to the authentication G / W 200.

(3) Then, the authentication G / W 200 transmits the URI for the authentication I / F of the “affiliate (B.com)” SP 600 to the user PC 300.

(4) The user PC 300 requests for issuance of 'access token' of the affiliated company (B.com) to the received URI. When requesting for issuance of an access token, the user ID registered in "A.com" is delivered together with the user information (ID, password) registered in the affiliate (B.com). The user ID registered in "A.com" is used later to provide affiliate service.

(5) If confirmed as a legitimate user, the "affiliate (B.com)" SP (600) is a smart card embedded in the USB memory 500 mounted on the user PC (300) of the affiliate (B.com) 'access rights Issue one token.

(6) As a result, the 'access right token' of the affiliated company (B.com) is stored in the smart card embedded in the USB memory 500.

FIG. 15 is a view provided to explain a process of automatically logging in to an affiliated company after registering the affiliated partner to be integrated-authenticated according to FIG. 14.

(1) In FIG. 15, it is assumed that the user PC 300 is already logged in to "A.com".

(2) The user PC 300 logged in to "A.com" grasps that "B.com" exists as an affiliate of "A.com", and affiliates (B.com) to the authentication G / W 200. Request the connection information of).

(3) In response to the request for connection information of the user PC 300, the authentication G / W 200 sends the URI for the authentication I / F of the "partner (B.com)" SP 600 to the user PC (300). To pass).

(4) Then, the user PC 300, through the step (6) of Figure 14 "Access Right Token" stored in the smart card embedded in the USB memory 500 "partner (B.com)" SP (600) Pass in URI for authentication I / F of.

(5) If the 'access right token' received from the user PC 300 is confirmed to have been issued in "(5)" of Figure 14, the authentication I / F of the "partner (B.com)" SP 600 is Issuing a 'temporary access token' of the affiliate (B.com) to the smart card embedded in the USB memory 500 mounted on the user PC (300).

Accordingly, the 'temporary access token' of the affiliated company (B.com) is stored in the smart card embedded in the USB memory 500.

(6) After that, the user PC 300 delivers the 'access token' of the affiliated company (B.com) stored in the smart card embedded in the USB memory 500 to the "partner (B.com)" SP 600. do.

(7) Then, since the user PC 300 is automatically logged in to the affiliate company B. com, a session between the user PC 300 and the "partner company B. com" SP 600 is established.

6. Other

Up to now, preferred embodiments and methods for performing user authentication and integrated authentication using tokens issued to portable devices have been described in detail.

It goes without saying that the technical idea of the present invention can also be applied to a computer-readable recording medium having a computer program for performing the functions of the apparatus and method according to the present embodiment. In addition, the technical idea according to various embodiments of the present invention may be embodied in computer-readable code form recorded on a computer-readable recording medium. The computer-readable recording medium is any data storage device that can be read by a computer and can store data. For example, the computer-readable recording medium may be a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk, an optical disk, a hard disk drive, or the like. In addition, the computer readable code or program stored in the computer readable recording medium may be transmitted through a network connected between the computers.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but, on the contrary, It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the present invention.

100, 600: SP
200: Certification G / W
300: user PC
400: smartphone
500: USB memory

Claims (11)

Requesting a second token of the first SP from the first SP using the first token of the first SP issued and stored in a portable device of the user from a first service provider (SP);
Delivering a second token of the first SP issued from the first SP to a user terminal; And
Using the second token of the first SP, the user terminal logging in to the first SP; user authentication method comprising a.
The method of claim 1,
The portable device is a portable terminal,
The user authentication method,
Obtaining an address for the authentication I / F of the first SP from the authentication G / W; And
And requesting and issuing and storing the first token of the first SP in the address.
The method of claim 1,
The portable device is a portable terminal,
The user authentication method,
Requesting the user terminal to log in to the first SP;
Requesting, by the first SP, a second token of the first SP from an authentication G / W;
Transmitting an address for the authentication I / F of the first SP to the portable terminal to the authentication G / W;
Requesting, by the portable terminal, the second token of the first SP while transferring the first token of the first SP to the address; And
And receiving, by the portable terminal, a second token of the first SP and storing the second token.
The method of claim 1,
The portable device is a portable terminal,
The user authentication method,
Requesting, by the portable terminal, a first token of the second SP from a second SP which is an affiliate of the first SP;
Receiving, by the portable terminal, a first token of the second SP from the second SP;
Requesting, by the portable terminal, the second token of the second SP using the first token of the second SP;
Receiving, by the portable terminal, a second token of the second SP from the second SP;
Delivering, by the portable terminal, the stored second token of the second SP to the user terminal; And
And the user terminal automatically logging in to the second SP with the second token of the second SP.
5. The method of claim 4,
The first token request step of the second SP,
Receiving, by the portable terminal, an address for the authentication I / F of the second SP from the authentication G / W; And
Requesting, by the portable terminal, a first token of the second SP while transferring user authentication information registered to the second SP and user authentication information registered to the first SP to the address; A user authentication method characterized by the above-mentioned.
5. The method of claim 4,
The second token request step of the second SP,
Receiving, by the portable terminal, an address for the authentication I / F of the second SP obtained from the authentication G / W; And
Requesting, by the portable terminal, the second token of the second SP while transferring the first token of the second SP to the address.
The method of claim 1,
The portable device is mounted to the user terminal as a portable storage medium,
And a first token of the first SP is stored and issued in an inactive state in a smart card embedded in the portable storage medium.
8. The method of claim 7,
Obtaining, by the user terminal, an address for authentication I / F of the first SP from authentication G / W;
Requesting, by the user terminal, to activate the first token of the first SP at the address; And
Commanding, by the first SP, activation of a first token of the first SP stored in an inactive state in the smart card.
The method of claim 1,
The portable device is mounted to the user terminal as a portable storage medium,
Requesting, by the user terminal, a first token of the second SP from a second SP which is an affiliate of the first SP;
Receiving, by the user terminal, a first token of the second SP from the second SP and storing the received first token in a smart card embedded in the portable storage medium;
Requesting, by the user terminal, a second token of the second SP using the first token of the second SP stored in the smart card;
Receiving, by the user terminal, a second token of the second SP and storing the second token in the smart card; And
And the user terminal automatically logging in to the second SP with the second token of the second SP stored in the smart card.
The method of claim 9,
The first token request step of the second SP,
Receiving, by the user terminal, an address for the authentication I / F of the second SP obtained from the authentication G / W; And
Requesting, by the user terminal, a first token of the second SP while transferring user authentication information registered to the second SP and user authentication information registered to the first SP to the address. A user authentication method characterized by the above-mentioned.
The method of claim 9,
The second token request step of the second SP,
Receiving, by the user terminal, an address for the authentication I / F of the second SP obtained from the authentication G / W; And
Requesting, by the user terminal, a second token of the second SP while transferring the first token of the second SP to the address.

Images