KR101318154B1 - Method of providing image-based user authentication for shared documents, and computer-readable recording medium for the same - Google Patents

Abstract

The present invention relates to an image-based user authentication method. More specifically, in order to overcome the problem that the conventional text-based user authentication method is weak, the present invention enhances security by achieving user authentication by modifying an authentication image selected from a plurality of images as they are or in part, and leaking personal information. To eliminate the risk of presenting an image-based user authentication technology. According to the present invention, an authentication method using an image provides an effect of reinforcing personal information security by eliminating the risk of a leak in a text-based user authentication such as a conventional private key or signature recognition. That is, the possibility of overlapping the private key, which is a disadvantage of the conventional private key method, becomes low, and even if a personal authentication image is exposed due to the loss of the terminal, it is difficult to know which of the numerous images stored in the terminal is used as the authentication image. It provides the effect of strengthening the security of personal information.

Description

Image-based shared document user authentication method and computer-readable recording medium therefor {METHOD OF PROVIDING IMAGE-BASED USER AUTHENTICATION FOR SHARED DOCUMENTS, AND COMPUTER-READABLE RECORDING MEDIUM FOR THE SAME}

The present invention relates to an image-based user authentication method. More specifically, in order to overcome the problem that the conventional text-based user authentication method is weak, the present invention enhances security by achieving user authentication by modifying an authentication image selected from a plurality of images as they are or in part, and leaking personal information. To eliminate the risk of presenting an image-based user authentication technology.

The general method of sending and paying bills was that the billing agency printed monthly bills and sent them to the customer through the post office, and the customer paid the bills printed on the bills received directly to the bank using the Jiro service. Direct debit was the mainstream.

Recently, however, with the rapid increase of the Internet and e-mail, a method of sending and paying electronic bills to customers around the world through the same medium as the Internet has been used.

In the case of sending and paying the electronic bill, if the customer wants to receive the electronic bill, he / she must register the personal notice information through the membership registration process with the billing institution, and then request the electronic bill and input the customer's payment information and personal information. Payment of notices is made by credit card or bank transfer.

Consolidation EBPP (Consolidation EBPP) service method is also emerging to provide the billing agency for the delivery of bills and collection of bills.

However, the method of sending and paying electronic bills uses the Internet, and authenticates the user, which leads to illegal access by the third party and illegal leakage of customer information by leaking personal information during user authentication. There is a problem that information can be leaked through the Internet. This problem can occur not only in the sending and receiving of electronic bills, but also in the authentication of users on all web pages provided by the web server.

More specifically, as a method commonly used in the service for authenticating a user in a web browser as well as a method for sending and paying an electronic bill, a method issued by a certification authority under a conventional public key infrastructure (PKI) There is a way to verify public key certificates. This public key infrastructure allows a certification authority to generate a pair of public and private keys (secret keys) for a user.

Here, the public key is a key that is open to the public through a certificate authority and can be accessed by anyone, and the private key is a private key used only by that entity among asymmetric key pairs of one entity. Is given. This public key-based authentication method is convenient, but when a private key is leaked, there is a problem of unauthorized use of personal information, commerce, and web page authentication.

Another method of authentication is the digital signature method, which is currently widely used. In general, an electronic signature method in a web site such as an electronic commerce is converted into digital information on the basis of an application program so that an electronic signature provided in the form of a signature for a customer having a specific qualification in a stored form is recorded. It is.

However, digital signatures also contain a problem that the submission of various documents for the verification of additional personal information must be repeated online. In addition, the conventional certificate method or the digital signature method as described above is a text-based user authentication system, so if the contents are leaked, there is a vulnerability that anyone can easily copy.

Accordingly, in the technical field, there is a demand for technology development to enhance the security of personal information by eliminating the risk of leakage of a private key or signature. In the present invention, by presenting the image-based user authentication scheme through the conversion of ideas to suggest a way that it is difficult for the third party to imitate.

[Related Technical Literature]

1. User authentication method, service authentication method and apparatus using the divided user private key (Patent Application No. 10-2005-0098691)

2. Authentication system using synchronized private key (Patent application 10-2006-0138457)

An object of the present invention is to provide an image-based user authentication method. In more detail, the object of the present invention is to overcome the problem that the conventional text-based user authentication method is vulnerable, to enhance the security by achieving user authentication by modifying the selected authentication image as it is or partially selected from a plurality of images as it is It is to provide image-based user authentication technology by eliminating the risk of personal information leakage.

An image-based user authentication method according to the present invention for achieving this problem, the first step of the user terminal to transmit the authentication image to the authentication server to register as an original-authentication image; A second step of the user terminal driving the web browser to return an authentication image transmission request to the web server according to an access request; A third step of the user terminal generating a challenge-authentication image corresponding to the original-authentication image; A fourth step of providing, by the user terminal, the challenge-authentication image to the web server; A fifth step of the web server acquiring a matching result according to a comparative analysis of the original-authentication image and the challenge-authentication image through a cooperative operation between the web server and the authentication server; And a sixth step of providing, by the web server, the authentication result to the user terminal according to the matching result.

In the present invention, the third step may be configured to select a challenge-authentication image to be used for user authentication among a plurality of images stored in the user terminal, wherein the attempt-attempt by further performing a resizing or partial cutting operation on the selected challenge image It may also be configured to transform the authentication image.

In addition, the first step in the present invention is to register the image generated in response to the user input to the image editing module provided by the user terminal to the authentication server as the original-authentication image, the third step is the user terminal The image editing module may be provided on a web browser to receive an operation from a user and select the reproduced image as a challenge-authentication image.

In addition, the web server is configured to include the step of returning the original-authentication image according to the request for transmission of the original-authentication image to the authentication server when the original-authentication image is not stored in the database of the web server in advance.

An image-based user authentication method according to the present invention for achieving the above object, the first step in which the first user terminal encrypts and registers a shared document using the original-authentication image; A second step in which the first user terminal registers the original-authentication image in the workgroup accessible area of the authentication server; A third step of requesting image-based authentication by a second user terminal attempting to access a shared document; A fourth step in which the second user terminal accesses the authentication server; A fifth step in which the second user terminal selects and downloads the challenge-authentication image to use for accessing the shared document from among the plurality of images stored in the authentication server; Providing a challenge-authentication image downloaded by the second user terminal in response to the image-based authentication request; A seventh step of generating a match result based on a comparative analysis of the original-authentication image and the challenge-authentication image; An eighth step of receiving, by the second user terminal, whether to access the shared document according to the matching result.

The computer-readable recording medium according to the present invention stores a program for performing the user authentication method according to the present invention.

According to the present invention, an authentication method using an image provides an effect of reinforcing personal information security by eliminating the risk of a leak in a text-based user authentication such as a conventional private key or signature recognition.

That is, the possibility of overlapping the private key, which is a disadvantage of the conventional private key method, becomes low, and even if a personal authentication image is exposed due to the loss of the terminal, it is difficult to know which of the numerous images stored in the terminal is used as the authentication image. It provides the effect of strengthening the security of personal information.

1 is a diagram illustrating a system in which an image-based user authentication method according to the present invention is used.
2 is a flowchart illustrating an image-based user authentication method according to a first embodiment of the present invention.
3 is a flowchart illustrating an image-based user authentication method according to a second embodiment of the present invention.
4 is a flowchart illustrating an image-based user authentication method according to a third embodiment of the present invention.

Hereinafter, with reference to the drawings will be described the present invention in more detail.

1 is a diagram illustrating a system in which an image-based user authentication method according to the present invention is used. 2 is a flowchart illustrating an image-based user authentication method according to a first embodiment of the present invention.

First, referring to FIG. 1, a system for performing an image-based user authentication method according to the present invention includes a user terminal 10, a communication network 20, an authentication server 30, and a web server 40. Based on this, it looks at the image-based user authentication method according to the first embodiment of FIG.

(S1) step: the user terminal 10 transmits the authentication image according to the user's selection to the authentication server 30 through the communication network 20. The authentication image may be arbitrarily selected by a user (or an authentication system administrator), and it is preferable to select a relatively plain image that cannot determine whether the image is used for authentication simply by looking at the contents of the image.

(S2) step: Accordingly, the authentication server 30 registers the provided authentication image in the database as an original-authentication image for the user terminal 10. Optionally, the user terminal 10 may transmit the authentication image to the web server 40 to register as an original-authentication image. Preferably the original-authentication image is stored encrypted in a database.

In step S3, the user terminal 10 executes a web browser for the purpose of surfing the web to the web server 40 through the communication network 20. This is the case where the user accesses the web server 40 as his or her own needs while surfing the web using the terminal 10.

In step S4, in response to the access request, the web server 40 returns an authentication image transmission request to the user terminal 10.

(S5) step: The user terminal 10 generates an attempt-authentication image to be used for the user authentication purpose for the web server 40 using the authentication image transmitted in the previous step (S1). The challenge-authentication image may be selected in the same manner as the authentication image provided to the authentication server 30, but more preferably, a part of the authentication image is cut or resized to select a slightly deformed form. You can make authentication more secure. To this end, the web browser of the user terminal 10 preferably provides an editing module for cutting or resizing part of the image. It is also desirable to encrypt the challenge-authenticated image.

More specifically, when the web server 40 accesses the website, the web server 40 may request partial data of the authentication image for authentication, and thus the authentication image stored through the web browser driven by the user terminal 10. Partial data of can be transmitted. In this case, the web browser includes a technology capable of transmitting as many images as necessary in the original image.

(S6) step: Then, the user terminal 10 transmits the challenge-authentication image generated in the previous step (S5) to the web server 40. As the challenge-authentication image is provided from the user terminal 10 to the web server, the web server 40 must perform user authentication and provide the authentication result to the user terminal 10.

(S7)-(S9) steps: First, the web server 40 determines whether the original-authentication image registered according to the transmission in the previous step S1 is received and stored in the database of the web server 40 in advance. do. If the original-authentication image is not stored in advance in the web server 40 as a result of the determination in step S7, the web server 40 requests to transmit the original-authentication image to the authentication server 30 through the communication network 20, and (S8), the authentication server 30 provides the original-authentication image to the web server 40 in response to this request (S9).

Step S10: Then, the web server 40 compares and analyzes the original-authentication image registered in step S2 with the challenge-authentication image provided in step S6 and generates an authentication result according to the match. To this end, the web server 40 should be provided with an analysis module for analyzing the pre-edited authentication image, it may be necessary to further include a decryption module for decrypting the encrypted authentication image.

(S11) step: after step S10, the web server 40 transmits the authentication result to the user terminal 10 through the communication network 20, thereby responding to the access request of the user terminal 10 in step S3. Notify the authentication result. Accordingly, the user terminal 10 may access the web server 40 when the authentication of the authentication result is completed.

On the other hand, the above process may be configured in a somewhat modified as necessary, for example, the web server 40 provides the challenge-authentication image to the authentication server 30, the original authentication in the authentication server 30 The authentication result obtained by matching and comparing the image and the challenge-authentication image may be implemented by providing the web server 40. However, this degree of modification is replaceable to the extent that those skilled in the art can easily conceive of the scope of the present invention is not limited by this modification, in the present invention through the cooperative operation of the authentication server 30 and the web server 40 It is limited to the result of authentication.

3 is a flowchart illustrating an image-based user authentication method according to a second embodiment of the present invention. The second embodiment is generally similar to the first embodiment described above with reference to [FIG. 2], and shows a difference in the process of generating the original-authentication image and the challenge-authentication image.

(S21) Step: Referring to [FIG. 1] and [FIG. 3], the user terminal 10 generates an authentication image according to an input of a user's editing module (editing tool). More specifically, the editing module may be implemented in the web browser of the user terminal 10, and generates an authentication image created through the web browser to register with the web server 40 or the authentication server 30 providing the service. . The authentication image is not stored in the user terminal 10, and it is preferable to generate and transmit it through a web browser whenever an access request is made. In this case, the generated authentication image is preferably generated as an image having a small size and a simple pattern or a pattern in consideration of the function of the web browser and the editing environment. As described above, it is preferable that the authentication image is generated in a relatively plain form that cannot be determined simply by looking at the contents thereof.

Step S22: The user terminal 10 transmits the authentication image generated in step S21 to the authentication server 30 through the communication network 20.

(S23) Step: Accordingly, the authentication server 30 registers the provided original-authentication image in the database as the original-authentication image for the user terminal 10. Optionally, the user terminal 10 may transmit the authentication image to the web server 40 to register as an original-authentication image. Preferably the original-authentication image is stored encrypted in a database.

In operation S24, the user terminal 10 drives a web browser for the purpose of surfing the web and performs an access request to the web server 40 through the communication network 20. This is the case where the user accesses the web server 40 as his or her own needs while surfing the web using the terminal 10.

In step S25, in response to the access request, the web server 40 returns an authentication image transmission request to the user terminal 10.

(S26), (S27) step: in response to the request for transmitting the authentication image of the web server 40, the user terminal 10 starts the editing module, and accordingly the user is the same as the authentication image sent in step S22 or The image, which is considered to be the same range, is regenerated through an input to the editing module (S26). Then, the reproduced authentication image is transmitted to the web server 40 as a challenge-authentication image (S27).

(S28)-(S30) steps: First, the web server 40 determines whether the original-authentication image registered according to the transmission in the previous step S22 is received and stored in the database of the web server 40 in advance. do. As a result of the determination in step S28, if the original-authentication image is not stored in advance in the web server 40, the web server 40 requests to transmit the original-authentication image to the authentication server 30 through the communication network 20, and In operation S29, the authentication server 30 provides the original authentication image to the web server 40 in response to the request (S30).

(S31) step: Then, the web server 40 compares the original-authentication image registered in step S23 with the challenge-authentication image provided in step S27, and generates an authentication result according to the match. To this end, the web server 40 should have an analysis module for analyzing whether the pre-generated authentication image and the original-authentication image are in the same range, and further include a decryption module for decrypting the encrypted authentication image. It may be necessary.

Step S32: After step S31, the web server 40 transmits an authentication result to the user terminal 10 through the communication network 20, thereby requesting access to the user terminal 10 in step S24. Notify the authentication result. Accordingly, the user terminal 10 may access the web server 40 when the authentication of the authentication result is completed.

The user authentication method of the present invention through such a series of processes is based on an image, unlike a key combination method using a conventional text even though a relatively simple image is used, and thus can not be easily inferred by a third party, thereby enhancing security. It is effective.

On the other hand, the above process may be configured in a somewhat modified as necessary, for example, the web server 40 provides the challenge-authentication image to the authentication server 30, the original authentication in the authentication server 30 The authentication result obtained by matching and comparing the image and the challenge-authentication image may be implemented by providing the web server 40. However, this degree of modification is replaceable to the extent that those skilled in the art can easily conceive of the scope of the present invention is not limited by this modification, in the present invention through the cooperative operation of the authentication server 30 and the web server 40 It is limited to the result of authentication.

4 is a flowchart illustrating an image-based user authentication method according to a third embodiment of the present invention.

(S41) Step: Referring to [FIG. 1] to [FIG. 4], the first user terminal 10 prepares an original-authentication image to be used for encrypting the shared document, and uses the original-authentication image to share the document. Encrypt and register. The shared document may be registered in the document management system, or may be registered as metadata in the document file so that the document viewer can recognize it.

In step S42, the first user terminal 10 provides the authentication server 30 with the original-authentication image used for encrypting the shared document, so that the user terminal 10 accesses the database of the authentication server 30. Allow other terminals (not shown) in the workgroup defined by the allowed range to be registered in the accessible area.

In operation S43, when another terminal in the workgroup, that is, the second user terminal 10, attempts to access the shared document, image-based authentication is requested in response to the above encryption action. The document management system may request authentication, or the document viewer program may request authentication.

In step S44, in response to the authentication request, the second user terminal 10 accesses the database of the authentication server 30 through the communication network 20 in order to grant accessibility of the shared document, and within the range of access granted. Since it is a user terminal, access is granted to the area storing the original-authentication image in the authentication server 30.

Step S45: In order to enhance security, the authentication server 30 preferably presents a plurality of images, and the second user terminal 10 may use the challenge-authentication image to access the shared document among the plurality of images. Select to download. If the user of the second user terminal 10 has been granted access to the shared document, the information on the authentication image should be provided in advance.

(S46) step: The second user terminal 10 provides the challenge-authentication image downloaded in step S45 in response to the user authentication request in step S43.

(S47) step: Then, according to the implementation method, the document management system or the document viewer software compares and analyzes the original-authentication image and the challenge-authentication image and generates a matching result accordingly.

In step S48, if the comparison result of step S47 is within the same range or the same range, user authentication is completed for the second user terminal 10, and as a result, the second user terminal 10 has accessibility to the shared document. Is given.

The present invention can also be embodied as computer-readable codes on a computer-readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored.

Examples of the computer-readable recording medium include a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device and the like, and also implemented in the form of a carrier wave (for example, transmission over the Internet) .

The computer readable recording medium may also be distributed over a networked computer system so that computer readable code can be stored and executed in a distributed manner. And functional programs, codes, and code segments for implementing the present invention can be easily inferred by programmers skilled in the art to which the present invention pertains.

As described above, preferred embodiments of the present invention have been disclosed in the present specification and drawings, and although specific terms have been used, they have been used only in a general sense to easily describe the technical contents of the present invention and to facilitate understanding of the invention , And are not intended to limit the scope of the present invention. It is to be understood by those skilled in the art that other modifications based on the technical idea of the present invention are possible in addition to the embodiments disclosed herein.

10: User terminal
20: Network
30: Certificate Server
40: web server

Claims (9)

delete delete delete delete delete A first step in which the first user terminal encrypts the shared document using the original authentication image and registers the document in the document management system;
A second step of the first user terminal registering the original-authentication image in a workgroup accessible area of the authentication server;
A third step of receiving an image-based authentication request as a second user terminal attempts to access the shared document in the document management system;
A fourth step in which the second user terminal accesses the authentication server;
A fifth step of the authentication server confirming whether the workgroup accessible area corresponds to the second user terminal;
A sixth step of the authentication server presenting a plurality of images for the image-based authentication to the second user terminal;
A seventh step of the second user terminal selecting and downloading the challenge-authentication image to be used for accessing the shared document from among the plurality of images presented by the authentication server;
An eighth step of providing, by the second user terminal, the downloaded challenge-authentication image to the document management system in response to the image-based authentication request;
A ninth step of the document management system generating a matching result based on a comparative analysis of the original authentication image and the challenge authentication image;
A tenth step in which the second user terminal is provided with permission to access the shared document according to the matching result;
Image-based shared document user authentication method comprising a.
delete A first step of the first user terminal encrypting the shared document using the original-authentication image and registering the encrypted information as metadata in the document file of the shared document;
A third step of the first user terminal registering the original-authentication image in a workgroup accessible area of the authentication server;
A third step of requesting an image-based authentication based on the metadata by a document viewer operating in the second user terminal as a second user terminal attempts to access the shared document;
A fourth step in which the second user terminal accesses the authentication server;
A fifth step of the authentication server confirming whether the workgroup accessible area corresponds to the second user terminal;
A sixth step of the authentication server presenting a plurality of images for the image-based authentication to the second user terminal;
A seventh step of the second user terminal selecting and downloading the challenge-authentication image to be used for accessing the shared document from among the plurality of images presented by the authentication server;
An eighth step of the second user terminal providing the downloaded challenge-authentication image to the document viewer in response to the image-based authentication request;
A ninth step of the document viewer comparing and analyzing the original-authentication image and the challenge-authentication image based on metadata stored in the shared document, and generating a matching result according to the analysis result;
A tenth step in which the second user terminal is provided with permission to access the shared document according to the matching result;
Image-based shared document user authentication method comprising a.
A computer-readable recording medium storing a user authentication program for performing an image-based shared document user authentication method according to claim 6 or 8.

Images