KR101336438B1 - Method for user authentication using rear audio equipment of mobile device - Google Patents

Abstract

A method for authenticating a user using a rear audio device of a mobile terminal is disclosed. A method for inputting a password on a terminal equipped with an audio transception tool may include (1) a step of activating the audio transception tool upon the launch of a password input screen and (2) a step of recognizing information inputted through the password input screen as the password depending on the state of the audio transception tool being controlled by a user. [Reference numerals] (AA) Start;(BB) End;(S210) Activate an audio transception tool and a password input screen;(S220) Recognize a password by using a combination of propositions inputted through the audio transception tool and the value inputted through the password input screen

Description

User authentication method using rear acoustic device of mobile terminal {METHOD FOR USER AUTHENTICATION USING REAR AUDIO EQUIPMENT OF MOBILE DEVICE}

Embodiments of the present invention relate to a method for inputting a password required for authentication of a user.

Recently, there have been many devices using touch screens such as ATMs, driverless ticket vending machines, as well as mobile phones. In addition, various tablet PCs and smartphones have emerged and are rapidly spreading.

In such devices, a method of inputting a password and a personal identification number (PIN) for user authentication is commonly used. However, passwords or PINs used in these devices are often limited to four digits, and even if there is no limit on the number of digits, the user may use a short password or PIN for convenience, especially peeking or camera-attacking attacks. Vulnerable to

As an alternative to the vulnerability of the user authentication method using a password or PIN input, there is a method of using bio information such as a fingerprint or an iris, and a method of analyzing user behavior such as keystroke dynamics. However, it is difficult to use it economically because additional equipment is needed to use bio-information, and behavior-based authentication is a complex algorithm and a large amount of input for generating an authentication model using a specific pattern of legitimate users. This is not suitable for device authentication using a touch screen because it is required.

In Korean Patent No. 10-1015633 (Registration date February 10, 2011), in order to protect the user's input information from keyboard hacking and peeking, the computer provides the screen information and voice information together to A method of inputting a combination of pieces of information is disclosed.

The existing data input method is basically a method of delivering a voice challenge to a user and authenticating the user by directly checking a corresponding sound. In other words, conventional methods often assume that a system to be authenticated includes radio transceivers such as wireless LAN, Bluetooth, and RF (radio frequency). Since the wireless transceiver is not basically equipped, the utilization is poor. In addition, the method using the ultrasonic transceiver for signal transmission also has the same problem because both the token and the authentication target system requires the ultrasonic transceiver.

In this specification, a method for allowing a user to securely input information required for authentication against an attack such as peeping or camera shooting is proposed.

It provides a password input method to protect user's personal information from sneak attack or camera shooting attack.

The present invention provides a password input method for safely inputting authentication information of a user using an acoustic means, which is a basic configuration of a mobile terminal, without requiring an additional device.

According to an embodiment of the present invention, a method for inputting a password in a terminal having sound transmitting and receiving means includes: (1) activating the sound transmitting and receiving means at the time when the password input screen is executed; And (2) recognizing information input through the password input screen as the password by proposing the operation state of the sound transmitting / receiving means by a user.

According to one aspect, the step (1), it is possible to output a predetermined pattern of sound through the speaker and to check the volume of the sound through the microphone. At this time, step (2), it is possible to distinguish the operation state of the sound transmitting and receiving means by using the volume of the sound identified through the microphone.

According to another aspect, the step (2), the user does not block the speaker or the microphone by hand or the state of any one of the state blocked the speaker or the microphone to the information input through the password input screen as a true value In the other state, the information input through the password input screen may be recognized as a false value.

According to an embodiment of the present invention, a method for inputting a password in a terminal having sound transmitting and receiving means includes: (1) activating the sound transmitting and receiving means when a password input is required; And (2) recognizing the operation pattern of the sound transmitting and receiving means by the user as the password.

According to one aspect, the step (1), it is possible to output a predetermined pattern of sound through the speaker and to check the volume of the sound through the microphone. At this time, step (2), it is possible to recognize the operation pattern of the sound transmitting and receiving means using the volume of the sound confirmed through the microphone.

According to another aspect, the step (2), the user does not block the speaker or the microphone by hand, the operation pattern consisting of at least one element of the order of the state of blocking the speaker or the microphone and the holding time of each state It can be recognized by the password.

According to an embodiment of the present invention, a password is input by combining a proposition for an input value through an operation of an audio transmitting / receiving means, or a manipulation pattern for an audio transmitting / receiving means is directly inputted as a password to prevent a peeping attack or a camera shooting attack. It can provide more secure user password input method. Therefore, it is possible to solve the problem that the input information is exposed in the process of the user inputs the information required for authentication, it is possible to protect the user's password more secure.

According to an embodiment of the present invention, since both the touch screen and the audio transmission and reception means are basically supported functions in most mobile terminals, there is an advantage that an additional device for password protection and user convenience is not required.

1 is an exemplary view for explaining the front and rear configuration of the mobile terminal.
2 is a flowchart illustrating a password input method using the audio transmission and reception means of the mobile terminal as a proposition input means for a password according to an embodiment of the present invention.
FIG. 3 is an exemplary diagram for explaining a process of inputting a proposition using sound transmitting / receiving means according to an embodiment of the present invention.
4 is a flowchart illustrating a password input method using a sound transmitting and receiving means of a mobile terminal as a pattern input device for a password according to another embodiment of the present invention.
5 is a block diagram illustrating an internal configuration of a terminal for implementing a password input method according to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

The present embodiments relate to a method for safely entering a password against an attack such as peeping during a user authentication process or photographing by a camera.

In this embodiment, no additional device is required to receive a password and security can be guaranteed because the password input by the user is not exposed at all.

In the present specification, 'password' is information input for user authentication, which may mean a PIN, a password, and the like, but is not limited thereto, and may be easily extended to all types of passwords used to identify a user. The password may be composed of various characters or symbols such as numbers, Korean, and English, and further, may be formed in a specific pattern.

The mobile terminal is a means for inputting a password for authentication of a user, and may mean any terminal provided with a sound transmitting / receiving means such as a microphone or a speaker at the rear of a smartphone, a tablet, and the like.

According to the present embodiments, when a user manipulates a sound device disposed at a rear side with the front screen of the mobile terminal facing the user, a shoulder surfer located next to or behind the user may view the rear operation contents of the terminal by the user. It was conceived in that it could not be peeped.

The present invention proposes a method for securely authenticating a user in a mobile terminal in which sound transmitting and receiving means such as a microphone or a speaker is disposed at a rear side thereof.

1 illustrates a front side 110 and a rear side 120 of a mobile terminal.

The display unit 101 is disposed on the front surface 110 of the terminal, and on the rear surface 120, additional devices such as a camera 103 and sound transmitting and receiving means 102 such as a speaker or a microphone are disposed.

Although various embodiments of the present invention can be considered with respect to a password input method using the sound transmitting and receiving means 102, a password required for user authentication may be input in two ways as follows.

The first method may use the sound transmitting and receiving means 102 of the mobile terminal as a proposition input means for the password. In the second method, the audio transmission and reception means 102 of the mobile terminal can be used as a pattern input device for a password.

Hereinafter, a password input method using the audio transmission and reception means of the terminal will be described in detail. In this case, each step of the password input method may be performed by the terminal to be described with reference to FIG. 5.

First Embodiment

2 is a flowchart illustrating a password input method using the audio transmission and reception means of the mobile terminal as the proposition input means for the password.

In step S210, when the user authentication is required, the terminal may display a password input screen (for example, a PIN pad) on the display means of the mobile terminal, and at the same time, activate the sound transmission / reception means.

In operation S220, the terminal may recognize the user's password from a combination of an input value input through the password input screen and a proposition value input through the sound transceiving means.

For example, when a user wants to input a user's password using a password input screen and a rear speaker of a mobile terminal, the user touches the PIN pad on the front of the terminal and simultaneously moves the rear speaker 102 with a finger as shown in FIG. 3. An operation 320 for blocking the opening operation 310 or the rear speaker 102 may be selectively performed. For example, the terminal recognizes the number input through the PIN pad as a 'true' input in a state in which the rear speaker 102 is not blocked by a finger 310, while the PIN is blocked in a state in which the rear speaker is blocked by a finger 320. The number entered through the pad can be recognized as a 'false' input.

For example, when the user manipulates the password input screen and the rear speaker of the terminal in the order as shown in Table 1 below, <2086> may be input as the user's PIN.

(1) Open speaker and touch number '2' on PIN pad-> recognize number '2' as PIN input
(2) Block the speaker and touch the number '7' on the PIN pad-> false input so it will not be recognized
(3) Block the speaker and touch the number '4' on the PIN pad-> false input so it will not be recognized
(4) Block the speaker and touch the number '1' on the PIN pad-> do not recognize because it is a false input
(5) Open speaker and touch number '0' on PIN pad-> recognize number '0' as PIN input
(6) Block the speaker and touch the number '6' on the PIN pad-> false input so it will not be recognized
(7) Open speaker and touch number '8' on PIN pad-> recognize number '8' as PIN input
(8) Open speaker and touch number '6' on PIN pad-> recognize number '6' as PIN input
(9) Block the speaker and touch the number '1' on the PIN pad->don't recognize it because it is a false input

In order to use the rear speaker as a proposition input means for password input, the terminal must be able to recognize the state of blocking and opening the user's speaker, which causes the terminal to generate a certain pattern of sound to the rear speaker when authentication is performed. The microphone provided in the to determine the volume of the sound is recognized. In other words, by comparing the sound volume generated by the speaker with the sound volume recognized by the microphone, if the sound recognized by the microphone is large, the user recognizes that the speaker is opened. It can be recognized as blocked.

At this time, in order to prevent the attacker to recognize the attack by attacking the sound, the microphone of the terminal can recognize the sound pattern, but the human being uses a high frequency region (for example, 18 ~ 20KHz band of the higher audible frequency) that is difficult to recognize easily The volume can be adjusted to a minimum.

In the example of operation of Table 1, even if the attacker observes the front input of the user and checks the numeric string of <274106861>, it is difficult to find out which of the numbers corresponds to the actual password unless the rear of the terminal is simultaneously observed.

The password input method is similar when the rear speaker and the front microphone provided in the terminal, or the rear microphone and the front speaker are used.

Although the password input screen has been described as a general PIN pad as an example, it is similarly applicable to an authentication method in which a user inputs information on the screen in any form, such as another type of keypad or graphic password. In either case, you can reduce the likelihood of attack by blocking the rear speakers or the rear microphones and allowing the terminal to ignore the information you enter.

In the first embodiment, the information input while blocking the rear speaker or the rear microphone is described as an example of a 'false' input. On the contrary, the information input while the rear speaker or the rear microphone is not blocked is 'false'. It is also possible to recognize it as an input.

Second Embodiment

4 is a flowchart illustrating a password input method using the audio transmission and reception means of the mobile terminal as a pattern input device for a password.

In step S410, the terminal may activate the sound transmission and reception means when user authentication is required. Activation of the sound transmitting and receiving means may mean that the terminal generates a predetermined pattern of sound to the speaker and recognizes the corresponding sound through the microphone, as described in the first embodiment.

In operation S420, the terminal may receive a user's operation pattern for the audio transmission / reception means and recognize the operation pattern of the audio transmission / reception means as the user's password.

At this time, the terminal does not transmit any information to the display means on the front, and the user does not input any information through the display means. All information for entering a password is input by operating a speaker or a microphone at the rear of the terminal.

In the second embodiment, the pattern of blocking and opening the speaker or microphone, that is, the order of blocking and opening, the holding time of each blockage or opening, and the like are the passwords. For example, the user's password may be configured as shown in Table 2.

(1) block the speaker for 0.2 seconds
(2) speaker open for 0.6 seconds
(3) block the speaker for 0.2 seconds
(4) Leave speaker open for 0.1 second
(5) Block the speaker for 0.4 seconds
(6) Leave the speaker open for 0.1 seconds

However, the actual rhythm and pattern can be remembered as if the morse code is entered, rather than the actual time the user opens and closes. The advantage of this method is that it can be securely authenticated in situations where an attacker cannot observe information at all, such as in a pocket or in a dark place. Therefore, the password can be protected while keeping the user authentication process more secure.

5 is a block diagram illustrating an internal configuration of a terminal for implementing a password input method according to an embodiment of the present invention.

As shown in FIG. 5, the terminal for inputting a password includes an input module 510, a storage module 520, a calculation module 530, a display module 540, and an audio transmission / reception means 550. Can be.

The input module 510 is a module for receiving information from a user through a keyboard, a mouse, a touch screen, a keypad, an RFID, a smart card, a biometric (fingerprint, an iris, a voice, a face), and other methods. The input module 510 of the terminal for inputting a password according to the present invention may be implemented as an input module capable of touch input. In addition, other devices may use a finger mouse, a notebook touch pad, and a G-sensor. Various input methods can be adopted according to the system environment such as the input method through tilt or motion.

The display module 540 may display a password input screen for inputting a password, an environment setting screen for setting an environment related to user authentication, and the like. In addition, the display module 540 may display a guide message such as a user authentication type help or an error message to the user. The input module 510 and the display module 540 may be implemented as one integrated device.

The operation module 530 can recognize the screen touch operation of the user through the input module 510 and can control the overall operation for user authentication based on the screen touch operation of the user. First, when the user authentication is required, the operation module 530 may display a password input screen through the display module 540 and simultaneously activate the audio transmission / reception means 550. As another example, when the user authentication is required, the calculation module 530 may activate only the sound transmitting / receiving means 550 without transmitting information through the display module 540.

The sound transmitting and receiving means 550 may be configured as a speaker and a microphone, and when activated in a password input process, the sound transmitting and receiving means 550 may generate a sound of a high frequency region through the speaker and recognize the volume of the corresponding sound through a microphone. In this case, it may be distinguished whether the user blocks or opens the speaker or the microphone according to the volume of the sound recognized through the microphone.

In the present embodiment, the audio transmission and reception means 550 may be used as a proposition input means for a password or as a pattern input device for a password. For example, the user may touch the PIN pad, which is a password input screen, and at the same time, open or block a speaker or a microphone, which is the sound transmitting / receiving means 550, with a finger. For example, the calculation module 530 recognizes the number input through the PIN pad as a 'true' input without blocking the speaker or the microphone with a finger, while inputting the PIN pad while blocking the speaker or the microphone with a finger. Can be recognized as 'false' input. In other words, the calculation module 530 may recognize the password input from the user through a combination of the input value input through the password input screen and the proposition value input through the audio transmission and reception means. As another example, the user may operate the audio transmission / reception means 550, ie, the speaker or the microphone, with a finger to input a password without inputting any information through the input module 510. Accordingly, the operation module 530 may recognize a pattern of blocking and opening the speaker or the microphone, that is, a combination pattern such as an order of blocking and opening, and a holding time of each blockage or opening, as a user's password.

The storage module 520 stores a password for user authentication. When the password input from the user is simultaneously matched with the password stored in the storage module 520, the calculation module 530 simultaneously operates the password input screen and the audio transmission / reception means 550 or a single operation of the audio transmission / reception means 550. Accept access

In the case where a user's password is input in a local environment (eg, a smartphone) and password authentication is performed at a remote server, the storage module 520 and the calculation module 530 may be implemented in a configuration of a remote server. It is possible. For example, a smartphone receives a password from a user and delivers the password to a server, whereby the server can determine whether to accept the user's access through authentication of the password.

According to the terminal of the above configuration, it is possible to securely input the user's password by using the audio transmission and reception means (speakers and microphone) provided in the terminal.

As described above, according to the embodiment of the present invention, the password is input by combining the propositions for the input values through the operation of the audio transmission / reception means, or by directly inputting the operation pattern for the audio transmission / reception means as the password. It can provide a more secure user password input method for attacks. Therefore, it is possible to solve the problem that the input information is exposed in the process of the user inputs the information required for authentication, it is possible to protect the user's password more secure. In addition, according to the embodiment of the present invention, since both the touch screen and the audio transmission and reception means are basically supported functions in most mobile terminals, there is an advantage that an additional device for password protection and user convenience is not required.

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. For example, the apparatus and components described in the embodiments may be implemented within a computer system, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable array (FPA) A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For ease of understanding, the processing apparatus may be described as being used singly, but those skilled in the art will recognize that the processing apparatus may have a plurality of processing elements and / As shown in FIG. For example, the processing unit may comprise a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of the foregoing, and may be configured to configure the processing device to operate as desired or to process it collectively or collectively Device can be commanded. The software and / or data may be in the form of any type of machine, component, physical device, virtual equipment, computer storage media, or device , Or may be permanently or temporarily embodied in a transmitted signal wave. The software may be distributed over a networked computer system and stored or executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI &gt; or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

510: input module
520: storage module
530: Operation module
540: Display module
550: sound transmitting and receiving means

Claims (6)

Claims [1] A method for inputting a password in a terminal having sound transmitting and receiving means,
(1) activating the sound transmitting / receiving means at the time when the password input screen is executed; And
(2) a step of recognizing information input through the password input screen as the password using the operation state of the sound transmitting and receiving means by a user as a proposition;
Password input method comprising a. The method of claim 1,
The step (1)
Output a certain pattern of sound through the speaker, and check the volume of the sound through the microphone,
The step (2)
Classifying the operation state of the sound transmitting and receiving means by using the volume of the sound identified through the microphone
Password input method characterized in that. The method of claim 1,
The step (2)
The user recognizes the information input through the password input screen as a true value in either the state where the user does not block the speaker or the microphone by hand, or the state in which the speaker or the microphone is blocked, and the password input screen in the other state. Recognizing information entered via a false value
Password input method characterized in that. Claims [1] A method for inputting a password in a terminal having sound transmitting and receiving means,
(1) activating the sound transmitting and receiving means when a password input is required; And
(2) recognizing, by the password, an operation pattern of the sound transmitting and receiving means by a user
Password input method comprising a. 5. The method of claim 4,
The step (1)
Output a certain pattern of sound through the speaker, and check the volume of the sound through the microphone,
The step (2)
Recognizing the operation pattern of the sound transmitting and receiving means using the volume of the sound confirmed through the microphone
Password input method characterized in that. 5. The method of claim 4,
The step (2)
Recognizing, by the password, an operation pattern consisting of at least one element of a state in which the user does not block the speaker or the microphone by hand, a state of blocking the speaker or the microphone, and a holding time of each state.
Password input method characterized in that.

Images