KR101373745B1 - Method for Providing United Authentication Service in Network, and Authentication Server Used Therein - Google Patents

Abstract

A method for providing an integrated authentication service on a network and an authentication server used therein are disclosed. According to the present invention, an authentication server receives member information input by a user from a web server providing a service on a network to which the user intends to subscribe, and the authentication server receives device information of the mobile terminal from the mobile terminal possessed by the user. The mobile terminal may be configured to generate and store a unique key of the mobile terminal including device information of the mobile terminal, and transmit the unique key to the mobile terminal so that the mobile terminal can store the unique key. According to the present invention, it is possible to minimize the damage due to the leakage of member information by not only transmitting a password to the online service but also when the user subscribes to the online service and also does not transmit the password to an external server. You can do it.

Description

Method for Providing United Authentication Service in Network, and Authentication Server Used Therein}

The present invention relates to a method for providing an integrated authentication service on a network and an authentication server used therein, and more particularly, not only when a user subscribes to an online service, but also when a user accesses the service, a password is not transmitted to the outside. Integrated authentication service on the network that allows users not to transmit passwords to external servers, thereby minimizing the damage from leaking membership information, and allows users to combine passwords used by multiple online services into a single password. It relates to a providing method and an authentication server used therein.

Recently, the leakage of personal information of members from famous online portal sites has become a social problem.

In general, users who use the online service use the same ID and password as membership information of each site. Therefore, when the personal information of members is leaked through a specific online portal site, the acquirer of the leaked member information is leaked. By using the registered member ID and password, an attempt is made to illegally access various web services that the member is supposed to subscribe to.

This problem occurs because the online portal site stores and manages not only the ID of each member but also a password. Therefore, according to the conventional method of managing member information of the portal site, even if the hacking security of the portal site is increased, the personal information is kept. Serious problems as described above due to the outflow will remain inevitable.

In addition, Internet service providers are forcing users to determine passwords that conform to the format of passwords (eg, four or more characters, mixed English, mixed case) determined according to their internal security standards. .

As a result, users are forced to set and remember different passwords for each Internet site irrespective of their intention to use their own easy-to-remember passwords on all sites.

The setting of different passwords for each Internet site is a situation in which a user is required to individually remember a plurality of passwords or causes a lot of inconvenience by causing confusion of passwords.

Republic of Korea Patent Publication No. 10-2010-0020559 (published February 23, 2010)

Accordingly, an object of the present invention is not only when a user subscribes to an online service, but also when the user accesses the service, the user does not transmit the password to the outside or transmit the password to the external server. In addition to minimizing damage, the present invention provides a method for providing an integrated authentication service on a network that enables a user to use a single password by using a password for use in a plurality of online services, and an authentication server used therefor.

In accordance with an aspect of the present invention, there is provided a method for providing an integrated authentication service on a network, the method comprising: (a) receiving, by an authentication server, member information input by a user from a web server that provides a service on a network to which the user intends to subscribe; ; (b) receiving, by the authentication server, device information of the mobile terminal from the mobile terminal possessed by the user; (c) generating and storing, by the authentication server, a unique key of the mobile terminal including device information of the mobile terminal; And (d) the authentication server sending the unique key to the mobile terminal for storage by the mobile terminal.

Preferably, the mobile terminal is characterized in that for storing the unique key received from the authentication server and the password entered by the user.

In addition, after the step (d), (e) when the web server receives a login request from the user, the authentication server further comprises the step of receiving the user's ID from the web server.

In addition, after the step (e), (f) the authentication server further comprises the step of transmitting the unique key corresponding to the user's ID to the mobile terminal.

In the step (d), when the authentication server sends the unique key to the mobile terminal, the mobile terminal receives and installs an authentication program from the authentication server.

The mobile terminal may be configured to execute the authentication program when the unique key received in step (f) and the unique key received in step (d) match.

The mobile terminal may display a password input window to the user by executing the authentication program.

In addition, when the user inputs a password into the mobile terminal, the mobile terminal is configured to store the unique key previously stored in the mobile terminal when the input password matches a password previously stored in the mobile terminal. It is characterized by transmitting to.

In addition, when the authentication server receives the unique key from the mobile terminal, (g) whether the authentication server matches the received unique key and the unique key stored in the authentication server in step (c). The method may further include determining.

Further, after the step (g), (f) if the received unique key and the unique key stored in the authentication server match, the authentication server further sends a member authentication completion message to the web server Include.

Meanwhile, the authentication server according to the present invention receives member information input by a user from a web server providing a service on a network to which the user intends to subscribe, and receives device information of the mobile terminal from the mobile terminal possessed by the user. A receiving unit; A generation unit generating a unique key of the mobile terminal including device information of the mobile terminal received by the reception unit; A storage unit for storing a unique key generated by the generation unit; And a transmitter for transmitting the unique key to the mobile terminal so that the mobile terminal can store it.

Preferably, the mobile terminal is characterized in that for storing the unique key received from the authentication server and the password entered by the user.

In addition, when the web server receives a login request from the user, the receiving unit is characterized in that for receiving the ID of the user from the web server.

Further, when the transmitting unit transmits the unique key to the mobile terminal, the mobile terminal receives and installs an authentication program from the authentication server.

Also, when the reception unit receives the user's ID from the web server by receiving the login request from the user by the web server, the transmitting unit transmits the unique key corresponding to the user's ID to the mobile terminal. It is characterized by transmitting.

The mobile terminal may execute the authentication program when the unique key corresponding to the ID of the user received by the user's login request matches the unique key previously stored in the mobile terminal. .

The mobile terminal may display a password input window to the user by executing the authentication program.

In addition, when the user inputs a password into the mobile terminal, when the mobile terminal determines that the input password matches a password previously stored in the mobile terminal, the receiver is pre-stored in the mobile terminal. A unique key is received from the mobile terminal.

The receiver may further include a determiner configured to determine whether the received unique key matches the unique key stored in the storage unit when the unique key is received from the mobile terminal.

In addition, when the determination unit determines that the received unique key and the unique key stored in the authentication server is identical, the transmitter transmits the member authentication completion message to the web server.

According to the present invention, it is possible to minimize the damage due to the leakage of member information by not only transmitting a password to the online service but also when the user subscribes to the online service and also does not transmit the password to an external server. You can do it.

In addition, according to the present invention, it is possible for a user to integrate and use a password for use in a plurality of online services into a single password.

1 is a structural diagram of an integrated authentication service providing system on a network according to an embodiment of the present invention;
2 is a functional block diagram of an authentication server used in the integrated authentication service providing system on the network according to an embodiment of the present invention in FIG.
3 and 4 are signal flow diagrams illustrating an execution process of a method for providing an integrated authentication service on a network according to an embodiment of the present invention.

Hereinafter, the present invention will be described in detail with reference to the drawings. It is to be noted that the same elements among the drawings are denoted by the same reference numerals whenever possible. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail.

1 is a structural diagram of an integrated authentication service providing system on a network according to an embodiment of the present invention. Referring to FIG. 1, an integrated authentication service providing system on a network according to an embodiment of the present invention includes a user terminal 50, an authentication server 100, a web server 200, and a mobile terminal 250.

The user terminal 50 is a terminal used by a user to access a service on a network provided by the web server 200, and may be a personal PC of the user.

Meanwhile, the web server 200 is a server that provides various network services such as portal sites on the network, and may be a server of an operator who operates portal sites such as DAUM, NAVER, and NATE. .

The authentication server 100 authenticates the user's access authority to the web server 200 so that the user does not have to enter a password when the user attempts to access the web server 200 through the user terminal 50. It plays a role.

On the other hand, the mobile terminal 250 is a portable terminal possessed separately by the user, iPhone, Android phone, etc. may be a variety of mobile phones, including smart phones. The mobile terminal 250 stores a user's integrated password and transmits / receives data with the authentication server 100 so that the user can be authenticated for access to the web server 200 through the authentication server 100. To perform.

2 is a functional block diagram of the authentication server 100 used in the integrated authentication service providing system on the network according to an embodiment of the present invention in FIG. Referring to FIG. 2, the authentication server 100 according to an embodiment of the present invention includes a receiver 110, a generator 130, a storage 150, a transmitter 170, and a determiner 190. .

First, the receiving unit 110 of the authentication server 100 receives the member information input by the user from the web server 200 that provides a service on the network that the user wants to subscribe, and from the mobile terminal 250 possessed by the user Receives a request for transmission of device information and an application program of the mobile terminal 250.

In addition, the receiving unit 110 of the authentication server 100 receives the user's ID from the web server 200 when the web server 200 receives a login request from the user terminal 50 thereafter, the user is a mobile terminal When the password is input to the mobile terminal 250 and the mobile terminal 250 determines that the input password matches the previously stored password on the mobile terminal 250, the mobile terminal 250 stores the unique key previously stored in the mobile terminal 250. 250).

On the other hand, the generation unit 130 of the authentication server 100 generates a unique key of the mobile terminal 250 including the device information of the mobile terminal 250 received by the receiver 110, the storage unit 150 The unique key of the mobile terminal 250 generated by the generation unit 130 is stored.

When the receiver 110 receives the unique key from the mobile terminal 250, the determination unit 190 of the authentication server 100 determines whether the received unique key matches the unique key stored in the storage 150. It performs the function.

In addition, the transmitter 170 of the authentication server 100 transmits the unique key generated by the generator 130 to the mobile terminal 250 so that the mobile terminal 250 can store the web server 200. When the receiver 110 of the authentication server 100 receives the user's ID from the web server 200 by receiving a login request from the user, the transmitter 170 transmits the unique key corresponding to the user's ID to the mobile terminal 250. ) To perform the function.

In addition, when the determination unit 190 determines that the received unique key and the stored unique key stored in the storage unit 150 are identical to each other, the transmission unit 170 of the authentication server 100 completes member authentication to the web server 200. Send the message.

3 and 4 are signal flow diagrams illustrating an execution process of a method for providing an integrated authentication service on a network according to an embodiment of the present invention. First, referring to FIGS. 1 to 3, the authentication preparation process in the integrated authentication service providing method on a network according to an embodiment of the present invention will be described. In order to subscribe to a service provided on the network, the user terminal 50 transmits a member registration request message including member information to the web server 200 (S300).

In the practice of the present invention, it is preferable that the member information includes device information of the mobile terminal 250 such as a user ID (ID) and a telephone number of the mobile terminal 250 possessed by the user.

Meanwhile, when the web server 200 receives a membership request message from the user terminal 50, the web server 200 based on the device information of the mobile terminal 250 included therein, the authentication server 100 in the mobile terminal 250. URL (Uniform Resource Locator) information is transmitted (S305).

The URL information is used by the user to download the integrated authentication application provided by the authentication server 100 through the mobile terminal 250, in the practice of the present invention, the web server 200 is a mobile terminal 250 In the case of sending the URL information, it may be desirable to send a text message "Download the integrated authentication application" together.

Next, the web server 200 stores the user's member information (S310), and also transmits the stored member information to the authentication server 100 (S315). Meanwhile, the receiving unit 110 of the authentication server 100 receives member information including a user ID and device information of the mobile terminal 250 from the web server 200, which is stored in the authentication server 100. It is stored in the unit 150.

Meanwhile, a user who receives the URL of the authentication server 100 through the mobile terminal 250 accesses the authentication server 100 through the corresponding URL, thereby transmitting a request for transmission of the integrated authentication application program to the authentication server 100. It is made (S320). In this case, the receiver 110 of the authentication server 100 receives the device information of the mobile terminal 250 together with the application program transmission request message from the mobile terminal 250.

Meanwhile, the generation unit 130 of the authentication server 100 generates a unique key of the mobile terminal 250 based on the device information of the mobile terminal 250 and stores it in the storage unit 150 (S325).

In the practice of the present invention, the device information of the mobile terminal 250 used to generate a unique key may be an MPI value of the corresponding device and / or a phone number of the mobile terminal 250.

Meanwhile, the transmitting unit 170 of the authentication server 100 transmits the generated unique key to the mobile terminal 250 based on the device information of the mobile terminal 250. In this case, the integrated authentication application program is also transmitted. (S330).

Then, the authentication server 100 stores the unique key generated by the generation unit 130, the ID of the user corresponding to the corresponding unique key, and the device information of the mobile terminal 250 of the user in the storage unit 150 ( S335). On the other hand, the mobile terminal 250 installs an application program received from the authentication server 100, and stores the unique key received from the authentication server 100 in the internal memory (S340).

In the practice of the present invention, it is preferable that the application program installed in the mobile terminal 250 includes an encryption module which is used by the mobile terminal 250 to encrypt the unique key in the future. It is preferable that the corresponding decoding module is stored and installed in 150.

On the other hand, the user then executes the integrated authentication application program installed in the mobile terminal 250 possessed by the user. In this case, by executing the integrated authentication application program, the mobile terminal 250 displays a password input window to the user as shown in FIG.

In this case, the user determines a password to be used to authenticate the access right to the web server 200, inputs the determined password through the input unit of the mobile terminal 250, the input password is stored in the internal memory of the mobile terminal 250 It is stored (S345).

On the other hand, in the practice of the present invention, the application installed in the mobile terminal 250 transmits an authentication preparation completion message indicating that the authentication preparation is completed to the authentication server 100 when the password is stored in the internal memory, The authentication server 100 may store the authentication ready message received from the mobile terminal 250 in the storage unit 150, and then transmit the same to the web server 200.

In this case, the web server 200 receives a member authentication preparation message from the authentication server 100 and updates and stores member information of the corresponding user as a member registration procedure is completed.

Hereinafter, with reference to FIGS. 1, 2, and 4, the authentication process in the integrated authentication service providing method on the network according to an embodiment of the present invention will be described.

As shown in FIG. 3, after the member authentication preparation is completed, after the registration procedure for the service on the network provided by the user's web server 200 is completed, the user uses his or her own user terminal 50 to utilize the subscribed service. Attempts to access the web server 200 through.

In this case, the user terminal 50 transmits a login request message including a user ID to the web server 200 (S355). Accordingly, the web server 200 joins the user ID included in the login request message. Look up. When the member registration with the corresponding ID is confirmed, the web server 200 transmits the user ID included in the login request message to the authentication server 100 (S360).

The authentication server 100 receiving the user ID from the web server 200 is stored with the user ID in the mobile terminal 250 based on the device information of the mobile terminal 250 stored with the user ID. The unique key is transmitted (S365).

Meanwhile, the mobile terminal 250 receiving the unique key from the authentication server 100 checks whether the unique key stored in the internal memory matches the unique key received from the authentication server 100 (S370). In this case, the integrated authentication application is automatically executed (S375).

If the unique key stored in the internal memory of the mobile terminal 250 and the unique key received from the authentication server 100 do not match, the application program will not be executed, and thus the secret stored in the mobile terminal 250. It is possible to prevent the illegal holder of the mobile terminal 250 which does not know the number from stealing the right to access the web server 200 of a legitimate user.

By the automatic execution of the integrated authentication application program installed in the mobile terminal 250, the mobile terminal 250 displays a password input window to the user as shown in FIG.

In this case, the user inputs the password inputted by the user in step S345 through the input unit of the mobile terminal 250 (S380), and the mobile terminal 250 may include a password previously stored in the internal memory in step S345. In operation S385, it is determined whether or not the password matches the input password.

When the passwords match, the mobile terminal 250 encrypts a unique key previously stored in the internal memory through an application program and transmits the unique key to the authentication server 100 together with the device information (S390). ) Receives and stores the encrypted unique key and decrypts the corresponding unique key using the decryption module stored in the storage 150.

Thereafter, the determination unit 190 of the authentication server 100 checks whether the decrypted unique key and the unique key previously stored together with the corresponding device information in the storage unit 150 match (S395).

If the determination unit 190 of the authentication server 100 determines that the decrypted unique key and the unique key previously stored together with the corresponding device information in the storage unit 150 do not match, the generation unit of the authentication server 100 is generated. 130 generates a member authentication disable message, and the transmission unit 170 of the authentication server 100 transmits a member authentication disable message to the web server 200.

On the other hand, when the determination unit 190 of the authentication server 100 determines that the decrypted unique key and the unique key previously stored together with the corresponding device information in the storage unit 150 are generated, the authentication server 100 is generated. The unit 130 generates a member authentication completion message, and the transmission unit 170 of the authentication server 100 transmits a member authentication completion message to the web server 200 (S400).

Accordingly, the web server 200 checks the access authority of the user who requested the login, thereby allowing access to the web server 200 through the user terminal 50.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the present invention.

50: user terminal, 100: authentication server,
110: receiving unit, 130: generating unit,
150: storage unit, 170: transmitting unit,
190: judgment unit, 200: web server,
250: mobile terminal.

Claims (20)

delete delete delete (a) receiving, by the authentication server, the member information input by the user from a web server providing a service on a network to which the user intends to subscribe;
(b) receiving, by the authentication server, device information of the mobile terminal from the mobile terminal possessed by the user;
(c) generating and storing, by the authentication server, a unique key of the mobile terminal including device information of the mobile terminal; And
(d) the authentication server sending the unique key to the mobile terminal for storage by the mobile terminal;
Including;
The mobile terminal stores the unique key received from the authentication server and the password entered by the user,
After the step (d)
(e) when the web server receives a login request from the user, the authentication server receiving an ID of the user from the web server; And
and (f) transmitting, by the authentication server, the unique key corresponding to the user's ID to the mobile terminal.
5. The method of claim 4,
In the step (d)
And when the authentication server sends the unique key to the mobile terminal, the mobile terminal receives and installs a program for authentication from the authentication server.
6. The method of claim 5,
And if the unique key received in step (f) and the unique key received in step (d) coincide, executing the authentication program.
The method according to claim 6,
And the mobile terminal displays a password input window to the user by executing the authentication program.
8. The method of claim 7,
When the user inputs a password into the mobile terminal, the mobile terminal transmits a unique key previously stored in the mobile terminal to the authentication server when the input password matches a password previously stored in the mobile terminal. The integrated authentication service providing method on the network.
9. The method of claim 8,
When the authentication server receives the unique key from the mobile terminal,
and (g) determining, by the authentication server, whether the received unique key matches the unique key stored in the authentication server in step (c).
10. The method of claim 9,
After step (g),
and (f) when the received unique key and the unique key stored in the authentication server match, transmitting the member authentication completion message to the web server by the authentication server.
delete delete delete A receiving unit for receiving member information input by the user from a web server providing a service on a network to which the user intends to subscribe, and receiving device information of the mobile terminal from the mobile terminal possessed by the user;
A generation unit generating a unique key of the mobile terminal including device information of the mobile terminal received by the reception unit;
A storage unit for storing a unique key generated by the generation unit; And
A transmitter for transmitting the unique key to the mobile terminal for the mobile terminal to store
Including;
The mobile terminal stores the unique key received from the authentication server and the password entered by the user,
When the web server receives a login request from the user, the receiving unit receives the user's ID from the web server,
And when the transmitting unit transmits the unique key to the mobile terminal, the mobile terminal receives and installs an authentication program from the authentication server.
15. The method of claim 14,
When the reception unit receives the user's ID from the web server by the web server receiving a login request from the user, the transmitting unit transmits the unique key corresponding to the user's ID to the mobile terminal. Authentication server.
16. The method of claim 15,
And the mobile terminal executes the authentication program when the unique key corresponding to the user's ID received by the user's login request matches the unique key previously stored in the mobile terminal.
17. The method of claim 16,
And the mobile terminal displays a password input window to the user by executing the authentication program.
18. The method of claim 17,
When the user inputs a password to the mobile terminal, when the mobile terminal determines that the input password and the password previously stored in the mobile terminal,
And the receiving unit receives a unique key previously stored in the mobile terminal from the mobile terminal.
19. The method of claim 18,
When the receiver receives the unique key from the mobile terminal,
And a determination unit for determining whether the received unique key matches the unique key stored in the storage unit.
20. The method of claim 19,
And when the determining unit determines that the received unique key and the unique key stored in the authentication server match, the transmitting unit transmits a member authentication completion message to the web server.

Images