KR101392692B1 - User authentication device using virtual account and one time password and method for controlling thereof - Google Patents

Abstract

A method for controlling a host electronic device which performs authentication to a first account is disclosed. A control method according to an embodiment of the present invention comprises the steps of: loading at least one secret key for each of at least one virtual account which is used through a shared first account to create a hash map; creating virtual account information and a one-time password which correspond to each of the at least one secret key included in the hash map, at the time of a request for login to the first account or periodically; checking a second one-time password mapped to a first one-time password received from a user among the created one-time passwords; and identifying a virtual account corresponding to the second one-time password to permit the login.

Description

USER AUTHENTICATION DEVICE USING VIRTUAL ACCOUNT AND ONE TIME PASSWORD AND METHOD FOR CONTROLLING THEREOF

The present invention relates to an electronic apparatus for performing authentication for a virtual account and a control method thereof.

Most of the IT-related systems, including the computer login process, use a variety of user authentication for system use. In particular, identification and encryption are basic information for user authentication.

However, in recent years, various hacking technologies such as dictionary attack and brute force attack have been developed, and it has been pointed out that a fixed password is vulnerable to security. To overcome this problem, it has been suggested that the user should periodically change the password and set a more complex password.

In order to solve the above-mentioned problem, a disposable password method is actively used in recent years. A one-time password is a non-reusable one-time password.

However, a single user or a plurality of users may share the computer for convenience of use and convenience of work. In this case, it is common that the user identifier and the password are easily accessed by the shared users even when the password is set to an easy password that can be stored by a plurality of users or a complex password is set.

In the situation described above, a plurality of users can log in and use the computer in a single account, but in such a case, a security problem can occur that can not confirm who is an actual user. Accordingly, it is required to develop a method for identifying an actual user when there are a plurality of users sharing a single account. In particular, it is required to develop a method for real user identification in association with an existing one-time password.

The following description provides a host electronic device and its control method for responding to the above-described technology development request, which identifies an actual user among a plurality of users sharing an actual account based on a one-time password.

In order to accomplish the foregoing, a control method of a host electronic device for performing authentication with a first account comprises loading at least one secret key for each of at least one virtual account sharing and utilizing the first account, ; Generating a virtual account information and a one-time password corresponding to each of the at least one secret key included in the hash map at the time of requesting login to the first account or periodically; Checking a second one-time password mapped with a first one-time password received from a user among the generated one-time passwords; And allowing the login by identifying a virtual account corresponding to the second one-time password.

Each of the at least one secret key according to another embodiment may be generated by encrypting and encoding at least one of a user name, an email address, and user related information.

The control method according to yet another embodiment may further comprise sharing each of the at least one secret key with a client electronic device corresponding to each of the at least one secret key.

In the control method according to another embodiment, the step of sharing the secret key may include: generating a relatively long first secret key; Generating an HMAC-based one-time password (H-OTP) using the generated first secret key; And setting and sharing the generated n-th H-OTP to a relatively short second secret key.

In the control method according to another embodiment, the step of sharing the secret key may include: generating at least one of the virtual account correspondence text secret key and the virtual account correspondence QR code; And displaying at least one of the virtual account corresponding secret key and the most account corresponding QR code.

The step of sharing the secret key of the control method according to yet another embodiment may encrypt and display the virtual account correspondence text secret key.

The step of generating the hash map of the control method according to yet another embodiment may generate a hash map for the one-time password, secret key and virtual account information for each virtual account.

The step of allowing the login of the control method according to yet another embodiment includes: comparing the first one-time password and the hash map; And determining the login availability according to the comparison result.

According to another embodiment of the present invention, the control method may further include a step of authenticating the first account if the first one-time password exists in the hash map.

The control method according to another embodiment may further include storing log information of a corresponding virtual account related to authentication success or failure of the first account.

The control method according to yet another embodiment may further include a step of creating the virtual account.

The control method according to yet another embodiment may further include storing a relationship between the at least one virtual account and a secret key corresponding to each of the at least one virtual account.

The control method according to another embodiment may further include setting rights for each of the virtual accounts.

In a control method according to another embodiment, the first one-time password is an input via a user interface, and the user interface further comprises, together with the first one-time password, a first one-time password corresponding to the first account and the first account And a password can be input.

A host electronic device for performing authentication with a first account by another aspect comprises: a storage for storing at least one secret key for each of at least one virtual account sharing and utilizing the first account; A virtual account manager for loading the at least one secret key to generate a hash map; A user authentication processing unit for generating virtual account information and a one-time password corresponding to each of the at least one secret key included in the hash map at the time of requesting the login to the first account or periodically; And an input unit for receiving a first one-time use password from a user, wherein the user authentication processing unit identifies a second one-time use password mapped to the first one-time use password received from the user among the generated one- And may allow the login by identifying a virtual account corresponding to the second one-time password.

In a host electronic device according to another embodiment, each of the at least one secret key may be generated by encrypting and encoding at least one of a user name, an email address, and user related information.

The host electronic device according to another embodiment may further include a display unit that shares each of the at least one secret key.

The user authentication processing unit of the host electronic device according to another embodiment generates a relatively long first secret key, generates an HMAC based one time password using the generated first secret key , Sets the generated n-th H-OTP to a relatively short second secret key, and the display unit can share the second secret key.

In the host electronic device according to another embodiment, the display unit may display at least one of the virtual account correspondence text secret key and the most account correspondence QR code.

The display unit of the host electronic device according to another embodiment may encrypt and display the virtual account-correspondence text secret key.

In the host electronic device according to another embodiment, the virtual account management unit may generate a hash map of a one-time password, a secret key and virtual account information for each virtual account.

The user authentication processing unit of the host electronic device according to another embodiment may compare the first one-time password and the hash map, and determine the login availability according to the comparison result.

The user authentication processing unit of the host electronic device according to another embodiment may perform the authentication for the first account when the first one-time password exists in the hash map.

In the host electronic device according to another embodiment, the storage unit may include a log storage unit for storing log information of a corresponding virtual account related to authentication success or failure of the first account.

In the host electronic device according to another embodiment, the virtual account management unit may create the virtual account.

The storage of the host electronic device according to yet another embodiment may include a secret key store for storing the relationship between the at least one virtual account and the secret key corresponding to each of the at least one virtual account.

In the host electronic device according to another embodiment, the virtual account management unit may set rights for each of the virtual accounts.

In a host electronic device according to yet another embodiment, the first one-time password is an input via a user interface, and the user interface further comprises a first one-time password corresponding to the first account and the first account The password can be inputted to at least one of the passwords.

1 illustrates a log-in system including a host electronic device and a client electronic device according to one embodiment.
2 is a flowchart illustrating a method of controlling a host electronic device according to an embodiment.
3 is a flowchart illustrating a method of controlling a host electronic device according to an embodiment.
4 is a flowchart illustrating a method of sharing a secret key between a host electronic device and a guest electronic device according to an embodiment.
5A and 5B are conceptual diagrams of a host electronic device and a guest electronic device according to various embodiments.
6 is a flowchart for explaining a secret key sharing method between a host electronic device and a guest electronic device according to another embodiment.
7A and 7B are conceptual diagrams of a host electronic device and a guest electronic device according to various embodiments.
8 is a flow diagram illustrating a method for handling virtual account authentication of a host electronic device and a guest electronic device according to one embodiment.
9 is a conceptual diagram of a client electronic device according to one embodiment.
10A to 10D are conceptual diagrams of a user interface capable of inputting authentication information according to various embodiments.
11 is a flowchart illustrating an authentication procedure according to an embodiment.
12 is a flowchart for explaining the operation of the host electronic device according to another embodiment.
13A illustrates a secret key record structure according to an embodiment.
13B shows a sample of a secret key record according to an embodiment.
14 is a conceptual diagram of log information according to an embodiment.
15A to 15C are conceptual diagrams of a hash map according to various embodiments.
16 is a block diagram of a host electronic device according to one embodiment.

1 illustrates a log-in system including a host electronic device and a client electronic device according to one embodiment.

As shown in FIG. 1, a first account 10 and a second account 20 may be registered in the host electronic device 1. Here, the host electronic device 1 may be an electronic device or a software system capable of performing authentication for at least one account, for example a computer. The host electronic device 1 can register at least one account. Although FIG. 1 shows that two accounts of the first account 10 and the second account 20 are registered, this is merely an example, and the number of registered accounts is not limited. I can understand it. For example, the first account 10 may be an administrator account and the second account 20 may be a first user account.

The host electronic device 1 may store an algorithm, program or application that performs authentication for each of the at least one registered. The host electronic device 1 may, for example, provide a user interface for inputting account identifications. Alternatively, the host electronic device 1 may provide a user interface for entering an account identifier and a password corresponding to the account identifier. Meanwhile, as will be described in more detail below, the host electronic device 1 may provide a user interface for inputting a one time password (OTP).

The host electronic device 1 can perform authentication based on the authentication information input to the user interface. For example, the host electronic device 1 can perform authentication for the account corresponding to the entered account identifier. The host electronic device 1 can compare the password corresponding to the input account identifier with the predetermined password. The host electronic device 1 can permit login to the account if the password entered is the same as the preset password.

The host electronic device 1 can perform different authentication procedures for each registered account. For example, different passwords may be set for the first account 10 and the second account 20, respectively. The first account 10 may be assigned a first password and the second account 20 may be assigned a second password and the host electronic device 1 may assign a second secret If the number is entered, the login may be disallowed. The host electronic device 1 further receives the one-time password for further authentication, which will be described later in more detail.

On the other hand, the host electronic device 1 may provide different privileges or screens depending on the account being logged in. For example, if the first account is an administrator account and the login is proceeded to the first account, the host electronic device 1 can grant the administrator authority to the user. In addition, the host electronic device 1 may display a screen corresponding to the first account. On the other hand, when login is performed for the first user, which is the second account, the host electronic device 1 can grant the authority of the first user to the user. The authority of the first user may be more restrictive than that of the administrator. In addition, the host electronic device 1 may display a screen corresponding to the second account, and the screen stored corresponding to the first account and the screen stored corresponding to the second account may be different.

As described above, the host electronic device 1 can operate as if it were another electronic device for another account.

Meanwhile, a plurality of users can share and use one account. In FIG. 1, a first user 101, a second user 102, and a third user 103 share and use the first account 10. The fourth user 104 and the fifth user 105 share and use the second account 2. The first user 101 to the third user 103 can recognize the account identifier and the password of the first account 10. The fourth user 104 and the fifth user 105 may be aware of the account identifier and the password of the second account 20.

According to the above description, the first user 101 to the third user 103 can use the host electronic device 1 by logging into the first account. In addition, the fourth user 104 and the fifth user 105 can log in to the second account and use the host electronic device 1.

On the other hand, each of the first to fifth users 101 to 105 may have a first client electronic device 111 to a fifth client electronic device 115. The first client electronic device 111 to the fifth client electronic device 115 may be implemented in a mobile terminal such as, for example, a smart phone, a tablet PC, a PDA, or the like, but may generate the one- There is no restriction as long as the device can display the generated password.

Each of the first client electronic device 111 to the fifth client electronic device 115 can share a secret key with the host electronic device 1. Here, the secret key may be generated based on user information, such as, for example, a user name, a user e-mail address, and may be set differently for each client electronic device 111 to 115. [ The host electronic device 1 can generate and display a different secret key for each of the client electronic devices 111 to 115. [ The user can confirm the displayed secret key and input it to the client electronic device having it, so that the secret key can be shared. The host electronic device 1 can display the secret key in various ways such as a character or a QR code, which will be described later in more detail.

The first client electronic device 111 to the fifth client electronic device 115 may generate a one-time password based on the shared secret key. The one-time password generated at the first client electronic device 111 to the fifth client electronic device 115 may be different. The one-time password generated in the first client electronic device 111 to the fifth client electronic device 115 is generated based on a different secret key, so that it can be set differently. The first client electronic device 111 to the fifth client electronic device 115 can display the generated one-time password.

The users 101 to 105 can confirm the disposable password displayed on the client electronic devices 111 to 115 held. The users 101 to 105 can input the identified disposable password into the host electronic device 1. [ The host electronic device 1 can judge which user has logged in based on the entered one-time password.

For example, it is assumed that the second user 102 logs in the first account 10. The host electronic device 1 can not determine which real user of the first user 101 to the third user 103 logs in with the login process for the first account 10. [

The host electronic device 1 generates a secret key for each of the first user 101 to the third user 103 and transmits the secret key to the first client electronic device 111 to the third client electronic device 113, ≪ / RTI > The second client electronic device 112 may generate and display a one-time password based on the shared secret key. The second user 102 may enter the disposable password into the host electronic device 1. The host electronic device 1 can determine that the actual user who logs in to the first account is the second user 102 based on the entered one-time password.

The host electronic device 1 may store log information indicating that the second user 102 has logged in.

2 is a flowchart illustrating a method of controlling a host electronic device according to an embodiment.

In step 210, the host electronic device may create at least one virtual account using the first account. Here, the virtual account may mean at least one account sharing the first account. For example, the host electronic device according to the embodiment of FIG. 1 may be configured to have a first virtual account corresponding to a first user 101 for a first account 10, a second virtual account corresponding to a second user 102 Account and a third virtual account corresponding to the third user 103. [

A virtual account may refer to an account for distinguishing an actual user based on user information, rather than an actual account managed by the system. For example, a virtual account can be managed separately from an actual account registered in the OS, and a plurality of virtual accounts can be mapped to one real account. In particular, the virtual account can be managed only on the host electronic device without having to remember the user. The user only inputs the one-time password, there is no need to input the virtual account, and the convenience of the user can be increased. More specifically, the user can log in by inputting only a one-time password. In such a case, the actual account identifier and the actual account correspondence password need not be stored, which may further enhance user convenience.

The virtual account may include at least one of a user name, a user email address, and user related information. The virtual account may be implemented in the form of a user name, a user email address, and a sequence of user related information, e.g., user name + user email address + user related information.

In step 220, the host electronic device may store a virtual account and a one-time password relationship. In one embodiment, the host electronic device may store a virtual account and a private key relationship. The host electronic device may, for example, store a secret key relationship corresponding to the second virtual account and the second virtual account.

In step 230, the host electronic device may receive authentication information including a one-time password. The authentication information includes a one-time password, and may further include at least one of an actual account identifier and a corresponding password. The host electronic device may display a user interface for inputting authentication information. The user may enter authentication information including a one time password in the user interface.

At step 240, the host electronic device may process the virtual account authentication based on the stored one-time password and the stored virtual account and one-time password relationship included in the authentication information. For example, the host electronic device may generate a one-time password based on the secret key corresponding to the second virtual account. The host electronic device can compare the one-time password included in the authentication information with the generated one-time password. The host electronic device may determine that the one-time password included in the authentication information matches the generated one-time password corresponding to the second virtual account. Accordingly, the host electronic device can determine that the logged-in real user is the second user.

Although the conventional one-time password is used only for security authentication, the one-time password according to the embodiment can be used for actual user classification and authentication. That is, the disposable password according to the embodiment may operate as a user authentication code.

3 is a flowchart illustrating a method of controlling a host electronic device according to an embodiment.

In step 310, the host electronic device may create a virtual account using the first account. At least one user using the first account, i.e., the actual account, may pre-register the virtual account. For example, users may pre-register a user name, a user email address, user related information, and user possession client electronic device identification information.

In step 320, the host electronic device can identify the client electronic device corresponding to each virtual account using the first account. The host electronic device may send a one-time password generation algorithm, program or application to the client electronic device.

In step 330, the host electronic device may share a secret key with the client electronic device. The host electronic device can generate and display the secret key. The client electronic device can display a user interface capable of entering a secret key, and the user can confirm and input the secret key displayed on the host electronic device to the client electronic device.

In step 340, the host electronic device may store the relationship between the virtual account and the secret key.

4 is a flowchart illustrating a method of sharing a secret key between a host electronic device and a guest electronic device according to an embodiment. The secret key sharing method of FIG. 4 will be described in more detail with reference to FIGS. 5A and 5B, and FIGS. 5A and 5B are conceptual diagrams of a host electronic device and a guest electronic device according to various embodiments.

At step 401, the guest electronic device 450 may request a virtual account registration. For example, the guest electronic device 450 may authenticate that the owner of the guest electronic device 450 is registered as a user of the host electronic device 400 and then send a program or application capable of generating a one- Can be downloaded.

In step 402, the host electronic device 400 may create and manage virtual accounts. In addition, at step 403, the host electronic device 400 may generate a virtual account-aware private key. Here, the secret key may be generated by encrypting and encoding at least one of a user name, a user email address, and user related information.

In step 404, the host electronic device 400 may display the generated secret key. The host electronic device 400 may display the generated secret key, for example, as shown in FIG. 5A. On the other hand, the host electronic device can re-encrypt and encode the generated secret key to reproduce and display the secret key having a relatively short length as compared with the secret key shown in FIG. 5A.

At step 405, the guest electronic device 450 may receive the secret key. For example, the user can confirm the secret key displayed on the host electronic device 400 in an offline state. The guest electronic device 450 may provide a user interface for entering a secret key. For example, as shown in FIG. 5B, the guest electronic device 450 may display a user interface including a secret key input window 460 and a keyboard 461. The user can input the secret key displayed on the host electronic device 400 by designating the alphabet key displayed on the keyboard 461. [ The guest electronic device 450 may display the secret key entered by the user on the secret key input window 460 so that the guest electronic device 450 can recognize whether the user has correctly input the secret key.

In step 406, the host electronic device 400 and the guest electronic device 450 may share a secret key.

6 is a flowchart for explaining a secret key sharing method between a host electronic device and a guest electronic device according to another embodiment. The secret key sharing method of FIG. 6 will be described in more detail with reference to FIGS. 7A and 7B, and FIGS. 7A and 7B are conceptual diagrams of a host electronic device and a guest electronic device according to various embodiments.

At step 601, the guest electronic device 450 may request a virtual account registration. For example, the guest electronic device 450 may authenticate that the owner of the guest electronic device 450 is registered as a user of the host electronic device 400 and then send a program or application capable of generating a one- Can be downloaded.

In step 602, the host electronic device 400 can create and manage virtual accounts. In addition, at step 603, the host electronic device 400 may generate a virtual account-aware secret key. Here, the secret key may be generated by encrypting and encoding at least one of a user name, a user email address, and user related information. In addition, the host electronic device 400 may generate a quick response (QR) code corresponding to the generated secret key.

In step 604, the host electronic device 400 may display at least one of the generated secret key and the QR code. The host electronic device 400 may, for example, display the generated QR code 701 as in FIG. 7A.

At step 605, the guest electronic device 450 may receive the secret key. For example, the guest electronic device 450 can take a QR code displayed on the host electronic device 400 in the off-line. 7A, the guest electronic device 450 may include a camera module 470 that can collect foreground images. The user can photograph the QR code 701 using the camera module 470. [

In step 606, the host electronic device 400 and the guest electronic device 450 may share a secret key. 7B, the guest electronic device 450 may store the photographed QR code 702, such that each of the host electronic device 400 and the guest electronic device 450 may share the same secret key .

8 is a flow diagram illustrating a method for handling virtual account authentication of a host electronic device and a guest electronic device according to one embodiment.

At step 801, the guest electronic device 450 may generate a one-time password based on the stored secret key. The guest electronic device 450 may generate a one-time password using the same disposable password generation algorithm as the host electronic device 400. The guest electronic device 450 may generate a one-time password based on, for example, the HMAC-based one time password algorithm (RFC4226) or the time-based one time password algorithm (RFC6238).

Guest electronic device 450 may periodically generate six to ten digits as a one-time password based on a standard algorithm using, for example, a secret key.

At step 802, the host electronic device 400 may load a virtual account and a private key relationship. The host electronic device 400 may load only the secret key of each virtual account. In the foregoing description, since the secret key is generated based on the virtual account information, for example, the user name, the user email address, and the user-related information, the host electronic device 400 may load only the secret key and use it for authentication.

The owner of the guest electronic device 450 can generate and display the disposable password generated by the guest electronic device 450. [ The owner of the guest electronic device 450 may enter authentication information, including the identified disposable password, into the host electronic device (steps 803, 804).

In the short term 805, the host electronic device 400 may create a virtual account and a one-time password relationship. For example, the host electronic device 400 may generate a one-time password for each virtual account based on the secret key for each virtual account. The host electronic device 400 can generate the disposable password at the time when the authentication information is input. The host electronic device 400 can dynamically generate a one-time password. For example, the host electronic device 400 may regenerate the one-time password periodically or non-periodically and may renew the regenerated one-time password.

In step 806, the host electronic device 400 may process the virtual account authentication by comparing the one-time password generated for each virtual account with the password included in the authentication information.

For example, the host electronic device 400 may create and manage a first virtual account and a second virtual account. In addition, the host electronic device 400 may store a first secret key corresponding to the first virtual account and a second secret key corresponding to the second virtual account. Meanwhile, the second user may share the second secret key, and may input the authentication information including the second one-time password generated corresponding to the second secret key into the host electronic device 400. [

The host electronic device 400 may provide a user interface for inputting authentication information, which will be described in more detail with reference to FIGS. 10A to 10C.

The host electronic device 400 may load the first secret key and the second secret key. On the other hand, when the authentication information is input, the host electronic device 400 can generate the first one-time password based on the first secret key, and generate the second one-time password based on the second secret key. The host electronic device 400 can compare the one-time password included in the authentication information with the generated one-time password. For example, the host electronic device 400 can confirm that the second one-time password included in the authentication information is the same as the second one-time password generated corresponding to the second private key. Accordingly, the host electronic device 400 can process the authentication for the second virtual account corresponding to the second user.

9 is a conceptual diagram of a client electronic device according to one embodiment.

The client electronic device 450 may generate and display a one-time password based on the shared secret key, as described above. As in FIG. 9, client electronics 450 may generate and display at least one disposable password information 901,902. In the embodiment of FIG. 9, the client electronic device 450 may display one-time password information 901 that it has generated a one time password "873415" for the real account "Hong Kil Dong's personal computer". In addition, the client electronic device 450 may display the one-time password information 902 that it has generated a one-time password "341289" for the actual account "7th floor nursing fact". As in FIG. 9, the client electronic device 450 can be registered for each of a plurality of actual accounts.

10A to 10C are conceptual diagrams of a user interface capable of inputting authentication information according to various embodiments.

The user interface according to the embodiment of FIG. 10A may include a window for inputting an identifier for an actual account, a password for an actual account, and a one-time password. The user interface according to the embodiment of FIG. 10B may include a window for inputting an identifier for an actual account and a disposable password. The user interface according to the embodiment of FIG. 10C may include a window for inputting a disposable password. The user can input information required in various user interfaces as shown in FIGS. 10A to 10C, and the host electronic device 400 can process authentication for the actual account and the virtual account based on the input authentication information.

The various user interfaces as shown in FIGS. 10A to 10C can be configured as a text based interface, such as a graphical user interface, a console of Linux or Unix. In addition, as shown in FIG. 10B, in the case of a user interface for inputting only an identifier for an actual account and a disposable password, the client electronic device 450 internally randomly generates a password for an actual account, have. Accordingly, the user can perform the authentication process by inputting only the identifier for the real account and the one-time password without inputting the password for the actual account.

10D is a conceptual diagram of a user interface according to another embodiment. As shown in FIG. 10D, the host electronic device 400 may provide a user interface including a window for inputting user information and a one-time password other than actual account information. As described above, the host electronic device 400 can determine the actual user based on the one-time password. As will be described in more detail below, the host electronic device 400 may proceed to authenticate the actual account based on the authorization information. For example, the host electronic device 400 can manage which specific user information is mapped to which real account. Accordingly, the host electronic device 400 can use the user information and the disposable password as the authentication information. The user can utilize the user information, which the user is familiar with, as the authentication information, so that user convenience may be further increased.

In Fig. 10D, it is shown that the user information is inputted with a user name such as "Kudolai ", but this is an illustrative example, and a user e-mail address or user related information may also be used as authentication information.

11 is a flowchart illustrating an authentication procedure according to an embodiment.

In step 1110, the host electronic device 400 may load the virtual account and private key relationship.

In step 1120, the host electronic device 400 may load the secret key for each virtual account, and may extract the virtual account information and load it into the memory in the form of a hash map.

In step 1130, a user corresponding to one of the virtual accounts may enter authentication information including a one-time password.

At step 1140, at the time the user enters authentication information, the host electronic device 400 may generate a one-time password based on all secret keys loaded into memory.

At step 1150, the host electronic device 400 may dynamically generate a hash map of the form of a one-time password-secret-key-virtual account information.

In step 1160, the host electronic device 400 may compare whether the one-time password entered in the authentication information exists in the hash map.

In step 1170, the host electronic device 400 may perform authentication processing based on the comparison result. Based on the comparison result, the host electronic device 400 can identify who is the actual user who requested the log-in, and can perform log-in based on the identifier and the password for the inputted real account.

12 is a flowchart for explaining the operation of the host electronic device according to another embodiment.

In step 1210, the host electronic device 400 may receive a one-time password.

In step 1220, the host electronic device 400 may generate a one-time password based on the virtual account secret key.

In step 1230, the host electronic device 400 may generate a hash map containing the generated one-time password.

In step 1240, the host electronic device 400 may determine whether the received one-time password is present in the hash map.

If the received one-time password is not present in the hash map (1240-N), the host electronic device 400 may output an authentication failure message in step 1250. [

If the received one-time password exists in the hash map (1240-Y), the host electronic device 400 can proceed to authenticate the actual account in step 1260. [ The host electronic device 400 can authenticate the actual account based on at least one of the identifier of the actual account among the inputted authentication information and the password corresponding to the actual account. On the other hand, when the authentication information does not include the password corresponding to the actual account, the host electronic device 400 may authenticate the actual account based on the right information assigned to the virtual account. For example, it is assumed that the registered virtual accounts for the first real account are the first virtual account and the second virtual account. In this case, if the user corresponding to the third virtual account enters the first physical account and the one-time password and attempts to log in, the host electronic device 400 is not authorized to the first virtual account in the third virtual account . The host electronic device 400 may not allow logins for that virtual account.

If the actual account authentication fails (1270-N), the host electronic device may output an authentication failure message in step 1250. In step 1280, if the authentication is successful, the host electronic device 400 can provide the pre-stored screen.

13A illustrates a secret key record structure according to an embodiment.

As shown in FIG. 13A, the host electronic device 400 can store the correspondence between the private key 1301 and the real account 1302, and can be stored, for example, in a secret key store. In particular, the secret key 1301 may be stored in one field by encrypting and encoding the user name 1303, the user email address 1304, and other information 1305. Here, the other information 1305 may be additional user related information.

13B shows a sample of a secret key record according to an embodiment. The secret key record samples may include secret keys 1311, 1313, 1315, 1317, 1319, 1321 and actual accounts 1312, 1314, 1316, 1318, 1320, Meanwhile, as described above, the host electronic device 400 may encrypt and encode a relatively long secret key to generate a relatively short secret key, and may share and store the generated relatively short secret key with the client electronic device It is possible.

For example, the host electronic device 400 may generate a relatively long secret key and generate an HMAC based one time password using the generated secret key. The host electronic device 400 can set the generated n-th H-OTP to a relatively short secret key and share it with the guest electronic device 400.

14 is a conceptual diagram of log information according to an embodiment.

As shown in FIG. 14, the log information may include date information, actual account information, virtual account information, and login success / failure.

15A to 15C are conceptual diagrams of a hash map according to various embodiments.

FIG. 15A is a conceptual diagram of a hash map for a secret key and an actual account, and FIG. 15B is a conceptual diagram of a hash map including a secret key, actual account information, and virtual account information after extracting information of a virtual account from the secret key. 15C is a conceptual diagram of a hash map for a one-time password and a secret key generated when a user inputs authentication information. The host electronic device 400 can determine whether or not the login is proceeded by judging whether the one-time password included in the authentication information exists in the hash map of Fig. 15C.

16 is a block diagram of a host electronic device according to one embodiment.

The host electronic device 1600 may include a virtual account management unit 1610, an input unit 1620, a storage unit 1630, a user authentication processing unit 1640, a display unit 1660, and a communication unit 1670.

The virtual account management unit 1610 can register, delete, and modify at least one virtual account sharing an actual account. Or the virtual account management unit 1610 may regenerate the secret key for the previously registered virtual account.

The virtual account management unit 1610 may control the display unit 1660 to display the secret key based on the QR code or text. Here, the secret key may include a user name, a user email address, and user related information.

The input unit 1620 may input authentication information including a disposable password. The user can confirm the disposable password displayed on the client electronic device possessed and can input the authentication information including the confirmed disposable password. On the other hand, the authentication information may further include at least one of an actual account identifier and a password for an actual account in addition to the one-time password.

The display unit 1660 may provide a user interface for receiving authentication information. The user interface may be configured to receive a one-time password, or may be configured to receive at least one of an actual account identifier and a password for the actual account in addition to the one-time password.

The storage unit 1630 may include a secret key storage unit 1631 and a log storage unit 1632. The secret key storage unit 1631 may store a secret key corresponding to each of the virtual accounts. The log storage unit 1632 may store log information, for example, as shown in FIG.

The user authentication processing unit 1640 may process the one-time password verification process based on the identifier of the actual account included in the authentication information, the password for the actual account, and the one-time password. The user authentication processing unit 1640 can read the secret key of the virtual account stored in the secret key storage 1631. [ The user authentication processing unit 1640 extracts the virtual account information stored in each secret key to generate a hash map. The user authentication processing unit 1640 may generate a one-time password using the secret key at the time when the authentication information is input or periodically generate the one-time password-secret key-virtual account information type hash map. The user authentication processing unit 1640 can determine whether the one-time password included in the authentication information exists in the hash map, and can confirm whether the actual user is the user based on the presence or absence. When an actual user is identified, the user authentication processing unit 1640 may perform login based on at least one of an identifier for the actual account included in the authentication information and a password for the actual account. On the other hand, the various embodiments do not include all of the above-described components, and may include only a part.

The communication unit 1670 can communicate with the client electronic device and can transmit, for example, a one-time password generating program or application. Or the communication unit 1670 may receive a virtual account registration request from the client electronic device.

The method according to an embodiment of the present invention can be implemented in the form of a program command which can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

While the invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. This is possible.

Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined by the equivalents of the claims, as well as the claims.

Claims (28)

A control method of a host electronic device for performing authentication with a first account,
Loading at least one secret key for each of at least one virtual account sharing and utilizing the first account to generate a hash map;
Generating a virtual account information and a one-time password corresponding to each of the at least one secret key included in the hash map at the time of requesting login to the first account or periodically;
Checking a second one-time password mapped with a first one-time password received from a user among the generated one-time passwords; And
And identifying the virtual account corresponding to the second one-time password to allow the login. The method according to claim 1,
Wherein each of the at least one secret key is generated by encrypting and encoding at least one of a user name, an email address, and user related information. The method according to claim 1,
Further comprising sharing each of the at least one secret key with a client electronic device corresponding to each of the at least one secret key. The method of claim 3,
Wherein the sharing of the secret key comprises:
Generating at least one of the virtual account correspondence text private key and the virtual account correspondence QR code; And
And displaying at least one of the virtual account correspondence secret key and the virtual account correspondence QR code. 5. The method of claim 4,
Wherein the step of sharing the secret key encrypts and displays the virtual account correspondence text secret key. The method according to claim 1,
Wherein the step of generating the hash map is to generate a hash map of a one-time password, a secret key, and virtual account information for each virtual account. The method according to claim 1,
The step of allowing the login further comprises:
Comparing the first one-time password and the hash map; And
And determining the login availability according to a result of the comparison. 8. The method of claim 7,
And if the first one-time password exists in the hash map, proceeding to authentication for the first account. 9. The method of claim 8,
Storing log information of a corresponding virtual account related to authentication success or failure of the first account. The method according to claim 1,
Further comprising the step of creating the virtual account. 11. The method of claim 10,
Further comprising storing a relationship between the at least one virtual account and a secret key corresponding to each of the at least one virtual account. The method according to claim 1,
And setting an authority for each of the virtual accounts. The method according to claim 1,
The first one-time password is an input via a user interface,
Wherein the user interface is configured to input at least one of the first account, the password corresponding to the first account and the user information together with the first one-time password. A host electronic device for performing authentication to a first account,
A storage unit for storing at least one secret key for each of at least one virtual account sharing and utilizing the first account;
A virtual account manager for loading the at least one secret key to generate a hash map;
A user authentication processing unit for generating virtual account information and a one-time password corresponding to each of the at least one secret key included in the hash map at the time of requesting the login to the first account or periodically; And
An input for receiving a first one-time password from a user,
The user authentication processing unit identifies a second one-time password mapped to the first one-time password received from the user among the generated one-time passwords, identifies a virtual account corresponding to the second one-time password, Lt; / RTI > 15. The method of claim 14,
Wherein each of the at least one secret key is generated by encrypting and encoding at least one of a user name, an email address, and user related information. 15. The method of claim 14,
Further comprising a display unit that shares each of the at least one secret key. 17. The method of claim 16,
Wherein the display unit displays at least one of the virtual account correspondence text secret key and the virtual account correspondence QR code. 18. The method of claim 17,
And the display unit encrypts and displays the virtual account correspondence text secret key. 15. The method of claim 14,
Wherein the virtual account management unit generates a hash map of a one-time password, a secret key, and virtual account information for each of the virtual accounts. 15. The method of claim 14,
Wherein the user authentication processing unit compares the first one-time password and the hash map, and determines the login availability according to the comparison result. 21. The method of claim 20,
Wherein the user authentication processing unit performs authentication for the first account when the first one-time password exists in the hash map. 22. The method of claim 21,
Wherein the storage unit comprises a log storage unit for storing log information of a corresponding virtual account related to authentication success or failure of the first account. 15. The method of claim 14,
And the virtual account management unit creates the virtual account. 24. The method of claim 23,
Wherein the storage comprises a secret key storage for storing a relationship between the at least one virtual account and a secret key corresponding to each of the at least one virtual account. 15. The method of claim 14,
Wherein the virtual account management unit sets an authority for each of the virtual accounts. 15. The method of claim 14,
The first one-time password is an input via a user interface,
Wherein the user interface is configured to input at least one of the first account, the password corresponding to the first account and the user information together with the first one-time password. The method of claim 3,
Wherein the sharing of the secret key comprises:
Generating a relatively long first secret key;
Generating an HMAC-based one-time password (H-OTP) using the generated first secret key; And
And setting and sharing the generated n-th H-OTP to a relatively short second secret key. 17. The method of claim 16,
The user authentication processing unit generates a relatively long first secret key, generates an HMAC based one time password using the generated first secret key, and stores the generated n-th H-OTP in a relative Is set to a short second secret key,
And the display unit shares the second secret key.

Images