KR101480035B1 - Security apparatus for financial service - Google Patents

Abstract

The key lock apparatus includes a user terminal for mediating mutual authentication between the security server and the keylock apparatus in cooperation with a security server and a keylock apparatus, wherein the keylock apparatus generates a signature value, And the security server generates a signature value and verifies the signature value generated in the key lock apparatus.

Description

[0001] SECURITY APPARATUS FOR FINANCIAL SERVICE [0002]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an authentication apparatus for providing financial services, and more particularly, to an authentication apparatus for providing a financial service that improves security when a financial service is used through mutual authentication between a security server and a keylock apparatus.

As customers using financial services using Internet banking become popular, there is a need to provide financial services more safely and conveniently.

In order to use more secure financial services, users use financial service through internet banking at home, in company or public place by using portable disk with embedded certificate.

However, since the Internet is an open network environment, any information can be leaked without security features. Therefore, the most important thing in the Internet environment is security and privacy.

On the other hand, electronic financial transactions using the Internet employ user authentication based on a public certificate in all financial institutions and use encryption and digital signature between the server and the user computer in a public key manner. In this way, electronic finance or electronic commerce has secured some degree of safety and reliability. However, there is a problem that an authorized certificate is stored in a hard disk or an auxiliary memory device, thereby making it easy to electronically copy and deodorize.

In addition, the authorized certificate system should store and carry the official certificate of each financial institution and the file in which the security card number is inputted in a portable storage device such as a universal serial bus (USB) memory. However, this method has a problem of being lost, risk of being stolen or copied, and being vulnerable to security.

Background Art related to the present invention is a portable USB security device using an integrated control chip of Korean Utility Model Publication No. 20-2010-0004117 (Apr. 20, 2010).

It is an object of the present invention to provide an authentication device for providing a financial service that improves security when a financial service is used through mutual authentication between a security server and a keylock device.

It is another object of the present invention to reduce the damage caused by duplication or deception of an authorized certificate.

Another object of the present invention is to prevent illegal use of Internet banking by a third party even if an authorized certificate is duplicated or seized through the authentication process through a keylock device provided to a legitimate user.

A security device for a financial service according to an aspect of the present invention includes a user terminal for mediating authentication between the security server and the keylock device in cooperation with a security server and a keylock device, The security server verifies the signature value generated in the security server, and the security server generates a signature value and verifies the signature value generated in the keylock device.

In the present invention, the user terminal confirms whether the keylock device is connected, and outputs a message requesting to connect the keylock device if the keylock device is not connected.

In the present invention, the key lock device is mounted on a universal serial bus (USB) medium.

In the present invention, the keylock device may include an encryption / decryption unit for encrypting and decrypting unique information of the keylock device using an encryption key; A storage unit for storing an authentication key of the key lock apparatus; A communication unit for performing data communication with the user terminal; And generating a random value according to a request of the user terminal, transmitting the generated random value to the user terminal through the communication unit, transmitting the random value to the security server, and comparing the random value generated according to the request of the user terminal with the random value generated by the encryption decryption unit, The signature value received from the security server is verified by comparing the generated signature value with the signature value transmitted from the security server through the communication unit after generating the signature value using the authentication key stored in the storage unit, And an authenticating unit for authenticating the authenticated user.

In the present invention, the security server may include an encryption / decryption module for encrypting and decrypting unique information of the keylock device using a cryptographic key; A database module for storing an authentication key of the key lock device; A communication module for performing data communication with the user terminal; And generating a random value according to a request from the user terminal and transmitting the generated random value to the keylock device through the communication module and generating a random value generated according to a request of the user terminal and a combination data of the unique information encrypted in the encryption / decryption module An authentication module for generating a signature value using the authentication key stored in the database module and verifying a signature value received from the key lock device by comparing the generated signature value with a signature value transmitted from the key lock device through the communication module, .

In the present invention, the unique information of the key lock device is a serial number of the key lock device or personal information of the user.

In the present invention, the security server manages the media status of the key lock apparatus according to status information on the life cycle of the key lock apparatus received from the key lock apparatus.

The present invention improves security when using a financial service through mutual authentication between a security server and a keylock device.

In addition, since the present invention reduces the damage of the authorized certificate leakage by duplication or deception of the authorized certificate and passes the authentication process through the key lock device provided to the legitimate user, even if the authorized certificate is duplicated or seized, In advance.

1 is a block diagram of a security device for a financial service according to an embodiment of the present invention.
2 is a block diagram of the security server of FIG.
3 is a block diagram of the key lock apparatus of FIG.
4 is a flowchart illustrating a method of providing a financial service using an authentication apparatus for providing financial services according to an embodiment of the present invention.
5 is a flowchart illustrating an authentication method for providing financial services according to an embodiment of the present invention.
6 is a flowchart illustrating a method of generating an authentication key of an authentication device for providing financial services according to an embodiment of the present invention.

Hereinafter, an authentication apparatus for providing financial services according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings. In this process, the thicknesses of the lines and the sizes of the components shown in the drawings may be exaggerated for clarity and convenience of explanation. In addition, the terms described below are defined in consideration of the functions of the present invention, which may vary depending on the intention or custom of the user, the operator. Therefore, definitions of these terms should be made based on the contents throughout this specification.

1 is a block diagram of a security device for a financial service according to an embodiment of the present invention.

Referring to FIG. 1, a security device for a financial service according to an embodiment of the present invention includes a user terminal 10, a keylock device 20, and a security server 40.

The user terminal 10 includes a personal computer (PC), a notebook computer, a laptop computer, a smart phone, and the like as a user's personal terminal, and performs data communication with the key lock device 20. The user terminal 10 is connected to the security server 40 and the financial server 50 through a wired / wireless communication network. When the user terminal 10 is requested to use a financial service such as Internet banking, the user terminal 10 performs an authentication process using a public certificate in connection with the financial server 50.

The user terminal 10 transmits and receives data between the security server 40 and the keylock device 20 through a communication network using an API (Application Programming Interface) (not shown) And provides the financial service to the user in cooperation with the financial server 50 according to the mutual authentication result between the security server 40 and the keylock device 20. [

Financial services provided through the financial server 50 include financial services provided through ordinary Internet banking such as account transfer, withdrawal, deposit, and the like.

The key lock device 20 is mounted on a universal serial bus (USB) medium or a smart card with an integrated circuit (IC) chip, and performs data communication with the user terminal 10.

For example, when the key lock device 20 is mounted on a USB medium, it may be connected to a personal computer (PC), a notebook computer, or a laptop computer of the user terminal 10. In addition, when an antenna capable of NFC (Near Field Communication) communication is installed in the USB medium, the key lock device 20 is mounted on the USB medium and performs data communication with the smart phone through the antenna. In addition, when the key lock device 20 is mounted on the IC chip of the smart card, the key lock device 20 performs data communication directly with the smart phone through the NFC communication of the smart card.

For reference, in the present embodiment, a PC is employed as the user terminal 10, and the key lock device 20 is mounted on the USB medium and connected to the PC via the USB medium.

The key lock device 20 compares the signature value generated by the security server 40 with the signature value generated by the security server 40 and verifies the signature value generated in the security server 40 through whether or not the signature value matches the signature value generated by the security server 40, Compares the generated signature value with the signature value generated by the key lock device 20 and verifies the signature value generated in the key lock device 20 through whether or not the signature value matches. The key lock device 20 and the security server 40 authenticate whether the user is a legitimate user through the mutual authentication process as described above.

2 is a block diagram of the security server of FIG.

2, when the security server 40 is requested to generate a random value from the user terminal 10, the security server 40 generates a random value, transmits it to the user terminal 10, and generates a signature value using the random value . In addition, the security server 40 compares the signature value generated by the security server 40 with the signature value generated in the keylock device 20, and verifies the signature value generated in the keylock device 20.

The security server 40 includes an authentication module 41, an encryption / decryption module 42, a database unit 43, and a communication module 44.

The encryption / decryption module 42 encrypts and decrypts the unique information of the key lock device 20 with the encryption key. The encryption / decryption module 42 decrypts unique information and generates a signature value when unique information is encrypted and transmitted from the keylock device 20 through the user terminal 10, To be transmitted.

The unique information includes a serial number for identifying the key lock device 20 and personal information of the user. Such user's personal information may include the resident registration number of the user.

The database module 23 stores the authentication key of the key lock device 20. [ The process of generating the authentication key will be described later with reference to FIG.

The communication module 44 performs data communication with the user terminal 10.

The authentication module 41 generates a random value at the request of the user terminal 10 and transmits the random value to the keylock device 20 through the communication module 44. [ The authentication module 41 generates a combination data by combining the generated random value and the unique information decoded by the encryption / decryption module 42, and generates a signature value by signing the combination data with an authentication key. The authentication module 41 compares the signature value generated by the random value with the signature value transmitted from the key lock device 20 through the communication module 44 and transmits And verifies the signature value.

The authentication module 41 receives the status information on the lifecycle of the key lock device 20 from the user terminal 10 and manages the key lock device 20 through the status information.

Here, the status information of the key lock device 20 is information indicating whether the key lock device 20 is in an initial state, an issued state, or a revoked state. When the key lock device 20 is in an initial state, In case of the disposition state, the authentication is stopped through the corresponding key lock device 20, and the financial service is provided to the corresponding key lock device 20 I can not do it.

The security server 40 may be installed separately from the financial server 50 as shown in FIG. 1, but may be installed inside a financial server 50 installed in a financial institution (not shown) .

3 is a block diagram of the key lock apparatus of FIG.

Referring to FIG. 3, when the keylock device 20 is requested to generate a random value from the user terminal 10, the keylock device 20 generates and transmits a random value to the user terminal 10, and generates a signature value using the random value . In addition, the key lock device 20 compares the signature value generated by the key lock device 20 with the signature value generated in the security server 40, and verifies the signature value generated in the security server 40.

The key lock apparatus 20 includes an authentication unit 21, an encryption / decryption unit 22, a storage unit 23, and a communication unit 24.

The encryption / decryption unit 22 encrypts and decrypts unique information of the key lock apparatus 20 with the encryption key. When the unique information is transmitted from the user terminal 10, the encryption / decryption module 42 decrypts the signature value to generate a signature value, and encrypts the unique information so that the unique information can be transmitted to the security server 40.

The storage unit 23 stores the authentication key of the key lock apparatus 20. [

The communication unit 24 performs data communication with the user terminal 10.

The authentication unit 21 generates a random value at the request of the user terminal 10 and transmits the random value to the key lock apparatus 20 through the communication unit 24. [ The authentication unit 21 generates a combination data by combining the generated random value and the unique information decrypted by the encryption / decryption unit 22, and generates a signature value by signing the combination data with an authentication key. The authentication unit 21 compares the signature value generated by the random value with the signature value transmitted from the security server 40 via the communication unit 24 and determines whether or not the signature value transmitted from the key lock apparatus 20 Verify the signature value.

That is, the security server 40 and the keylock device 20 generate respective signature values and mutually authenticate the generated signature values.

Hereinafter, a process of providing a financial service using a security device for a financial service according to an embodiment of the present invention will be described in detail with reference to FIG. 4 to FIG.

4 is a flowchart illustrating a method of providing a financial service using an authentication apparatus for providing financial services according to an embodiment of the present invention.

First, when the user terminal 10 is requested to use the financial service, the user terminal 10 completes the public authentication process using the public key certificate (S102).

Here, the authentication process using the public certificate may include all of the public authentication processes currently used for the Internet banking and the like.

On the other hand, after completing the authentication process using the public certificate, the user terminal 10 uses the personal information of the user inputted at the time of authentication using the public certificate, 20) to the security server 40 (S104) whether the service subscriber can use the service for performing the authentication process.

The security server 40 confirms whether the user is a service subscriber and transmits the confirmation result to the user terminal 10 (S106).

The user terminal 10 receives a confirmation result from the security server 40 to confirm that the corresponding user is a service subscriber. At this time, if the user is not a service subscriber, the user terminal 10 notifies and requests subscription of the service so that the user can use the service.

On the other hand, if the user is a service subscriber, the user terminal 10 determines whether the key lock device 20 is electrically connected to the user terminal 10 (S108).

If it is determined that the key lock apparatus 20 is not electrically connected, the user terminal 10 outputs a message requesting insertion of the key lock apparatus 20 into the user terminal 10 (S110).

On the other hand, if the keylock device 20 is electrically connected, the user terminal 10 requests the keylock device 20 for status information of the keylock device 20 (S112).

Accordingly, the key lock device 20 transmits the status information of the key lock device 20 to the user terminal 10 (S114).

Here, the status information enables the keylock apparatus 20 to recognize whether it is an initial state, an issuing state, or a disposal state.

The user terminal 10 confirms the status information on the key lock device 20 (S116).

The user terminal 10 outputs a message window or the like so that the user can register the key lock device 20 in the issuance state when the key lock device 20 is in the initial state and the user can change the key lock device 20 to the issued state If the key lock device 20 is in the discarded state, it is informed that it can not be re-issued or can not provide financial services to the corresponding key lock device 20 through the key lock device 20.

On the other hand, when the key lock status is the issuance status, the user terminal 10 mediates the mutual authentication between the security server 40 and the key lock device 20 in cooperation with the security server 40 and the key lock device 20, The security server 20 and the security server 40 can mutually authenticate each other (S118).

Here, a mutual authentication process between the security server 40 and the keylock device 20 will be described later with reference to FIG.

The user terminal 10 requests the financial service 50 requested by the user in step S120 according to the mutual authentication result between the security server 40 and the keylock device 20, The financial service transmitted from the user terminal 10 to the user terminal 10 (S122).

5 is a flowchart illustrating an authentication method for providing financial services according to an embodiment of the present invention.

First, when the user terminal 10 applies power to the keylock device 20 (S202) and the operation for authenticating the keylock device 20 with the power supplied from the user terminal 10 is started (S204) The user terminal 10 requests the key lock apparatus 20 to generate a random value (S206).

When the keylock device 20 receives a random value generation request from the user terminal 10, it generates a random value and transmits it to the user terminal 10 (S208) And transmits the random value to the security server 40 (S210).

The security server 40 generates and transmits a signature value using the random value, the unique information, and the authentication key generated in the keylock device 20 (S212).

In this case, the security server 40 generates the combination data by combining the random value and the unique information, and authenticates the combination data with the authentication key to generate the signature value.

The security server 40 transmits the signature value to the user terminal 10 after generating the signature value as described above and the user terminal 10 transmits the signature value transmitted from the security server 40 to the keylock device 20, (S214).

The key lock device 20 generates a signature value by using the random value, the unique information and the authentication key generated by the key lock device 20, compares the signature value with the signature value transmitted from the security server 40, And verifies the signature value transmitted from the security server 40 (S216).

Here, the key lock device 20 generates the combination data by combining the random value and the unique information generated by the key lock device 20, and generates the signature value by authenticating the combination data with the authentication key.

Meanwhile, the key lock device 20 transmits the signature value verification result obtained by comparing the signature value generated by itself and the signature value transmitted from the security server 40 to the user terminal 10 (S218).

Upon receipt of the signature value verification result transmitted from the keylock device 20, the user terminal 10 requests the security server 40 to generate a random value (S220).

The security server 40 generates a random value and transmits the generated random value to the user terminal 10 at step S222 and the user terminal 10 transmits the random value to the user terminal 10, Value to the key lock device 20 (S224).

The keylock device 20 generates and transmits a signature value using the random value generated by the security server 40, the unique information, and the authentication key (S226).

In this case, the key lock device 20 generates the combination data by combining the random value and the unique information, and authenticates the combination data by the authentication key to generate the signature value.

The key lock device 20 transmits the signature value to the user terminal 10 after generating the signature value as described above and the user terminal 10 transmits the signature value transmitted from the security server 40 to the key lock device 20 (S228).

The security server 40 generates a signature value using the random value, the unique information, and the authentication key generated by the security server 40, compares the signature value with the signature value transmitted from the keylock device 20, The signature value transmitted from the key lock device 20 is verified (S230).

Here, the security server 40 generates combination data by combining the random value and the unique information generated by the security server 40, and generates the signature value by authenticating the combination data with the authentication key.

The security server 40 transmits the signature value verification result obtained by comparing the signature value generated by the security server 40 with the signature value transmitted from the keylock device 20 to the user terminal 10 (S232).

Upon receipt of the signature value verification result from the key lock apparatus 20 and the security server 40 as described above, the user terminal 10 registers as having been normally authenticated (S234) and, as shown in FIG. 4, Provide financial services.

Meanwhile, the authentication key is generated when the user is given the corresponding key lock device 20. The authentication key generating process will be described with reference to FIG.

6 is a flowchart illustrating a method of generating an authentication key of an authentication device for providing financial services according to an embodiment of the present invention.

First, the user requests registration of a service using the key lock device 20 to the branch terminal 30, and the branch terminal 30 registers the user as a service subscriber.

Thereafter, the user is actually given the key lock device 20. [ Thus, when the user is given the key lock apparatus 20, the authentication key for the key lock apparatus 20 is registered.

First, when the user inserts the key lock device 20 into the user terminal 10, the user terminal 10 and the key lock device 20 are electrically connected.

The user terminal 10 is electrically connected to the keylock device 20 so that power is applied to the keylock device 20 at step S302 and the keylock device 20 uses the power supplied from the user terminal 10 An operation for generating an authentication key is started (S304).

After applying power to the key lock apparatus 20, the user terminal 10 requests the key lock apparatus 20 to generate a random value (S306).

The keylock device 20 generates a random value and transmits it to the user terminal 10 in step S308. The user terminal 10 transmits the random value to the keylock device 20, And transmits unique information at this time (S310).

The keylock device 20 generates a signature value using the generated random value, the unique information transmitted from the user terminal 10, and an arbitrary authentication key, and then transmits a random value, unique information, and a signature value (S312 ). In this case, the key lock device 20 encrypts and transmits the unique information.

Here, the authentication key is generated arbitrarily, and after the result of mutual authentication in the security server 40, it is stored and registered as a final authentication key.

In this case, the key lock device 20 generates the combination data by combining the generated random value and the unique information, and generates the signature value by authenticating the combination data with an arbitrary authentication key.

When the keylock device 20 generates the signature value as described above and transmits the signature value and the encrypted unique information and signature value to the user terminal 10, the user terminal 10 transmits the random value and the encrypted unique information And the signature value to the security server 40 (S314).

The security server 40 receives the signature value, the encrypted unique information, and the random value from the user terminal 10, and decrypts the encrypted unique information. Thereafter, the security server 40 generates a signature value using the random value, the decrypted unique information, and the arbitrary authentication key, compares the signature value with the signature value generated in the keylock device 20, The signature value is verified (S316). Here, the arbitrary authentication key is the same as any authentication key previously stored in the keylock device 20. [

Thereafter, the security server 40 generates a random value, and generates a signature value using the stored unique information and an arbitrary authentication key. Thereafter, the security server 40 encrypts the unique information, transmits the verification result of the encrypted unique information, the random value, the signature value, and the signature value generated in the above-described keylock device 20 to the user terminal 10 (S318).

When the user terminal 10 receives the verification result of the encrypted unique information, the random value, the signature value, and the signature value generated in the above-described keylock device 20 from the security server 40, the user terminal 10 registers the verification result , The random value transmitted from the security server 40, the encrypted unique information, and the signature value to the keylock device 20 (S320).

When the key lock device 20 receives the signature value, the encrypted unique information, and the signature value from the user terminal 10, the key lock device 20 decrypts the encrypted unique information.

Thereafter, the key lock device 20 generates a signature value using the random value, the decrypted unique information, and an arbitrary authentication key, compares the signature value with the signature value generated in the security server 40, The signature value is verified (S322). Here, the arbitrary authentication key is the same as any authentication key previously stored in the keylock device 20. [

The keylock device 20 transmits the verification result obtained by verifying the signature value generated in the security server 40 to the user terminal 10 (S324).

The user terminal 10 registers the verification result transmitted from the keylock device 20. [ Accordingly, the user terminal 10 registers all the verification results in the security server 40 and the keylock device 20, and when the keylock device 20 verifies the signature value generated in the security server 40 To the security server 40 (S326).

Accordingly, the security server 40 stores process processing for service processing, for example, a previously stored arbitrary authentication key as a final authentication key, registers the corresponding key lock device 20 in an issuance state, To the terminal 10 (S328).

The user terminal 10 transmits to the keylock device 20 that the security server 40 has completed the process processing for service processing (S330).

Accordingly, the key lock device 20 registers that the process processing for the service processing is completed and stores the currently stored arbitrary authentication key as the final authentication key.

Meanwhile, in the above process, if the verification result and the signature value are different from each other in at least one of the key lock device 20 and the security server 40, the authentication procedure is stopped, and the user terminal 10 provides the corresponding financial service It would be natural to not.

According to the present invention configured as described above, security is improved when using a financial service based on mutual authentication between the security server 40 and the keylock device 20. [

In addition, since the present invention reduces the damage of leakage of the authorized certificate by duplication or deodorization of the authorized certificate and goes through the authentication process through the keylock device 20 provided to the legitimate user, even if the authorized certificate is duplicated or deodorized, To prevent the use of Internet banking in advance.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is clearly understood that the same is by way of illustration and example only and is not to be taken by way of limitation, I will understand. Accordingly, the true scope of the present invention should be determined by the following claims.

10: user terminal 20: keylock device
21: authentication unit 22: encryption / decryption unit
23: storage unit 24: communication unit
30: Branch terminal 40: Security server
41: authentication module 42: encryption / decryption module
43: Database part 44: Communication module
50: financial server

Claims (7)

And a user terminal for mediating authentication between the security server and the keylock device in cooperation with the security server and the keylock device,
The key lock apparatus generates a signature value through an authentication key, verifies a signature value generated in the security server,
Wherein the security server generates a signature value through the authentication key, verifies a signature value generated in the keylock device,
When the key lock device generates a random value in response to a request from the user terminal, generates a signature value using the generated random value, unique information, and an arbitrary authentication key, and transmits the random value to the security server through the user terminal, Verifies the signature value generated in the key lock device,
Generating a random value, generating a signature value using the generated random value, the unique information, and the arbitrary authentication key, and transmitting the signature value to the user terminal through the user terminal, When transmitting to the key lock device, the security server verifies the signature value generated in the key lock device,
Wherein the user terminal stores the verification result of the key lock device and the security server, and the security server and the key lock device finally store the arbitrary authentication key as the authentication key.
2. The method according to claim 1, wherein the user terminal confirms whether the keylock device is connected and outputs a message requesting connection of the keylock device if the keylock device is not connected. Device.
The authentication device according to claim 1, wherein the key lock device is mounted on a universal serial bus (USB) medium.
The apparatus as claimed in claim 1,
An encryption / decryption unit for encrypting and decrypting unique information of the key lock apparatus using an encryption key;
A storage unit for storing an authentication key of the key lock apparatus;
A communication unit for performing data communication with the user terminal; And
A random value is generated according to a request of the user terminal, and the random value is transmitted to the user terminal through the communication unit and transmitted to the security server. The random value generated according to the request of the user terminal and the unique value encrypted in the encryption / Generates a signature value using the authentication key stored in the storage unit, and compares the generated signature value with the signature value transmitted from the security server through the communication unit, and verifies the signature value transmitted from the security server And an authentication unit.
2. The system of claim 1, wherein the security server
An encryption / decryption module for encrypting and decrypting unique information of the key lock device using an encryption key;
A database module for storing an authentication key of the key lock device;
A communication module for performing data communication with the user terminal; And
Generating a random value according to a request from the user terminal, transmitting the generated random value to the user terminal through the communication module, and transmitting the random value to the keylock device, and generating a random value generated according to a request from the user terminal, And a signature value transmitted from the key lock device by comparing the generated signature value with the signature value transmitted from the key lock device through the communication module, And a verification module for verifying the verification result.
The method according to claim 4 or 5,
Wherein the unique information of the key lock device is a serial number of the key lock device or personal information of a user.
The authentication apparatus according to claim 1, wherein the security server manages the media status of the key lock apparatus according to status information on a life cycle of the key lock apparatus transmitted from the key lock apparatus.

Images