KR101607300B1 - Apparatus for authenticating password using character image, method thereof and computer recordable medium storing the method - Google Patents

Abstract

The present invention relates to an apparatus and a method for authenticating a password using a character image, and a computer readable recording medium storing the same. The method for authenticating a password using a character image comprises: a step of extracting a password character image from a password character string; a step of using the password character image and a reserve character image different from the password character image to generate a plurality of button images; a step of arranging the button images on a plurality of buttons to display the button images; a step of converting a button image of a selected button into a button image character string if at least a portion of the buttons is selected; and a step of comparing the button image character string with the previously stored password character string to authenticate the button image character string.

Description

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an apparatus for authenticating a password using a character image, a method therefor, and a computer-readable recording medium on which the method is recorded.

The present invention relates to authentication technology, and more particularly, to an apparatus and method for password authentication using a character image and a computer-readable recording medium on which the method is recorded.

As smartphone penetration rises and many tasks are transferred from PC to smartphone, important information such as personal information and financial information are being transferred. Recently, smartphone security has been studied in various ways to protect these important information. The portability of smartphones allows users to perform various tasks anytime and anywhere, but attackers are likewise more accessible to users, and smartphone users are more vulnerable than PC environments. Because of these various vulnerabilities, various kinds of attacks aimed at smartphones are emerging. As a threat to smartphone security, malicious code, stealth attacks and other threats are directly caused by personal information leakage or financial loss.

An existing user authentication application performs user authentication using a character or pattern recognition method. Currently, knowledge-based authentication is widely used as a technique for user authentication, which is mainly composed of a character or number input method or a pattern recognition method. Using this authentication technique, there is a risk that such a technique can be easily hacked with a simple peek attack, such as a Shoulder Sniffing Attack.

Korean Patent Publication No. 2002-0026636, published on April 12, 2002 (name: method of logging into computer and computer network)

An object of the present invention is to provide an apparatus and method for password authentication using a character image that allows an authentication process to be performed using an image based on a knowledge of a user rather than a number or a character and a computer readable recording Media.

According to another aspect of the present invention, there is provided an apparatus for password authentication using a character image, comprising: a password character image extracting unit for extracting a password character image from a password character string and using a password character image and a password character image different from the password character image A controller for generating a plurality of button images and arranging the plurality of button images on the plurality of buttons; And a display unit displaying a plurality of buttons.

In particular, the controller according to the embodiment of the present invention generates a button image by scrambling a password character image and a spare character image, and generates a button image using only the spare character image.

According to another aspect of the present invention, there is provided a method for password authentication using a character image, the method comprising: extracting a password character image from a password string; and extracting a password character image from the password character image, Generating a plurality of button images using the plurality of buttons, and arranging and displaying a plurality of button images on the plurality of buttons.

The method further includes the steps of converting the button image of the selected button to a button image string when at least some of the plurality of buttons are selected, .

The generating of the plurality of button images includes generating a button image by scrambling a password character image and a spare character image, and generating a button image using only the spare character image.

The authenticating step is characterized by confirming whether or not any one character image included in the characters of the button image string corresponding to the characters of the password character string and the password character image included in the characters of the password string are the same.

The method according to an embodiment of the present invention includes the steps of displaying a plurality of character images before extracting a password character image, and displaying the password character string as a password string when the password character images are sequentially selected from the plurality of character images And a step of storing the password string.

The method further includes scrambling one password character image belonging to each character of the password string and the preliminarily stored character image according to a predetermined rule before the step of converting the password string to the password string.

The step of generating a plurality of button images by using the password character image and the password character image different from the password character image may further include the steps of: And the password character image and the spare character image are displayed on one button image according to the display ratio.

Further, the present invention further provides a computer-readable recording medium having recorded thereon a program for performing a password authentication method using the character image according to an embodiment of the present invention.

The present invention provides a method for allowing an authentication process to be performed using an image based on a user's knowledge rather than numbers or letters. That is, since the present invention provides the password character image and the preliminary character image by scrambling in the button for inputting the password, the password can not be hacked by the peeking technique. Therefore, the reliability of the security process can be increased.

1 is a block diagram for explaining an apparatus for password authentication using a character image according to an embodiment of the present invention.
2 is a flowchart illustrating a method of registering a password according to an embodiment of the present invention.
FIG. 3 is an exemplary screen for illustrating a method of registering a password according to an embodiment of the present invention.
4 is a diagram for explaining a method of registering a password according to an embodiment of the present invention.
5 is a flowchart illustrating a password authentication method according to an embodiment of the present invention.
6 is a diagram for explaining a method of generating a button image using a password character image and a spare character image.
7 is a diagram for explaining a method of generating a button image using a plurality of preliminary character images.
8 is an example of a screen in which a plurality of buttons including a button image are displayed.
9 is a diagram for explaining a method of performing authentication by comparing a button image string and a password string.

Prior to the detailed description of the present invention, the terms or words used in the present specification and claims should not be construed as limited to ordinary or preliminary meaning, and the inventor may designate his own invention in the best way It should be construed in accordance with the technical idea of the present invention based on the principle that it can be appropriately defined as a concept of a term to describe it. Therefore, the embodiments described in the present specification and the configurations shown in the drawings are merely the most preferred embodiments of the present invention, and are not intended to represent all of the technical ideas of the present invention. Therefore, various equivalents It should be understood that water and variations may be present.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. Note that, in the drawings, the same components are denoted by the same reference symbols as possible. Further, the detailed description of known functions and configurations that may obscure the gist of the present invention will be omitted. For the same reason, some of the elements in the accompanying drawings are exaggerated, omitted, or schematically shown, and the size of each element does not entirely reflect the actual size.

First, an apparatus for password authentication using a character image according to an embodiment of the present invention will be described. 1 is a block diagram for explaining an apparatus for password authentication using a character image according to an embodiment of the present invention. An apparatus for password authentication using a character image will be referred to as a user apparatus 100 in the embodiment of the present invention.

The user device 100 may advantageously illustrate a Smart Phone. However, the user device 100 may be a mobile phone, a PDA (Personal Digital Assistant), a PMP (Portable Multimedia Player), a MID (Mobile Internet Device), a Desktop, a Tablet PC, A notebook, a netbook, a digital camera, and the like. Thus, each device can have various modules described below. Those of ordinary skill in the art will appreciate that the various devices described above can authenticate their passwords through the authentication method provided in the method of embodiments of the present invention.

The user device 100 includes an input unit 110, a display unit 120, a storage unit 130, and a control unit 140.

The input unit 110 receives a user's key operation for controlling the user device 100, generates an input signal, and transmits the input signal to the control unit 140. The input unit 110 may include any one of a power key, a number key, and a direction key for power on / off, and may be formed with a predetermined function key on one side of the user device 100. The input unit 110 may include at least one of a keypad and a touchpad that generates an input signal according to a user's touch or operation. At this time, the input unit 110 may be configured in the form of a touch panel (or a touch screen) together with the display unit 120 to simultaneously perform input and display functions. The input unit 110 may be any type of input device that can be developed in addition to an input device such as a keyboard, a keypad, a mouse, a joystick, and the like.

The display unit 120 receives data for screen display from the control unit 140 and displays the received data on a screen. The display unit 120 visually provides menus, data, function setting information, and various other information of the user apparatus 100 to the user. The display unit 120 functions to output a boot screen, a standby screen, a menu screen, and other application screens of the user device 100. When the display unit 120 is formed by a touch screen, some or all of the functions of the input unit 110 may be performed instead. The display unit 120 may include a liquid crystal display (LCD), an organic light emitting diode (OLED), and an active matrix organic light emitting diode (AMOLED).

In the case where the display unit 120 is formed as a touch screen, a part or all of the function of the input unit 110 may be realized in the display unit 120, and the input unit 110 may be implemented as a touch panel. The input unit 110 may be included in the display unit 120 when the display unit 120 can perform all the functions. Hereinafter, it is assumed that the input unit 110 is a touch panel in the embodiment of the present invention. It is assumed that the display unit 120 is a touch screen. Nevertheless, those skilled in the art will readily be able to apply embodiments of the present invention to devices in which the input section 110 and the display section 120 are separate types.

The storage unit 130 stores programs and data necessary for the operation of the user apparatus 100, and can be divided into a program area and a data area. The program area may store a program for controlling the overall operation of the user device 100, an operating system (OS) for booting the user device 100, an application program, and the like. The data area is an area where user data generated according to use of the user device 100 is stored. Also, the storage unit 130 may store various kinds of data generated according to the use of the user device 100 by the user. Each kind of data stored in the storage unit 130 can be deleted, changed, or added according to a user's operation.

The control unit 140 may control the overall operation of the user device 100 and the signal flow between the internal blocks of the user device 100 and may perform a data processing function for processing the data. The controller 140 may be a central processing unit (CPU), an application processor, or the like. According to an embodiment of the present invention, the control unit 140 generates an interface for receiving a password and outputs the generated interface through the display unit 120. [ The control unit 140 receives the password input by the user through the display unit 120 or the input unit 110. Then, the control unit 140 authenticates the input password. The operation of the control unit 140 will be described in detail below.

2 is a flowchart illustrating a method of registering a password according to an embodiment of the present invention. FIG. 3 is an exemplary screen for illustrating a method of registering a password according to an embodiment of the present invention. 4 is a diagram for explaining a method of registering a password according to an embodiment of the present invention.

Referring to FIGS. 2 to 4, when a process for setting a password starts, the control unit 140 displays a plurality of character images usable as a password through the display unit 120 in step S110.

When a plurality of character images are displayed, the user can select a plurality of character images to be used as a password from among a plurality of character images. The character image selected by the user is referred to as a password character image. On the other hand, a character image not selected by the user will be referred to as a spare character image. According to the screen example shown in Fig. 3, the user has selected character 1 and character 3 among a plurality of character images. In this screen example, although the selection of two character images is selected, the number of character images to be selected may be changed according to the set number.

If the user selects a plurality of character images, the control unit 140 detects the characters through the display unit 120 in step S120, and converts the plurality of character images selected by the user into character strings in step S130 to generate a password character string. That is, this password string is made in the order in which the password character image is selected. Here, referring to FIG. 4, the user can select a character image in the order as shown in (A). That is, the password character image and its order are as shown in (A). Then, the control unit 140 converts the password character image into a character string as shown in (B) in order. In this manner, a password character image obtained by converting the password character image in order will be referred to as a password character string. Then, the control unit 140 can encrypt the password string in step S140. According to the embodiment of the present invention, the encryption can be performed using the preliminary character image. As described above, the preliminary character image means all character images other than the password character image. For example, as shown in FIG. 4C, the encryption may be one of a password character image belonging to a character of each password string and a preliminary character image scrambled according to a predetermined rule. In this case, if the scrambling rule can not be known, it can not be known which character image is the password character image. Therefore, you can safely store password strings. It will be appreciated by those skilled in the art that various encryption techniques can be applied using the preliminary character image.

When the encryption is completed as described above, the controller 140 may store the encrypted password string in the storage unit 130 by mapping the encrypted password string to the ID of the user in step S150.

5 is a flowchart illustrating a password authentication method according to an embodiment of the present invention. 6 is a view for explaining a method of generating a button image using a password character image and a preliminary character image, and FIG. 7 is a view for explaining a method of generating a button image using a plurality of preliminary character images to be. FIG. 8 is a screen display example in which a plurality of buttons including a button image are displayed. FIG. 9 is a view for explaining a method for performing authentication by comparing a button image string and a password string.

In the embodiment of FIG. 5, it is assumed that the user has already set a password as described in the embodiment of FIG. 2 already described above. Accordingly, the user assumes a situation where authentication is to be performed using a password. This authentication can be to gain access to the device. This can be exemplified by a procedure for unlocking the smartphone.

Referring to FIG. 5, the controller 140 can receive a password input request in step S200. This can be done through the touch panel (input unit 110) of the display unit 120. If there is such a password input request, the control unit 140 extracts the encrypted password string in step S210. The encrypted password string is a state in which one password character image and a spare character image are scrambled in each character, as shown in FIG. 4C.

Accordingly, the control unit 140 decrypts the encrypted password string in step S220. If the encrypted password string is decrypted, a password string containing one password character image of one character in the password string is derived. For example, the control unit 140 descrambles (decrypts) the encrypted password string as shown in FIG. 4 (C) according to a predetermined rule to generate one password character for each character as shown in FIG. 4 (B) You can derive a password string that contains an image.

Next, the control unit 140 extracts a password character image from the password string in step S230. That is, the control unit 140 can extract the password character image included in each character of the password character string, as shown in FIG. 4A, from the password character string as shown in FIG. 4B.

Then, the control unit 140 generates a plurality of button images using the password character image and the preliminary character image in step S240.

At this time, the controller 140 may generate a button image using one password character image and at least one spare character image. Such an example is shown in Fig. Here, the character 3 (C3) is the password character image selected by the user, and the character 2 and the character 4 (C2, C4) are the preliminary character images. As shown, the controller 140 can generate the button image 10 by scrambling the character images. Here, the arrangement of the password character image and the preliminary character image during scrambling may be performed according to a predetermined rule. According to one embodiment, this rule may be determined according to the display ratio of one character image. Here, the display ratio of the character image is a ratio that should be minimally displayed in order to distinguish one character image from another character image. Such character image display ratio may vary depending on the character used. For example, in order for a user to distinguish one character image from another character image, it is assumed that one character image should be displayed at 70% or more. Then, the control unit 140 arranges the character image so that the password character image and the spare character image displayed on one button image are displayed on one button image according to the display ratio of the character image. That is, the control unit 140 arranges each character image included in the button image in the button image so that 70% or more of each character image is displayed. For this, the control unit 140 may enlarge or reduce the password character image and the spare character image at the same ratio.

On the other hand, if the password character image selected by the user is four, four button images 10 will be created. As described above, since the button image 10 generated using one password character image and at least one spare character image includes not only the password character image but also the spare character image, the user other than the user who knows the password character image It is not known whether the character image is a password character image.

Also, the control unit 140 may generate a button image using a plurality of preliminary character images. An example of this is shown in Fig. Here, the character 5, the character 6, and the character 7 (C5, C6, C7) are the preliminary character images. The control unit 140 may generate the button image 20 by scrambling the preliminary character images.

As described above, the arrangement of the password character image and the spare character image in scrambling is performed according to a predetermined rule, and is determined according to the display ratio of one character image. Accordingly, the control unit 140 scrambles the character image so that the spare character image displayed on one button image is included in one button image according to the display ratio of the character image. For this, the control unit 140 may enlarge or reduce the password character image and the spare character image at the same ratio.

On the other hand, if the number of password character images selected by the user is four and the number of buttons displayed on the screen is twelve, then the number of button images 20 will be 12 - 4 = 8.

As described above, when a plurality of button images 10 and 20 are generated, the control unit 140 arranges each of the plurality of button images in a plurality of buttons in step S250. At this time, the controller 140 preferably arranges each of the plurality of button images in a plurality of buttons in a random manner.

Then, in step S260, the controller 140 displays a plurality of buttons including the button images on the display unit 120, respectively. An example of such a screen is shown in Fig. As shown in the figure, a plurality of button images are arranged as buttons including a button image 10 including a password character image and a button image 20 including only a spare character image.

The user can sequentially select the password character images set in advance on the screen and request the authentication. Accordingly, if the user selects a button for requesting authentication, the control unit 140 senses the selected button through the input unit 110 or the display unit 120 in step S270. In step S280, the control unit 140 converts the button images of the sequentially detected buttons into button image strings.

Next, the control unit 140 compares the button image string and the password string in step S290 and performs authentication. For example, it is assumed that the button image string composed of the button image selected by the user is as shown in (A) of FIG. It is also assumed that the password string is as shown in Fig. 9 (B). Then, the control unit 140 compares the corresponding character 11, 12, 13, 21, 22, 23 in the button image string (a) and the password string (b) to perform authentication.

The control unit 140 determines that the characters of the password character string (a) and the character string of the password character string (b), respectively, when comparing the mutually corresponding characters in the button image string (a) And judges whether or not there is the same character image as the password character image. For example, the first character 11 of the button image string A and the first character 21 of the password string B can be compared. Here, the first character 21 of the password string B includes the character 1 (C1), and the control unit 140 determines that the first character 11 of the button image string (A) has the character 1 (C1) Whether they are included or not. At this time, the control unit 140 distinguishes each of the plurality of character images of the first character 11 of the button image string (a), compares the character images of the respective separated character images with the character 1 (C1), and determines whether or not the same character exists .

In the above-described manner, the control unit 140 compares each character of the password string (B) with each character of the button image string (A) in step S300, If the password character image is included in the character of the corresponding button image string (a), it is determined that the authentication is successful. That is, as shown in Fig. 9, the characters 21, 22 and 23 of the password string (b) corresponding to the respective characters 11, 12 and 13 of the button image string (a) are compared. At this time, each of the first, second and third characters of the password string (b) includes the password character image (C1, C2, C3), and the first, second and third characters It is determined that the authentication is successful because each of the password character images C1, C2, and C3 is also included. On the other hand, the control unit 140 compares each character of the button string (a) with the corresponding character of the password string (b), so that the password character image included in at least one character of the password string If the character of the button image string (a) is not included in the character string, it is determined that the authentication is failed.

If the authentication is successful, the control unit 140 performs a function corresponding to the authentication success in step S310. Typically, this function may illustrate unlocking the device. On the other hand, if the authentication is unsuccessful, the controller 140 may output an error through the display unit 120 and perform the authentication process again in step S320.

The method according to the present invention may be implemented in the form of software readable by various computer means and recorded in a computer-readable recording medium. Here, the recording medium may include program commands, data files, data structures, and the like, alone or in combination. Program instructions to be recorded on a recording medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of computer software. For example, the recording medium may be an optical recording medium such as a magnetic medium such as a hard disk, a floppy disk and a magnetic tape, a compact disk read only memory (CD-ROM), a digital versatile disk (DVD) A magneto-optical medium such as a floppy disk and a ROM, a random access memory (RAM), a flash memory, a solid state disk (SSD), a hard disk drive (HDD) And hardware devices specifically configured to store and perform the same program instructions. Examples of program instructions may include machine language code such as those generated by a compiler, as well as high-level language code that may be executed by a computer using an interpreter or the like. Such hardware devices may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

While the present invention has been described with reference to several preferred embodiments, these embodiments are illustrative and not restrictive. It will be understood by those skilled in the art that various changes and modifications may be made without departing from the spirit of the invention and the scope of the appended claims.

100: User device
110: input unit
120:
130:
140:

Claims (5)

A storage unit for storing data;
A display unit for screen display; And
A password character string image generating unit configured to generate a password character string in which a plurality of selected character images are listed in a selected order when the user selects a plurality of character images and generate a password character image different from a password character image belonging to the characters of the password string, Encrypts the password string by scrambling according to a predetermined rule, stores the encrypted password string in the storage unit,
Extracting a password character image from the encrypted password string if there is a password input request, generating a plurality of button images using the password character image and a preliminary character image different from the password character image, And a control unit for controlling the display unit to display the plurality of buttons by arranging the plurality of buttons on the plurality of buttons. When a user selects a plurality of character images, generating a password string arranged in a selected order of the plurality of selected character images;
Encrypting the password character string by scrambling a password character image belonging to the character string of the password string and a preliminary character image different from the password character image according to a predetermined rule;
Storing the encrypted password string;
Extracting a password character image from the encrypted password string if there is a password input request;
Generating a plurality of button images using the password character image and a preliminary character image different from the password character image; And
A method for password authentication using a character image, the method comprising: displaying a plurality of button images on a plurality of buttons. 3. The method of claim 2,
Wherein the generating the plurality of button images comprises:
Generating a button image by scrambling the password character image and the preliminary character image; And
And generating a button image using only the preliminary character image. A method for authenticating a password using a character image. 3. The method of claim 2,
Converting a button image of the selected button into a button image string when at least some of the plurality of buttons are selected; And
And comparing and authenticating the button image string with the pre-stored password string to authenticate the password. A computer-readable recording medium on which a program for performing the method according to any one of claims 2 to 4 is recorded.

Images