KR101643339B1 - Method and system for user certification - Google Patents

Abstract

The present invention relates to a method and system for authenticating a user. According to a first aspect of the present invention, there is provided an authentication method for an authentication system for authenticating a user controlling a first terminal, the method comprising: receiving unique information for authenticating the first terminal when receiving a login request from the first terminal; Receiving the unique information from the second terminal and receiving current location information of the second terminal together with the current location information of the second terminal and comparing the current location information and the registered location information of the second terminal, And authenticating the first terminal.

Description

[0001] METHOD AND SYSTEM FOR USER CERTIFICATION [0002]

The present invention relates to a user authentication method and an authentication system, and more particularly, to a method and system for authenticating a user terminal controlled by a user by using a controllable other terminal.

Recently, cloud services are widely used. The "cloud service" is a service that stores applications such as image files, image files, text files, music files, and other applications such as ERP (Enterprise Resource Planning) programs, office programs and groupware on a server, The user can access the server to access the server and download the content file or the application or access the content file to view / edit the content, access the application, To be performed. The server providing such a cloud service may be, for example, an application (or server) virtualization server.

On the other hand, a typical server providing a cloud service often authenticates a user by a combination of an ID and a password, so that a third party can access the user's cloud server account by stealing the user's ID and password. There is a problem that the account of the user is exposed to the third person as a helper. Therefore, it became necessary to develop a technique for authenticating that a user has legitimate rights to access a user's account.

In connection with this, in the prior art document 10-2013-0083074 (entitled "Cloud Authorized Authentication System, User Terminal, and Cloud Authorized Authentication Method"; published date: Jul. 23, 2013), a cloud A server, and a user terminal, and providing a public key certificate of the user terminal in response to a request from the cloud server. The cloud public authentication system includes a cloud authentication server, , A public authentication certificate is stored in a database linked to a cloud server so that the public authentication can be performed without any physical constraint in a communication environment, or a certificate can be copied and stored in a user terminal.

That is, in the prior art document, a method of authenticating a user using a cloud service is proposed, but a user who has access to a cloud server providing a cloud service has a legitimate right to access a user account of the cloud server And the user's account is easily exposed if the user does not manage the authorized certificate.

Therefore, there is a need for a user authentication technique that can effectively protect a user account without separately requiring a user's effort for authentication.

On the other hand, the background art described above is technical information acquired by the inventor for the derivation of the present invention or obtained in the derivation process of the present invention, and can not necessarily be a known technology disclosed to the general public before the application of the present invention .

One embodiment of the present invention is directed to a method and system for authenticating a user.

According to a first aspect of the present invention, there is provided an authentication method for an authentication system for authenticating a user controlling a first terminal, the authentication method comprising: The method comprising the steps of: providing unique information for authenticating the first terminal to the first terminal, receiving the unique information from a second terminal and receiving current location information of the second terminal together, And comparing the current location information and the registered location information of the second terminal to authenticate the first terminal.

According to a second aspect of the present invention, there is provided an authentication system for authenticating a user controlling a first terminal, the terminal comprising: a first authentication unit for authenticating the first terminal when receiving a login request from the first terminal; A unique information transmitting unit configured to provide the unique location information to the first terminal and receiving the unique information from the second terminal together with the current location information of the second terminal, And a user authentication unit configured to compare the first terminal with the first terminal.

According to a third aspect of the present invention, there is provided a method for authenticating a first terminal, comprising the steps of: providing unique information for authenticating the first terminal to the first terminal upon receiving a login request from the first terminal; And receiving the current location information of the second terminal together with the current location information of the second terminal and comparing the current location information and the registered location information of the second terminal to authenticate the first terminal The program may be a computer readable recording match in which the program is recorded.

According to a fourth aspect of the present invention, there is provided a method for authenticating a first terminal, the method comprising the steps of: providing unique information for authenticating the first terminal to the first terminal upon receiving a login request from the first terminal, Receiving information from the second terminal together with the current location information of the second terminal, and comparing the current location information and the registered location information of the second terminal to authenticate the first terminal May be a computer program stored on a medium.

According to any one of the above-mentioned objects of the present invention, an embodiment of the present invention can provide a method and system for authenticating a user.

In addition, according to any one of the tasks of the present invention, a user authentication technique that improves security by authenticating a user by using unique information generated each time a user accesses, rather than authenticating a user with only an ID and a password Can be presented.

In addition, according to any one of the tasks of the present invention, the user is authenticated by using the unique information generated each time the user accesses and the current location information of the user terminal, rather than authenticating the user with only the ID and password, It is possible to propose an improved user authentication technique.

According to any one of the tasks of the present invention, the authentication of the user is not limited to one time, but based on the current position information of the user terminal of the user, it is continuously checked whether the user having a legitimate authority has access to the user account It is possible to propose a user authentication technique with improved security.

The effects obtained by the present invention are not limited to the above-mentioned effects, and other effects not mentioned can be clearly understood by those skilled in the art from the following description will be.

1 is a configuration diagram of an authentication system according to an embodiment of the present invention.
2 is a block diagram illustrating an authentication system in accordance with one embodiment of the present invention.
3 is a flowchart illustrating an authentication method according to an embodiment of the present invention.
4 is a flowchart for explaining a step of authenticating a user in an authentication method according to an embodiment of the present invention.
5 is a flowchart illustrating a step of forming and managing a secure channel in an authentication method according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, which will be readily apparent to those skilled in the art. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

Throughout the specification, when a part is referred to as being "connected" to another part, it includes not only "directly connected" but also "electrically connected" with another part in between . Also, when an element is referred to as "comprising ", it means that it can include other elements as well, without departing from the other elements unless specifically stated otherwise.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram illustrating an authentication system 20 according to an embodiment of the present invention.

The authentication system 20 can communicate with the user terminal 11,12 and the service server 30 via the network N and the user terminal 11 can communicate with the service server 30 ) To authenticate whether or not the service server 30 has the right to receive the service. The network N may be a local area network (LAN), a wide area network (WAN), a value added network (VAN), a personal area network (PAN) wireless networks such as mobile radio communication network, Wibro (Wireless Broadband Internet), Mobile WiMAX, HSDPA (High Speed Downlink Packet Access) or satellite communication network.

Meanwhile, the user terminals 11 and 12 can be implemented as a computer, a portable terminal, a television, a wearable device, or the like, which can be connected to a remote server through a network N or connected to other terminals and servers. Here, the computer includes, for example, a notebook computer, a desktop computer, a laptop computer, and the like, each of which is equipped with a web browser (WEB Browser), and the portable terminal may be a wireless communication device , Personal Communication System (PCS), Personal Digital Cellular (PDC), Personal Handy phone System (PHS), Personal Digital Assistant (PDA), Global System for Mobile communications (GSM), International Mobile Telecommunication (IMT) (W-CDMA), Wibro (Wireless Broadband Internet), Smart Phone, Mobile WiMAX And a handheld based wireless communication device. In addition, the television may include an Internet Protocol Television (IPTV), an Internet television (TV), a terrestrial TV, a cable TV, and the like. Further, the wearable device is an information processing device of a type that can be directly worn on a human body, for example, a watch, a glasses, an accessory, a garment, shoes, or the like, and can be connected to a remote server via a network, Lt; / RTI >

Herein, for the sake of convenience of description, a user terminal to be authenticated is referred to as a first terminal 11, and a user terminal used for implementing an authentication method according to an embodiment of the present invention is referred to as a second terminal 12 do. In addition, the first terminal 11 may include a display unit capable of displaying unique information so that the second terminal 12 can acquire the unique information, and the second terminal 12 can acquire unique information (For example, a photographing unit capable of photographing the image when the unique information is displayed as an image through the display unit of the first terminal, a decoding unit for decoding the image when the image including the unique information is to be decoded, Etc.). Each of the first terminal 11 and the second terminal 12 may be a different user terminal or the same user terminal.

On the other hand, the service server 30 is a server including an account to be accessed by the first terminal 11, for example, the service server 30 includes a general web server . ≪ / RTI > The type of service that the service server 30 can provide is not limited, and thus, for example, the service server 30 may be a server capable of providing a cloud service. Such a service server 30 may communicate with the authentication system 20 via the network N as shown in Figure 1 or may include an authentication system 20 or may be included in the authentication system 20 .

The authentication system 20 capable of communicating with the first terminal 11, the second terminal 12 and the service server 30 in accordance with the above will be described in detail later with reference to Fig.

2 is a block diagram of an authentication system 20 in accordance with one embodiment of the present invention.

2, the authentication system 20 includes a construction construction unit 210, a unique information transmission unit 220, a unique information generation unit 230, a user authentication unit 240, a channel management unit 250, And a security management unit 260.

The authentication system 20 includes an internal component 210, a unique information transmission unit 220, a unique information generation unit 230, a user authentication unit 240, a channel management unit 250, And a communication unit (not shown) that enables communication between the management unit 260 and communication with external components.

The authentication system 20 may include a storage unit (not shown) for storing data for performing an authentication method according to an embodiment of the present invention, or a storage device (not shown) For example, it can communicate with a database.

The contract construction unit 210 according to the embodiment of the present invention can set various conditions for authenticating the first terminal to be authenticated.

That is, the contract construction unit 210 can set a condition for the first terminal to be authenticated, and can set conditions for the second terminal to be used for authentication.

For example, the contract construction unit 210 sets registration identification information so that user identification information (ID, password, etc. corresponding to the user) to be received through the first terminal (or the second terminal) has predetermined user identification information And may set registration position information so that the current position information (e.g., IP address, WiFi address, GPS address, etc.) of the first terminal (or the second terminal) has predetermined position information And also includes terminal detailed information (e.g., terminal identification information such as a MAC address or communication identification information, a product model name, a product unique number, a type and version of an operating system, Information on the owner of the terminal, etc.) can have predetermined terminal detailed information.

Thus, for example, when the first terminal 11 is a computer and the second terminal 12 is a portable terminal, the coarse construction unit 210 sets a specific IP address as registration position information of the first terminal, A specific MAC address can be set as the registration detailed information of the first terminal, a specific GPS address can be set as the registration position information of the second terminal, and a specific telephone number can be set as the registration detailed information of the second terminal.

At this time, the contract construction unit 210 can set the specific terminal detailed information registered by the user or the administrator of the authentication system 20 as the registration detailed information, or can set the registration detailed information by default.

The registered location information of the first terminal 11 may be registered by the user or registered by the administrator of the authentication system 20 or may be registered by the administrator of the authentication system 20, The position can be set to the selected position. At this time, the contract construction unit 210 may be a location where the user of the user account has most recently logged in, or a location where the user has logged in with the highest frequency, And at least one of the positions represented by the highest frequency among the positions may be recommended and selected as registration position information.

Further, the registration position information of the second terminal 12 can be registered by the user, or can be registered by the manager of the authentication system 20, or can be registered by the manager If at least one of the above positions is selected, the selected position can be set. At this time, the contract construction unit 210 can recommend the location based on the login request history of the first terminal and the unique information transmission history of the second terminal. For example, the contract construction unit 210 may determine a location where the first terminal has most recently logged in (or requested a login), a location where the first terminal has logged in (or requested to log in) with the highest frequency, A location where the second terminal transmitted the unique information, a location where the second terminal transmitted the unique information with the highest frequency, a location of the first terminal transmitting the unique information, At least one of the locations from which the second terminal has transmitted the unique information.

In addition, the joining construction unit 210 may further determine the number of accesses to each of the plurality of pieces of registration position information when there is a plurality of pieces of registration position information of the first terminal or the second terminal, It is possible to authenticate a user only when a login is requested less than the number of accesses or when unique information is transmitted.

Meanwhile, the unique information transmitting unit 220 may provide unique information for authenticating the first terminal to the first terminal upon receiving the login request from the first terminal.

At this time, the unique information transmitting unit 220 may transmit the unique information unconditionally to the first terminal that requests the login, or may transmit unique information only when the first terminal satisfies a predetermined condition.

For example, the unique information transmitting unit 220 may determine whether the unique information is provided based on at least one of the user identification information received through the first terminal, the terminal detailed information of the first terminal, and the current location information of the first terminal Can be determined. For example, when the password received through the first terminal is different from the predetermined password, the unique information transmitting unit 220 may not transmit unique information. Or, for example, if the MAC address of the first terminal is different from the predetermined address, it may not transmit the unique information.

In addition, the unique information transmitting unit 220 may transmit the unique information as it is, or may transmit the unique information in another form encapsulating the unique information. For example, if the unique information is a character string consisting of a series of numbers and characters, the barcode may be transmitted to the first terminal by encapsulating the unique information to generate a two-dimensional barcode.

In this manner, the unique information to be transmitted to the first terminal can be generated by the unique information generating unit 230.

The 'unique information' is information generated for authenticating a user, and can be allocated differently for each user. Such unique information may be a series of codes composed of letters or numbers, or a two-dimensional bar code such as a one-dimensional bar code or a QR code.

Such unique information can be newly generated by the unique information generating unit 230 for each login request event of the first terminal 11. [

At this time, the unique information generating unit 230 may generate unique information according to the time or location at which the first terminal 11 requests login, for example, to the authentication system 20, or may generate unique information based on a random seed To generate unique information,

Meanwhile, when the user authentication unit 240 receives the unique information from the second terminal of the user and receives the current location information of the second terminal together, the user authentication unit 240 registers the registered location information of the second terminal and the current location information of the second terminal The first terminal can authenticate the first terminal so that the first terminal can access the user account. In addition, the user authentication unit 240 compares the current location information and the registered location information of the second terminal, further determines whether or not the access network of the second terminal is a network corresponding to the registered location information, The first terminal can authenticate the first terminal so that the first terminal can access the user account only when the access network of the second terminal is a network corresponding to the registration position information. If the access network of the second terminal is not the network corresponding to the registration location information, the first terminal may be not authenticated, and instead, the security manager 260 may operate the predetermined security protocol.

When the access count is set for each registration position information of each second terminal by the coarse construction unit 210, the user authentication unit 240 counts the number of times of reception each time the current position information is received from the second terminal, And may not authenticate the first terminal if the counted number of times exceeds the number of accesses of the registration location information coinciding with the current location information.

The channel management unit 250 may establish a secure channel for packet exchange between the first terminal 11 and the service server 30 when the first terminal 11 is authenticated by the user authentication unit 240 have. At this time, the secure channel may be a dedicated channel only for the first terminal 11, and thus other user terminals can not transmit or receive packets to the service server 30 via the secure channel.

The channel management unit 250 may terminate the secure channel with the first terminal 11 if at least one of the first terminal 11 and the second terminal 12 does not satisfy the predetermined condition.

To this end, the channel manager 250 may determine whether to terminate the secure channel based on the header of the packet received from the first terminal 11. That is, the header of the packet received from the first terminal 11 includes at least one of the terminal detailed information and the current location information of the first terminal, and continuously analyzes the header of the packet every time the packet is received, If at least one of the information included in the header is inconsistent with the preset information, the secure channel can be terminated. For example, if the current location of the authenticated first terminal 11 is moved and the current location information included in the header of the packet becomes inconsistent with the registered location information, the channel management unit 250 may terminate the secure channel have. In addition, since the current position information of the first terminal 11 can be made to coincide with the registered position information through a tethering, for example, a hacker or the like, the channel manager 250 continuously / (I.e., the network to which the first terminal 11 is connected) in which the secure channel between the first terminals 11 is established (i.e., the network to which the first terminal 11 is connected) receives the login request of the first terminal 11 If the first terminal 11 detects that the first terminal 11 is connected to a network other than the predetermined network, it may terminate the secure channel with the first terminal 11 . In addition, the channel management unit 250 may allow the security management unit 260 to operate a predetermined security protocol.

When the first terminal 11 is authenticated and a secure channel is formed, the channel management unit 250 may match and store channel information related to the secure channel with the second terminal 12 used for the authentication, 2 terminal 12 periodically to request the current location information of the second terminal and terminate the secure channel with the first terminal if the current location of the second terminal does not match the registered location information. For example, the channel management unit 250 may request and receive the current location information of the second terminal directly from the second terminal 12 or may receive the current location information of the second terminal 12 from the first terminal 11 Extracts the current location information of the second terminal from the packet header of the first terminal and terminates the secure channel with the first terminal if the current location of the second terminal does not match the registered location information. Also, since the current position information of the second terminal 12 can be made to coincide with the registered position information through, for example, tethering by a hacker or the like, the channel manager 250 continuously / The second terminal 12 receives the information about the network to which the second terminal 12 is connected and receives the information from the second terminal 12 at random or periodically, If the second terminal 12 detects that the second terminal 12 is connected to a network other than the predetermined network, it may determine that the first terminal 12 is a secure channel with the first terminal Can be terminated. In addition, the channel management unit 250 may allow the security management unit 260 to operate a predetermined security protocol.

Meanwhile, if it is determined that at least one of the first terminal and the second terminal is connected to a network other than the predetermined network, the security managing unit 260 may operate the predetermined security protocol.

At this time, at least one of the first terminal and the second terminal is connected to the network other than the preset network, and the security management unit 260 transmits a message informing that the terminal having the current position different from the registration position has been connected, Alternatively, the security protocol may be operated in a manner of transmitting to the administrator, or a method of intercepting the connection of the terminal to the user account or a method of intercepting all terminals for the user account for a predetermined time .

Meanwhile, the authentication method according to the embodiment shown in FIGS. 3 to 5 includes steps that are processed in a time-series manner in the authentication system 20 shown in FIG. Therefore, the contents described above with respect to the authentication system 20 shown in Fig. 2 can be applied to the authentication method according to the embodiment shown in Figs. 3 to 5 even if omitted from the following description.

As shown in FIG. 3, the authentication system 20 can set a condition for authenticating the user before proceeding with the authentication procedure (S310).

That is, the authentication system 20 can set a condition for authenticating the user (or the first terminal for which the user requests login).

The authentication system 20 can transmit unique information to a user terminal when a user terminal requests a login, and can restrict an object to which the unique information is to be transmitted. That is, unique information can be transmitted only to a first terminal having predetermined registration detailed information as terminal detailed information or a first terminal having predetermined registration position information as current position information. Alternatively, the unique information may be transmitted only to the first terminal that has transmitted the predetermined registration identification information as the user identification information.

Also, the authentication system 20 does not authenticate the user unconditionally that the unique information is received from the second terminal, but sets a condition for the second terminal so that the second terminal satisfying the predetermined condition transmits the unique information In one case, the user can be authenticated. That is, when the second terminal transmits the unique information transmitted to the first terminal to the authentication system 20, the terminal detailed information of the second terminal does not satisfy the predetermined registration detailed information, The user can not be authenticated if the current position information of the user does not satisfy the predetermined registration position information.

As described above, a condition may be set for each of the first terminal and the second terminal, and in particular, the authentication system 20 may recommend one or more locations to set the registration location information of the second terminal. When the at least one of the recommended locations is selected, the selected location may be set as the registration location information. The recommended location may be at least one of the login request history of the first terminal and the unique information transmission history of the second terminal Can be determined accordingly.

Upon receiving the login request from the first terminal 11 after setting the authentication conditions according to the above description (S310), the authentication system 20 accesses the user account of the service server 30 by the first terminal 11 It is possible to determine whether or not the user is authorized to view / edit / download the content. That is, the authentication system 20 can authenticate the first terminal 11 (S320).

4, when the first terminal 11 senses to log in to the service server 30 (S321), the authentication system 20 generates unique information (S322) and transmits the unique information to the first terminal 11 (S323). At this time, if the target condition for transmitting the unique information is set, the authentication system 20 determines whether the first terminal 11 satisfies the above condition, and transmits the unique information to the first terminal 11 ). For example, if the MAC address of the first terminal 11 has a MAC address set as a condition, the authentication system 20 can transmit unique information to the first terminal 11. [

The unique information thus transmitted can be received from the second terminal 12. For example, when the unique information is displayed on the display unit of the first terminal 11, the second terminal 12 can transmit the unique information acquired and acquired to the authentication system 20. For example, when a barcode including unique information is displayed on the display unit of the first terminal 11, the second terminal 12 photographs and decodes the barcode to extract unique information, and transmits the unique information to an authentication system 20).

When the authentication system 20 receives the unique information from the second terminal 12, the authentication system 20 can also receive the current position information of the second terminal 12 (S324).

At this time, the authentication system 20 can determine whether or not the current location information of the second terminal 12 matches the registered location information (S325). If it is determined that the current location information does not match the registered location information, the authentication system 20 may not authenticate the first terminal 11 If it is determined that they match, the first terminal 11 can be authenticated (S326). The authentication system 20 may also consider the access network of the second terminal 12 so that only when the access network of the second terminal 12 is a network corresponding to the registration position information, Can be authenticated. If the access network of the second terminal 12 is not the network corresponding to the registration position information, the authentication system 20 can operate the predetermined security protocol.

The authentication system 20 may form a secure channel between the first terminal 11 and the service server 30 for communication between the first terminal 11 and the service server 30, The channel can be managed (S330).

As shown in FIG. 5, the authentication system 20 can transmit and receive a packet through a secure channel formed between the first terminal and the service server 30 (S331).

At this time, the authentication system 20 can detect whether the state of the first terminal is changed based on the header of the received packet (S332). For example, the authentication system 20 can check the current location information of the first terminal by analyzing the header of the packet, and determine whether the current location information of the first terminal matches the registered location information of the first terminal Can be determined.

In this manner, the authentication system 20 can decide to hold or terminate the secure channel according to the state of the first terminal (S333).

Therefore, for example, the authentication system 20 can terminate the secure channel with the first terminal if the current location information of the first terminal does not match the registration location information of the first terminal. Also, the authentication system 20 may store and store channel information related to the secure channel with the second terminal, and if the current location information of the second terminal does not match the registration location information of the second terminal, 1 < / RTI > terminal. If the authentication system 20 detects that at least one of the first terminal and the second terminal is connected to a network other than the predetermined network, the authentication system 20 may terminate the secure channel with the first terminal. In addition, the authentication system 20 can also operate a predetermined security protocol.

The authentication method according to the embodiment described with reference to Figs. 3 to 5 may also be implemented in the form of a recording medium including instructions executable by a computer such as a program module executed by a computer. Computer readable media can be any available media that can be accessed by a computer and includes both volatile and nonvolatile media, removable and non-removable media. In addition, the computer-readable medium can include both computer storage media and communication media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Communication media typically includes any information delivery media, including computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave, or other transport mechanism.

The authentication method according to an embodiment of the present invention may also be implemented as a computer program (or a computer program product) including instructions executable by a computer. A computer program includes programmable machine instructions that are processed by a processor and can be implemented in a high-level programming language, an object-oriented programming language, an assembly language, or a machine language . The computer program may also be recorded on a computer readable recording medium of a type (e.g., memory, hard disk, magnetic / optical medium or solid-state drive).

Therefore, the authentication method according to an embodiment of the present invention can be realized by the computer program as described above being executed by the computing device. The computing device may include a processor, a memory, a storage device, a high-speed interface connected to the memory and a high-speed expansion port, and a low-speed interface connected to the low-speed bus and the storage device. Each of these components is connected to each other using a variety of buses and can be mounted on a common motherboard or mounted in any other suitable manner.

Where the processor may process instructions within the computing device, such as to display graphical information to provide a graphical user interface (GUI) on an external input, output device, such as a display connected to a high speed interface And commands stored in memory or storage devices. As another example, multiple processors and / or multiple busses may be used with multiple memory and memory types as appropriate. The processor may also be implemented as a chipset comprised of chips comprising multiple independent analog and / or digital processors.

The memory also stores information within the computing device. In one example, the memory may comprise volatile memory units or a collection thereof. In another example, the memory may be comprised of non-volatile memory units or a collection thereof. The memory may also be another type of computer readable medium such as, for example, a magnetic or optical disk.

And the storage device can provide a large amount of storage space to the computing device. The storage device may be a computer readable medium or a configuration including such a medium and may include, for example, devices in a SAN (Storage Area Network) or other configurations, and may be a floppy disk device, a hard disk device, Or a tape device, flash memory, or other similar semiconductor memory device or device array.

It will be understood by those skilled in the art that the foregoing description of the present invention is for illustrative purposes only and that those of ordinary skill in the art can readily understand that various changes and modifications may be made without departing from the spirit or essential characteristics of the present invention. will be. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive. For example, each component described as a single entity may be distributed and implemented, and components described as being distributed may also be implemented in a combined form.

The scope of the present invention is defined by the appended claims rather than the detailed description and all changes or modifications derived from the meaning and scope of the claims and their equivalents are to be construed as being included within the scope of the present invention do.

11, 12: user terminal
20: Authentication system
210: construction construction government 220: unique information transmission unit
230: unique information generating unit 240:
250: channel management unit 260: security management unit
30: service server

Claims (28)

An authentication method for an authentication system for authenticating a user controlling a first terminal,
Providing unique information for authenticating the first terminal to the first terminal upon receiving a login request from the first terminal;
Receiving the unique information from the second terminal and receiving current location information of the second terminal together; And
And comparing the current location information and the registered location information of the second terminal to authenticate the first terminal,
After authenticating the first terminal,
Forming a secure channel for packet exchange with the first terminal; And
Receiving the current location information of the first terminal and terminating the secure channel with the first terminal if the current location information of the first terminal does not match the registered location information of the first terminal , Authentication method. The method according to claim 1,
Wherein the unique information is generated for each login request event of the first terminal and is a value dedicated to the user. The method according to claim 1,
Wherein the providing of the unique information to the first terminal comprises:
Determining whether to provide the unique information based on at least one of the user identification information received through the first terminal, the terminal detailed information of the first terminal, and the current location information of the first terminal; Way. The method according to claim 1,
Before providing the unique information to the first terminal,
And setting registration position information of the second terminal. 5. The method of claim 4,
Wherein the setting of the registration position information comprises:
Recommending one or more locations; And
And setting the selected location as registration location information of the second terminal if at least one of the recommended locations is selected,
Wherein the one or more locations are determined based on at least one of a login request history of the first terminal and a unique information transmission history of the second terminal. 5. The method of claim 4,
Wherein the setting of the registration position information comprises:
And determining the number of accesses to each of the plurality of pieces of registration position information when the plurality of pieces of registration position information is present,
Wherein authenticating the first terminal comprises:
And authenticating the first terminal only when receiving current position information from the second terminal below the determined number of accesses. The method according to claim 1,
Wherein authenticating the first terminal comprises:
Comparing the current location information and registration location information of the second terminal and authenticating the first terminal based on whether the access network of the second terminal is a network corresponding to the registration location information. Authentication method. 8. The method of claim 7,
Wherein authenticating the first terminal comprises:
And if the access network of the second terminal is not a network corresponding to the registration position information, operating the predetermined security protocol. delete The method according to claim 1,
After authenticating the first terminal,
Forming a secure channel for packet exchange with the first terminal; And
Further comprising terminating a secure channel with the first terminal based on a header of a packet received from the first terminal over the secure channel. The method according to claim 1,
After authenticating the first terminal,
Forming a secure channel for packet exchange with the first terminal;
Matching channel information on the secure channel with the second terminal and storing the channel information; And
And terminating the secure channel with the first terminal if the current location information of the second terminal does not match the registration location information of the second terminal. The method according to claim 1,
After authenticating the first terminal,
Forming a secure channel for packet exchange with the first terminal; And
And terminating a secure channel with the first terminal upon detecting that at least one of the first terminal and the second terminal is connected to a network other than the predetermined network. 13. The method of claim 12,
Further comprising the step of, after terminating the secure channel with the first terminal, operating a predefined security protocol. An authentication system for authenticating a user controlling a first terminal,
A unique information transmitter configured to provide unique information for authenticating the first terminal to the first terminal upon receiving a login request from the first terminal; And
A user authentication unit configured to receive the unique information from the second terminal and to receive the current location information of the second terminal together with the current location information and the registered location information of the second terminal to authenticate the first terminal, ; And
And a channel manager for forming a secure channel for packet exchange with the first terminal,
In addition,
And to terminate the secure channel with the first terminal if the current location information of the first terminal does not match the registration location information of the first terminal, system. 15. The method of claim 14,
Wherein the unique information is a value dedicated to the user for each login request event of the first terminal. 15. The method of claim 14,
In addition,
And determine whether to provide the unique information based on at least one of the user identification information received through the first terminal, the terminal detailed information of the first terminal, and the current location information of the first terminal. 15. The method of claim 14,
Further comprising a condition setting unit configured to set registration position information of the second terminal. 18. The method of claim 17,
The condition setting unit may further include:
And setting the selected location as registration location information of the second terminal if at least one of the recommended locations is selected,
Wherein the one or more locations are determined based on at least one of a login request history of the first terminal and a unique information transfer history of the second terminal. 18. The method of claim 17,
The condition setting unit may further include:
And to determine the number of accesses to each of the plurality of pieces of registration position information when there is a plurality of pieces of registration position information,
The user authentication unit may further include:
And to authenticate the first terminal only when receiving current position information from the second terminal below the determined number of accesses. 15. The method of claim 14,
The user authentication unit may further include:
And compares the current location information and the registered location information of the second terminal and authenticates the first terminal based on whether the access network of the second terminal is a network corresponding to the registered location information, . 21. The method of claim 20,
And a security management unit configured to operate a predetermined security protocol when the access network of the second terminal is not a network corresponding to the registration position information. delete 15. The method of claim 14,
Further comprising a channel manager for forming a secure channel for packet exchange with the first terminal,
In addition,
And terminate the secure channel with the first terminal based on a header of a packet received from the first terminal over the secure channel. 15. The method of claim 14,
Further comprising a channel manager for forming a secure channel for packet exchange with the first terminal,
In addition,
And stores the channel information related to the secure channel with the second terminal if the current location information of the second terminal does not coincide with the registered location information of the second terminal, And terminate the authentication. 15. The method of claim 14,
Further comprising a channel manager for forming a secure channel for packet exchange with the first terminal,
In addition,
And terminate the secure channel with the first terminal upon detecting that at least one of the first terminal and the second terminal is connected to a network other than the predetermined network. 26. The method of claim 25,
Further comprising a security manager configured to operate a predetermined security protocol after terminating a secure channel with the first terminal. A computer-readable recording medium on which a program for carrying out the method according to claim 1 is recorded. Coupled to the computing device,
Providing unique information for authenticating the first terminal to the first terminal upon receiving a login request from the first terminal;
Receiving the unique information from the second terminal and receiving current location information of the second terminal together;
Comparing the current location information and the registered location information of the second terminal to authenticate the first terminal;
Forming a secure channel for packet exchange with the first terminal; And
And terminating the secure channel with the first terminal if the current location information of the first terminal does not match the registered location information of the first terminal, A computer program stored on a recording medium.

Images