KR101701202B1 - Security authentication system and method using a plurality of paging code units - Google Patents

Abstract

The object of the present invention is to set a plurality of call code parts in a random order so as to enhance security authentication from malicious hackers, compare arranged security information data based on the order of the call code parts and inputted input information data, and authenticate it to enhance security function. According to the present invention, the plurality of call code parts is set in the random order. The security function is enhanced by comparing the arranged security information data based on the order of the calling code parts and the inputted input information data. Therefore, the possibility of remote authentication by simple propagation amplification can be basically blocked.

Description

A security authentication system and method using a plurality of call code units.

The present invention relates to a security authentication system and method using a plurality of paging code units, and more particularly, to a method for enabling stable security authentication by randomly setting the order of a plurality of paging code units and inputting an authentication key in a set order.

In recent years, security threats to various devices are increasing rapidly, and various solutions are being developed accordingly. Among the solutions, most of the security methods are software, but various problems are found due to their characteristics.

To solve these problems, a security method using hardware has been proposed. One of them is Trusted Platform Module (TPM).

Unlike the CPU processor, the Trusted Platform Module (TPM) provides a storage space that can store key values, passwords, digital certificates, etc., and at the same time provides an encryption engine. Each trust platform module is assigned its unique key, EK (Endorsement Key) and SRK (Storage Root Key), and is not allowed to go out.

However, when authentication is performed using a radio wave such as a smart key of a vehicle using a Trusted Platform Module (TPM), an authenticated driver using the characteristics of radio waves whose strength becomes weaker as the distance becomes longer It is confirmed whether or not the signal is transmitted. However, in a situation where the driver is not in the vicinity of the vehicle, the vehicle may be hijacked by a malicious hacker, and the same can be applied to various authentication methods using wireless.

Korean Patent Registration No. 10-0863644 (2008.10.08) Korean Patent Registration No. 10-0970552 (Jul. 2010)

SUMMARY OF THE INVENTION An object of the present invention is to provide a security information management system and a security information management method in which a plurality of call code units are set in a random order so as to enhance security authentication from malicious hackers, It is to strengthen the function.

In order to solve the above problems,

At least two or more calling code units 110 to which identifiable calling codes are assigned and security information data is stored. When detecting the authentication request signal, the security information data is compared with the received input information data, The security module 100 transmits the authentication request signal requesting authentication to the security module 100 within a set distance and inputs the input information data based on the order of the calling codes received from the security module 100, When the security module 100 detects an authentication request signal transmitted from the authentication request module 200, the security module 100 transmits an order of the output calling code, The authentication request module 200 transmits an authentication request signal, and when it detects the order of the calling codes transmitted from the security module 100, the input / And a second transmission / reception unit (280) for transmitting the power information data,

The security module 100 includes a security information storage unit 160 for classifying security information data of the paging code unit 110 according to call codes and storing the security information data, A sequence generation module 120 for generating and outputting a sequence of paging codes assigned to the paging code section 110 of the order generation module 120 according to a predetermined algorithm or at random, A security information enumerating unit 130 for calling up and listing the security information data of the security information storing unit 160 and a security information enumerating unit 130 for receiving the input information data from the first transmitting and receiving unit 180, And a security information verification module 140 for verifying whether the security information data matches the security information data listed in the security information storage module 160, Information data Receiving the input information data stored in the input information storage unit 260 on the basis of the order of the received calling codes, A security authentication system using a plurality of paging code units including an input information input unit 220

A security authentication method using a security authentication system using a plurality of paging code units,

An authentication request signal sending step (S100) for transmitting an authentication request signal for requesting authentication in the authentication request module (200) within a set distance; a step (S100) for sending an authentication request signal sent from the authentication request module A paging code sequence generation step (s200) for randomly generating and outputting a sequence of paging codes assigned to a plurality of paging code units (110), a step A calling code order sending step (s300) for sending out the calling code order within the set distance, a calling code unit (110) in the order of the calling codes outputted in the calling code order generating step (s200) The security information data listing step (S400) for sequentially listing the security information data, and the order of the paging codes transmitted in the paging code order transmitting step (s300) are received by the authentication requesting module (200) Based on An input information data input step (s500) for inputting input information data, an input information data transmitting step (s600) for sending input information data inputted in the input information data input step (s500) within a set distance, When the security module 100 receives the input information data transmitted in step s600, it compares the security information data listed in the security information data listing step (s300) with the received input information data, And a security authentication method using a plurality of paging code units including an information verification step (s700).

The present invention sets a plurality of paging code units in a random order and compares the security information data and the input information data that are listed based on the order of the paging code unit, thereby enhancing the security function, so that the remote authentication possibility by simple propagation amplification There is an effect to block the source.

1 is a block diagram according to an embodiment of the present invention.
2 is a flowchart illustrating an operation according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily carry out the present invention. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In order to clearly illustrate the present invention, parts not related to the description are omitted, and similar parts are denoted by like reference characters throughout the specification.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

The present invention relates to a security authentication system using a plurality of paging code units.

FIG. 1 is a block diagram of the present invention.

The present invention comprises a security module 100 and an authentication request module 200, and transmits and receives security information between the security module 100 and the authentication request module 200 to perform authentication.

The security module 100 includes at least two or more calling code units 110 to which identifiable calling codes are assigned and security information data is stored. When the security module 100 detects an authentication request signal, it compares the received security information data with the received input information data And verifies whether or not they match.

The calling code unit 110 of the present invention preferably uses a Trusted Platform Module (TPM), but may include everything capable of security authentication.

The TPM is a microcontroller that handles key security related functions such as hardware random number generation, key generation and management for data encryption / decryption, remote attestation, and secure storage.

In other words, mutual authentication is performed by transmitting and receiving the encrypted data, which is the security information data generated in the TPM, and the security information data is stored in the security information storage unit 160 mentioned below.

The security information storage unit 160 stores the security information data of the calling code unit 110 according to the calling code. Preferably, it stores security information data such as a key for encryption / decryption and encrypted data, and performs a secure storage function. Therefore, the data stored in the security information storage unit 160 is protected without being exposed to malicious users such as hacking. The security information storage unit 160 may exist inside or outside the call code unit 110. [

In the security information storage unit 160, the security information data of the paging code unit 110 is classified and stored according to the calling code.

A call code of "A", "B", and "C" is assigned to each of the three paging code units 110 and different security information data is stored in each paging code unit 110.

The calling code unit 110 to which the calling code "A" is assigned stores the security information data of "123" and the calling code unit 110 to which the calling code "B" And the calling code unit 110 to which the calling code "C" is assigned stores the security information data of "789 ".

If the security information data stored in the calling code unit 110 to which the calling code "A" is assigned is changed to "579 ", the security information stored in the security information storage unit 160, Security information data "579" changed in " 123 "

In addition, security information data corresponding to each calling code can be stored in various ways.

The security module 100 includes a sequence generation module 120, a security information enumeration section 130, a security information verification module 140, a first transmission / reception section 180, .

First, when the first transmission / reception unit 180 detects an authentication request signal transmitted from the authentication request module 200, the first transmission / reception unit 180 transmits the order of the output calling code and receives input information data from the authentication request module 200.

The first transmission / reception unit 180 may sense all signals transmitted from the outside. Preferably, when the authentication request signal transmitted from the authentication request module 200 described below is sensed, the security module 100 may secure The operation of performing the authentication is started.

Preferably, the first transmission / reception unit 180 further includes a detection sensor, detects an authentication request signal transmitted from the authentication request module 200, and if the frequencies match, the operation proceeds.

When the security module 100 starts the operation for security authentication, it transmits the order of the outputting paging codes. Upon receiving the order of the paging codes from the authentication request module 200 to generate and transmit the input information data, 100 receives the input information data. A detailed description thereof will be omitted herein.

Upon receipt of the authentication request signal from the first transmission / reception unit 180, the sequence generation module 120 randomly generates the order of the paging codes assigned to the plurality of paging code units 110 according to an algorithm or output do.

An example of a method of generating the order of the calling codes in the order generation module 120 is as follows.

When three calling code units 110 are configured, the calling codes assigned to each calling code unit 110 are assumed to be "A", "B", and "C".

It is also assumed that the security code data for each call code stores different security authentication data, and that "123" is stored in the call code "A", "456" is stored in the call code "B", and "789" do.

First, only three of the three calling codes are called due to the predetermined algorithm.

That is, the order of the calling codes "A" and "B" or calling codes "B", "A", calling codes "C". "A", calling codes "A", "C" have.

If the call code is generated in the order of "C" and "A", then the calling code "C" is called first and then "A" is called.

The security information data stored in the calling code unit 110 corresponding to the calling code "C" is "789", and the security information data stored in the calling code unit 110 corresponding to the calling code "A" 123 ". Therefore, the security information data in the security information enumerating section 130 listed below is listed as "789123 ".

As described above, the algorithm can be set by the user in advance and can be set by various methods. It is also possible to generate sequences of the calling code at random, in a similar manner.

Another embodiment of the sequence generation module 120 is as follows.

The security information data stored in the paging code unit 110 may store information such as identification information and a password in addition to numbers. Accordingly, the security information data may be stored for each calling code, and when the order generation module 120 generates the order of the calling codes, one or more of the stored security information data may be selected and output.

For example, it is also possible to input the composite security authentication data for simultaneously calling the identification information and the numerical value out of the security information data stored in the calling code unit 110 in the order of the calling codes "A " and" C ".

If the identification information of the calling code "A" is "80 ", the numerical value is" 123 ", the identification information of the calling code "C" Numeric value 'are inputted in the order of the calling code, the security information data listed in the security information listing section 130 may be listed as' 8012339789' as the combined security authentication data. Similarly, it goes without saying that the mutual authentication is approved only when the input information data to be received in the order of the calling codes in the authentication request module 200 is "8012339789 ".

The security information enumerating unit 130 calls and lists the security information data of the security information storing unit 160 in the order of the calling codes output from the order generating module 120. [

The order generation module 120 outputs the calling codes in the order of "C" and "A ", and the calling code output from the security information listing part 130 In the security information storage unit 160, the security information data stored in the calling code unit 110 in the order of "C" and "A " The security information storage unit 160 first calls the security information data "789" corresponding to the calling code "C" and then calls the security information data "123" corresponding to the calling code "A" "

Upon receipt of the input information data from the first transceiver 180, the security information verification module 140 compares the input information data with the security information data listed in the security information enumerating section 130 and verifies whether they match or not.

It is verified whether or not the security information data "789123" listed in the security information enumerating section 130 matches the input information data received from the authentication request module 200 to be described later.

If the input information data received from the authentication request module 200 is "789123 ", the authentication information is approved because the input information data matches the listed security information data, and the access right is obtained. However, if the received input information data is a value other than "789123 ", access is blocked because the authentication is not approved.

The security module 100 may further include a warning unit. If the input information data does not match the security information data as a result of the security information verification module 140, You may be informed of the deviation from the condition.

The authentication request module 200 transmits an authentication request signal for requesting authentication to the security module 100 within a set distance and inputs input information data based on the order of the calling codes received from the security module 100, do.

The authentication request module 200 includes a second transmission / reception unit 280, an input information storage unit 260, and a security information input unit 220.

The second transmission / reception unit 280 transmits an authentication request signal, and transmits the input information data when it detects the order of the calling codes transmitted from the security module 100.

The second transmission / reception unit 280 transmits an authentication request signal to the outside within the set distance. The security module 100 must be within the set distance to receive the transmitted authentication request signal. For example, when the set distance is set within 3 m, the distance between the security module 100 and the authentication request module 200 must be within 3 m Information such as a signal and data can be received. The set distance can be arbitrarily set by the user, and can be adjusted according to the distance that a normal signal can be transmitted and received.

The input information storage unit 260 stores input information data corresponding to the security information data of the security information storage unit 160.

The security information storage unit 160 of the security module 100 classifies and stores the security information data of the calling code unit 110 for each calling code. That is, as in the embodiment of the security information storage unit 160, the input information data of the calling code "A" as the security information data classified and stored for each calling code is "123" Quot; 456 ", and the input information data of the calling code "C" is stored as "789 ".

Also, when the content stored in the security information storage unit 160 is changed, the content stored in the input information storage unit 260 is changed corresponding to the security information storage unit 160. [

Upon receiving the order of the calling codes from the second transmitting / receiving unit 280, the input information input unit 220 calls and inputs the input information data stored in the input information storing unit 260 based on the order of the received calling codes .

When the order of the received calling codes is "C" and "A", the input information data stored in the input information storage unit 260 are input in the order of calling codes "C" and "A", respectively.

That is, since the value corresponding to the security information storage unit 160 of the security module 100 is stored in the input information storage unit 260, the calling code "A "Quot; 123 "is stored in the calling code" C ", and the input information data "789"

Therefore, when the calling code is called in the order of "C" and "A", and the input information data corresponding to each calling code is inputted, the value "789123" is inputted.

The input information data "789123" input as described above is transmitted through the second transceiver 280 and received by the security module 100, so that the input information data received by the security information verification module 140 and the security information data coincide with each other .

The number of the calling code units 110 is two or more and the number of the calling code units 110 increases as the number of the calling code units 110 increases, The number of procedures in the order of the number of generated in the case of malicious users is difficult to authenticate the security function is enhanced.

In addition, the smart key of a car is as follows.

The car carries out the authentication between the car and the smart key by the radio propagation method using the characteristic of the radio wave whose strength of the signal is weak. The smart key is structured to operate the car by sensing a low-power signal such as 'radio frequency' transmitted from the car.

That is, if the wireless amplifier is used, the strength of the signal that the smart key held by the driver located at the remote location requests for authentication is amplified, and the effective distance at which the smart key is recognized is also amplified. In this case, a malicious user can check the authentication value in the middle of transferring the authentication values, and the method of opening the door of the vehicle without a button when the distance between the car and the smart key is within the set distance includes a mutual signal It is possible to perform automatic authentication and to steal the vehicle.

This is also applied to various authentication systems using radio waves and the like, and is hacked by a malicious user.

Accordingly, in order to solve the above problems, the present invention increases the number of the calling code units 110 as the authentication means and randomly calls the calling code unit 110 to compare the stored security information data with the input information data , The effect of remote authentication by simple propagation amplification is essentially prevented.

Hereinafter, the operation of the security authentication system using a plurality of paging code units according to the present invention will be described.

2 is a flowchart showing the operation of the security authentication system using a plurality of paging code units according to the present invention.

The authentication request signal sending step s100 sends an authentication request signal for requesting authentication in the authentication request module 200 within a set distance.

Since the transmission of the authentication request signal within the set distance has been described above, the description thereof will be omitted. Also, the setting distance described below can be set by the user in the same manner as 3m, 4m, and the like.

When the security module 100 receives the authentication request signal transmitted from the authentication request module 200, the calling code order generating step s200 randomly sets the order of the calling codes assigned to the plurality of calling code units 110 And outputs it.

The method of randomly generating the order of the calling codes in the calling code sequence generation step (s200) is similar to the OTP (One Time Password) method, in which a one-time password of a random number generated randomly within the range of the calling code is used To authenticate the user. Therefore, each time there is a call code sequence generation request, the order of the calling code is generated by one-time use and output.

After outputting the output order of the calling codes, the following steps are performed in the order of transmitting the calling code sequence (s300) and listing the security information data (s400).

The calling code order transmitting step (s300) transmits the order of the calling codes outputted in the calling code order generating step (s200) within the set distance.

The security information data listing step (s400) calls the paging code unit (110) in the order of the paging codes output in the paging code order generating step (s200) and transmits the security information data stored in the paging code unit .

The input information data input step (s500) , when the authentication request module (200) receives the order of the calling codes transmitted in the calling code order transmitting step (s300), inputs the input information data based on the order of the received calling codes do.

The input information data transmitting step (s600) transmits the input information data input in the input information data input step (s500) within the set distance.

When the security module 100 receives the input information data transmitted in the input information data transmitting step s600, the security information verifying step s700 includes the steps of listing the security information data listed in the security information data listing step S300, And compares input information data and verifies whether or not they match.

In the security information verification step (step S700), if it is determined that the authentication is successful, the authentication is permitted and the access is permitted. If the security is not matched, the access is blocked and an alarm sound or the like may be generated.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but, on the contrary, Various modifications and variations may be made without departing from the scope of the appended claims.

100 security modules
110 calling code section
120 Order Generation Module
130 Security information listing
140 Security Information Validation Module
160 security information storage unit
180 first transmission /
200 certification request module
220 Input information input section
260 Input information storage unit
280 Second transmission /

Claims (3)

At least two or more calling code units 110 to which identifiable calling codes are assigned and security information data is stored. When detecting the authentication request signal, the security information data is compared with the received input information data, A security module 100;
An authentication request module (200) for transmitting an authentication request signal for requesting authentication to the security module (100) within a set distance, inputting input information data based on the order of the calling codes received from the security module (100) ≪ / RTI >
The security module 100
And a first transmission / reception unit (180) for transmitting the order of the outputted calling codes upon receiving an authentication request signal transmitted from the authentication request module (200) and receiving input information data from the authentication request module (200)
The authentication request module (200)
And a second transmission / reception unit (280) for transmitting the authentication request signal and transmitting the inputted input information data when detecting the order of the calling code transmitted from the security module (100)

The security module 100
A security information storage unit 160 for classifying and storing the security information data of the calling code unit 110 by calling codes;
Upon receiving the authentication request signal from the first transmission / reception unit 180, the sequence generation module 120 generates a sequence of paging codes assigned to the plurality of paging code units 110 according to a predetermined algorithm or randomly, ;
A security information enumerating unit 130 for calling up and listing security information data of the security information storing unit 160 in the order of the calling codes output from the order generating module 120;
A security information verification module 140 for comparing the input information data with the security information data listed in the security information enumerating unit 130 and verifying whether the input information data is matched or not when receiving the input information data from the first transmitting and receiving unit 180; Including,

The authentication request module (200)
An input information storage unit 260 for storing input information data corresponding to security information data of the security information storage unit 160;
And an input information input unit 220 for receiving input information data stored in the input information storage unit 260 based on the order of the received calling codes when the second transmitting and receiving unit 280 receives the order of the calling codes And a plurality of call code units. At least two or more calling code units 110 to which identifiable calling codes are assigned and security information data is stored. When detecting the authentication request signal, the security information data is compared with the received input information data, An authentication request signal for requesting authentication to the security module 100 within a set distance and inputting input information data based on the order of the calling codes received from the security module 100 The security module 100 transmits an order of the output calling code when the authentication request signal transmitted from the authentication request module 200 is received, (180) for receiving input information data from the security module (100), and the authentication request module (200) transmits an authentication request signal and detects the order of a paging code transmitted from the security module In the security authentication method using a security authentication system using a plurality of call code portion which includes the surface for transmitting the entered input information data, a second transceiver 280,

An authentication request signal sending step (S100) for sending an authentication request signal for requesting authentication in the authentication request module (200) within a set distance;
A call code sequence generation step of randomly generating and outputting a sequence of paging codes assigned to the plurality of paging code units (110) when the security module (100) receives the authentication request signal transmitted from the authentication request module (200) (s200);
A calling code order transmitting step (s300) for transmitting the order of the calling codes output in the calling code order generating step (s200) within a set distance;
A security information data listing step of listing the security information data stored in the call code part 110 in order by calling the calling code part 110 in the order of the calling codes outputted in the calling code order generating step s200 s400);
An input information data input step (s500) for inputting input information data based on the order of the received calling codes when the authentication request module (200) receives the order of the calling codes transmitted in the calling code order transmitting step (s300) ;
An input information data transmitting step (s600) for transmitting the input information data input in the input information data input step (s500) within a set distance;
When the security module 100 receives the input information data transmitted in the input information data sending step s600, it compares the security information data listed in the security information data listing step S400 with the received input information data (S700);
And a plurality of call code units including the plurality of call code units. delete

Images