KR101758158B1 - System and method for authentication using ring backtone - Google Patents

Abstract

An authentication system using RBT and a method thereof are disclosed. The authentication system using the ring back tone may include: a receiving module for receiving an authentication call made by the user through the terminal to the authentication system for authentication of the service; when receiving the authentication call, a ring back tone module for transmitting a ring back tone to the mobile terminal, and a control module for judging the validity of the authentication call for authentication of the service and for successfully authenticating the service if the authentication call is determined to be valid And the RBT module transmits the RBT tone including the service information corresponding to the service or guidance information to be guided to the user for authentication to the terminal.

Description

[0001] The present invention relates to an authentication system using a ring back tone,

The present invention relates to an authentication system and a method for allowing a user to make a call to an authentication system to authenticate that a person requesting a service for various services (e.g., payment, login, financial transaction, item transaction, etc.) is a legitimate user . More particularly, the present invention relates to a method and apparatus for transmitting a service request to a user during a call connection wait for an authentication call, while allowing a user to make an authentication call, that is, And more particularly, to a method and a system capable of performing authentication without reducing a call connection time or reducing a call connection time.

A method of performing authentication via telephone in various fields is known.

For example, after a call is made to the user's mobile terminal through ARS or the like, authentication can be performed by receiving a preset password in a state where a call is connected, receiving a disposable password, and receiving a disposable password again.

In the case of authentication using a telephone call, since a call is made to a mobile terminal of a legitimate user requesting service, even if an attacker requests a service, the authentication can not be successful unless the mobile terminal is owned by a legitimate user.

Accordingly, in the case of the authentication by telephone, it is not easy to take the telephone call, as compared with an authentication method (for example, small payment, etc.) in which a one-time password is transmitted through a short message such as SMS or the like and the transmitted password is input via the Internet or the like , And is used as a relatively secure authentication method.

However, since an environment in which a user can arbitrarily install software on a mobile terminal is emerging, the possibility of taking over a telephone call (for example, call forwarding to an attacker's phone) is becoming more difficult, though not easy.

Particularly, the called party can grasp the telephone number of the calling terminal, but in the telephone environment where the calling party can not confirm the telephone number of the called party (for example, in Korea, the calling party can not confirm the telephone number of the called party) It is impossible for the calling side to recognize it, so that the possibility of authentication by the attacker can be increased even in the case of the authentication through the relatively secure telephone call. And even if the possibility of authentication by such an attacker goes through the process of inputting a password through a connected telephone call, the leakage of the password can be done in various ways and still be high.

Therefore, in a case where a user to be authenticated requires an authentication call to be made on the side of the authentication system, arbitrary manipulation of the origination number is difficult, and more secure authentication can be performed. However, in such a case, if the user has to pay for the call connection, or if the authentication system side is burdened by the receiver, the authentication system must bear the cost for the call connection, .

Korean Patent No. 10-0818793 "Auto-call system using telephone and financial transaction method using the system"

SUMMARY OF THE INVENTION The present invention has been made in an effort to solve such a problem, and it is an object of the present invention to provide a method and system for providing a normal authentication function even if a party user takes a call or an authentication call, And to provide a method and system that can perform the same.

Especially, in order to authenticate through an authentication call, an increase in cost for a call connection may be a problem. To solve this problem, it is necessary to transmit and / or receive information required for authentication after a call connection, That is, it is a system and a method that can reduce the cost required for authentication by transmitting and / or receiving at least a part of information necessary for authentication during a call connection wait.

Even if the authentication time after the call connection is shortened by using the call connection wait time in order to solve the difficult problem of the non-repudiation because it is difficult to provide objective proof of the call record when the call is terminated without a call connection, (Even if the authentication can be completed using the information transmitted / received during the call connection), and ending the call after making the call connection, and a method thereof. Further, the present invention provides a system and method that can record a voice of a user after a call connection, thereby providing a higher anti-repudiation effect.

According to an aspect of the present invention, an authentication system using a ring back tone for solving the above-mentioned technical problems includes a receiving module for receiving an authentication call made by the user through the terminal to the authentication system, A ring back tone module for transmitting a ring back tone to the terminal while waiting for a call connection and a legitimacy of the authentication call for authenticating the service when the call is received, Wherein the RBT module transmits the RBT tone including the service information corresponding to the service or the guide information to be guided to the user for authentication to the terminal send.

The control module may identify the originating phone number of the authentication call and may determine that the authentication call is legitimate if the identified outgoing phone number corresponds to the service or the user.

Wherein the authentication system using the ring back tone further comprises an authentication signal confirmation module for confirming an authentication signal input from the terminal during the call connection wait time and the control module checks the validity of the authentication signal confirmed by the authentication signal confirmation module It is determined that the authentication call is legitimate.

The control module may determine that the authentication call is legitimate by connecting the call of the authentication call and terminating the call after the call is connected.

After the call is connected, the control module may transmit a predetermined announcement voice to the terminal, and may receive and record the voice of the user corresponding to the announcement voice.

Wherein the authentication system using the ring back tone further comprises an authentication signal confirmation module for confirming an authentication signal input from the terminal after the call of the authentication call is connected by the control module, The validity of the authentication signal confirmed by the module can not be verified and the authentication call can be judged to be legitimate.

According to another aspect of the present invention, there is provided an authentication system for authenticating a user requesting a service in a service system, the system including a receiving module for receiving an authentication call to the authentication system through the terminal, An authentication signal confirmation module for confirming an authentication signal input from the terminal during a call connection wait when the authentication call is received, and a validity judgment unit for determining the validity of the authentication call for authentication of the service, The control module determines that the authentication call is valid until the validity of the authentication signal confirmed by the authentication signal confirmation module is verified.

The control module may connect the call of the authentication call after the validity of the authentication signal is confirmed, and end the call after the call is connected.

According to an aspect of the present invention, there is provided an authentication method using an authentication system for authenticating a user who requests a service in a predetermined service system, the authentication system comprising: Receiving a call back request message including a service information corresponding to the service or guidance information to be guided to a user for authentication to the terminal during a call connection wait when the authentication call is received; ), And when the authentication system determines that the authentication call is legitimate, the authentication system successfully processes the authentication for the service.

Wherein the authentication method using the ring back tone comprises the steps of: checking the authentication signal input from the terminal during the call connection wait time; and determining whether the authentication call is legitimate until the validity of the confirmed authentication signal is confirmed Step < / RTI >

According to another aspect of the present invention, there is provided an authentication method using an authentication system for authenticating a user who requests a service in a predetermined service system, the method comprising: receiving, by the authentication system, Receiving an authentication call; checking, when the authentication system receives the authentication call, an authentication signal input from the terminal during a call connection wait; and determining the validity of the authentication signal, And if the signal is judged to be legitimate, successfully authenticating the service.

In order to solve the technical problem of the present invention, a program recorded on a recording medium for performing an authentication method using the authentication call installed in a data processing apparatus may be provided.

According to the technical idea of the present invention, authentication can be successful only when a party user calls the authentication system, so that it is safe to take out a telephone call, and the user can make a direct telephone call, thereby preventing non-repudiation.

In addition, since it is possible to send and receive information (for example, service information and / or an authentication signal) required for authentication during a call connection wait, authentication can be performed without a call connection, or the time can be reduced even if a call connection is made .

In addition, it is possible to provide different ring back tones for each user who performs authentication, and when receiving an authentication signal during a call connection wait time, the authentication result of the authentication signal can also be provided to the user as a ring back tone.

In addition, even when a call connection is not required, it is possible to prevent a non-repudiation by terminating a call after making a call connection. If the user's voice is recorded after a call connection, the effect of the non- have.

Also, in order to make an authentication call, an authentication request call may be transmitted to a user's terminal. In this case, authentication through a password (for example, a preset password or a disposable password) through at least one of an authentication request call or an authentication call So that high security can be provided.

BRIEF DESCRIPTION OF THE DRAWINGS A brief description of each drawing is provided to more fully understand the drawings recited in the description of the invention.
FIG. 1 is a diagram illustrating a schematic configuration of an authentication system using a ring back tone according to an embodiment of the present invention. Referring to FIG.
2 to 4 are views schematically showing an authentication method using a ring back tone according to an embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS The present invention is capable of various modifications and various embodiments, and specific embodiments are illustrated in the drawings and described in detail in the detailed description. It is to be understood, however, that the invention is not to be limited to the specific embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, the present invention will be described in detail with reference to the accompanying drawings.

The terms first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise.

In this specification, the terms "comprises" or "having" and the like refer to the presence of stated features, integers, steps, operations, elements, components, or combinations thereof, But do not preclude the presence or addition of features, numbers, steps, operations, components, parts, or combinations thereof.

Also, in this specification, when any one element 'transmits' data to another element, the element may transmit the data directly to the other element, or may be transmitted through at least one other element And may transmit the data to the other component. Conversely, when one element 'directly transmits' data to another element, it means that the data is transmitted to the other element without passing through another element in the element.

Hereinafter, the present invention will be described in detail with reference to the embodiments of the present invention with reference to the accompanying drawings. Like reference symbols in the drawings denote like elements.

FIG. 1 is a diagram illustrating a schematic configuration of an authentication system using a ring back tone according to an embodiment of the present invention. Referring to FIG.

Referring to FIG. 1, in order to realize the technical idea of the present invention, an authentication system using an RBT (hereinafter referred to as an authentication system) 100 may be provided.

The authentication system 100 may include a control module 110, a receiving module 120, and a ring back tone module 130. The authentication system 100 may further include an authentication signal confirmation module 140 and / or a DB 150.

In accordance with an embodiment of the present invention, some of the above-described components may not necessarily correspond to components that are essential to the implementation of the present invention, and in accordance with an embodiment, But may include more components.

The authentication system 100 may perform authentication according to the technical idea of the present invention while performing communication with a predetermined service system 200. In some implementations, the authentication system 100 may be included in the service system 200. That is, the service system 200 may perform the technical idea of the authentication system 100 according to the technical idea of the present invention.

The service system 200 may be, for example, a variety of web servers that require login, a financial institution system that provides financial transactions, a game system that provides game services, a service for inquiring information and / It may be the system of the public agency that provides. Or a system for providing a service that requires settlement on-line, such as a predetermined open market or an online market. In this case, the authentication system 100 may be a system for authenticating a payment when a user wishes to make a payment. In any case, the service system 200 may be a system that provides services requiring user authentication.

A user can request a predetermined service to the service system 200 through another mobile terminal 400 or another terminal 300 which is separate from the mobile terminal 400. [ Then, the service system 200 communicates with the authentication system 100 to implement the technical idea of the present invention. In the present specification, a case where a user transmits a certification call to the authentication system 100 is a user's mobile terminal 400, but in order to implement the technical idea of the present invention, There is no need to make an authentication call using However, in the case where the technical idea of the present invention is implemented so that the authentication is successful by making an authentication call through the mobile terminal 400 for authentication, the risk of arbitrary manipulation of the origination number is lowered and a large number of users It can be used at any time, but it is dependent on a specific user, so that the strength of authentication can be increased. Therefore, although the present invention will be described mainly on the case where an authentication call is made to the mobile terminal 400, the scope of rights of the present invention is not limited thereto.

For example, a user can request a service through the mobile terminal 400 or the other terminal 300. The service may include not only payment, financial transaction, and item transaction, but also all kinds of services that need authentication (authentication) to be performed to provide the service. According to an example, the authentication itself may be a service requested by a user, and in such a case, a separate service system 200 may not be provided.

In any case, when the service is requested, the service system 200 may request the authentication system 100 to authenticate the user requesting the service. For example, the service system 200 may load a service page or service UI provided by the authentication system 100 to a service request terminal (e.g., 300, 400). Or the service system 200 may simply transmit user information (e.g., a phone number of the mobile terminal, user identification information, etc.) input from the service request terminals 300 and 400 to the authentication system 100, And the authentication system 100 may perform authentication using the user information. In some implementations, the user information may be stored in the service system 200 in advance. For example, the user may disclose to the service system 200 who he / she is, such as a login, and may request authentication of the user using pre-registered user information when requesting a specific service. Of course, the authentication system 100 may directly receive user information from the service request terminal (e.g., 300, 400).

According to the technical idea of the present invention, the authentication system 100 can notify a service requester (hereinafter, referred to as a user) of a telephone number of an authentication call, that is, a call to be made by the user for authentication (hereinafter referred to as an authentication call number) . So that the user can make an authentication call to the telephone number. Of course, depending on an implementation, the service system 200 may notify the authentication call number.

According to an example, the authentication call number may be notified to the service requester through the service system 200 or a predetermined page or UI provided by the authentication system 100. That is, the user can confirm the authentication call number through the service request terminal (e.g., 300, 400). Then, an authentication call can be made with the confirmed authentication call number.

According to another embodiment, the authentication system 100 may place a call to the user's mobile terminal 400. As described above, the authentication system 100 calls a telephone call made by a legitimate user's mobile terminal as an authentication request call. When the authentication request call is received by the user's mobile terminal 400, the user can check the originating number of the authentication request call, that is, the authentication call number.

Hereinafter, the case where the authentication system 100 transmits an authentication request call will be described below for convenience of explanation. However, even if there is no authentication request call as described above, the user can authenticate with the authentication call number corresponding to the authentication system 100 Authentication can be successful if the call is received.

The identification information (e.g., telephone number) of the mobile terminal 400 may be previously stored in the service system 200 or the authentication system 100 in advance. According to an embodiment, the user may input identification information of his / her mobile terminal 400 to the service system 200 or the authentication system 100. A predetermined UI for inputting the identification information may be provided to the service system 200 or a service request terminal (e.g., 300, 400) requesting the service by the authentication system 100. [

Even if a call connection is not established, the authentication request call may be handled as a successful authentication request call if a ringing signal is transmitted only to the mobile terminal 400. For example, when the call is connected to the mobile terminal 400, the authentication system 100 may disconnect the call before the call connection is established (i.e., before the user receives the call). If the authentication request call is successful, the process can proceed to the next step for authentication according to the technical idea of the present invention. Of course, even a call connection may be handled as a successful authentication request call. That is, if the call connection is not established, the authentication request call is regarded as a failure and the authentication request call may be performed again after a predetermined time, or the authentication may be judged to have failed.

On the other hand, if the authentication request call is successful, the user can call the authentication system 100 to the mobile terminal 400. That is, the telephone number assigned to the authentication system 100 can be dialed.

In various manners, the authentication system 100 may inform the user of the number to which the authentication call should be made to the user. For example, the calling number of the authentication system 100 may be the calling number of the authentication call through the authentication request call. Or the called terminal of the authentication call to the other terminal 300. Or inform the messaging number of the authentication system 100 to the mobile terminal 400 through messaging.

The user can recognize the called party number of the authentication call to his / her mobile terminal 400 and then send the authentication call through the mobile terminal 400. [

In an environment where the origination number can not be manipulated politically or technically, even if an attacker hijacks a call of an authentication request call with his / her terminal, the attack can not succeed because the authentication call can not be made to the mobile terminal 400 of the party user It is effective. When a user makes a call to a mobile terminal, that is, a mobile phone, the user can not arbitrarily manipulate the identification information (e.g., caller ID) of the mobile phone, thereby preventing forgery.

When the user sends an authentication call to the authentication system 100 with the mobile terminal 400, the ARS system included in the authentication system 100 can be called. The ARS system then recognizes the call forwarding of the authentication call and can transmit a ring back tone to the mobile terminal 400. [ Transmitting the ring back tone to the mobile terminal 400 may include transmitting the ring back tone to the transmitting side repeater of the mobile terminal 400. [ In general, the ring back tone may be information transmitted from the receiving side for a predetermined time (e.g., 45 seconds to 55 seconds) and may be reproduced in the calling terminal, i.e., the mobile terminal 400. That is, the receiving system (i.e., the authentication system 100) can transmit the desired information to the user without making a call connection via the ring back tone. In addition, a predetermined signal, for example, an authentication signal may be received from the mobile terminal 400 during a call connection wait. For example, when a user selects and inputs a predetermined keypad through the originating terminal, i.e., the mobile terminal 400, even if the call connection is not established, a DTMF (Dual Tone Multi Frequency) (100). ≪ / RTI > In addition, the authentication system 100 confirms the validity of the authentication signal received during the call connection wait, and then transmits the confirmation result (for example, whether the password is matched or the authentication using the authentication call is successful) To the mobile terminal (400). Therefore, the authentication system 100 can not only receive the information required for authentication, but also can feedback the user to the result of the determination of the legitimacy of the received information even when the call connection is not established.

Therefore, according to the technical idea of the present invention, the authentication system 100 transmits a authentication call to the authentication system 100 (the authentication system 100) when the user sends an authentication call to the mobile terminal 400, (For example, an IVR (Interactive Voice Response) server) connected to the authentication system 100 or the authentication system 100 is connected to the authentication system 100. When the authentication system 100 receives a call of the authentication call, It is possible to cause the authentication to be terminated within a short period of time even if a call connection of an authentication call is not made or a call connection is made by transmitting at least a part of information or receiving at least a part of information necessary for authentication.

One example of the information to be transmitted to the user for authentication, that is, the service information, may include payment information (for example, payment amount, payment object, site to be paid, etc.) when the service is payment. Depending on the type of service, the information to be transmitted to the user's mobile terminal 400 through the call connection tone may vary during the call connection wait. For example, in the case of authentication for login, information about a login target (site to be logged in) may be included in the service information. For example, in the case of an online financial transaction, the kind of a financial transaction, a financial transaction amount, and the like may be included in the service information. In any case, information capable of identifying the service to be authenticated through the RBT may be included in the RBT. Therefore, after the call connection is established, the call connection time can be shorter than when the information is transmitted to the user. Of course, the RBT may include not only service information for identifying a service to be authenticated, but also guide information for guiding an action to be performed by the user for authentication. Such guide information is also included in the ring back tone, so that the time can be shortened even if the call connection is not established or the call connection is established. As will be described later, the guide information may include a disposable password.

Meanwhile, the authentication system 100 may receive information necessary for authentication from the mobile terminal 400 during a call connection wait time. The information may include, for example, an authentication signal (e.g., (E.g., a user password or a disposable password registered in advance in advance). When the user password is used for authentication, the user inputs a password to the mobile terminal 400 during the call connection wait time, the DTMF corresponding to the inputted password is transmitted to the authentication system 100, and the authentication system 100 Authentication can be performed while the call connection is waiting. When the one-time password is used for authentication, the one-time password is transmitted to the mobile terminal 400 by including the one-time password in the RBT, and it is confirmed whether a DTMF tone corresponding to the transmitted one- (100) can perform authentication.

In addition, the authentication system 100 may determine the validity of the received authentication signal, and may transmit the determination result adaptively to the mobile terminal 400 as a ringback tone during a call connection wait.

As a result, according to the technical idea of the present invention, not only can a user send an authentication call, but also can transmit information necessary for authentication through a ringback tone of an authentication call, and also receives information (for example, an authentication signal) You may. Further, it is also possible to judge the legitimacy of the received information, and to feedback the result to the user during the call connection wait. Therefore, it is possible to authenticate a user who requests a service even if a call connection is not made, thereby reducing or eliminating the communication cost due to the call connection.

However, depending on the implementation, it may be desirable to make a call connection even though the authentication may be completed during the call connection wait. This is because, if the call connection is not established, the record of the user making the authentication call may not be left on the third party (that is, the communication company system), and thus the non-repudiation prevention may be weakened.

Therefore, according to the technical idea of the present invention, the authentication system 100 transmits service information, guidance information necessary for authentication, and / or disposable password during waiting for a call connection, and even when receiving an authentication signal during a call connection wait, The call may be terminated. According to an implementation example, information (for example, service information, guidance information, and / or disposable password, etc.) necessary for authentication may be transmitted during a call connection wait, and an authentication signal may be received after a call connection. Alternatively, after the call connection is made, the user's voice may be recorded. Since the voice of the user is an element for enhancing the non-repudiation prevention, the voice of the user may be recorded.

In any case, according to the technical idea of the present invention, according to the technical idea of the present invention, it is possible to perform all or a part of the processes required for authentication during a call connection wait and to terminate a call immediately after a call connection, It has the effect of saving strong but strong authentication.

Needless to say, the process required for authentication may vary according to the implementation. For example, a process necessary for authentication includes transmission of service information, which is information on a service to be authenticated, guidance information for guiding the authentication process or inputting an authentication signal (the guide information may include a disposable password) Reception of a signal, voice recording of a user, and the like. Among these processes, voice recording can be performed after the call connection, and the remaining processes can be performed even during the call connection waiting. Therefore, all or some of the processes that can be performed during the call connection wait can be performed during the call connection wait, and the remaining processes can be performed after the call connection.

Of course, in the case where a voice recording is not included in the process required for authentication, all the processes may be performed during a call connection wait. In this case, the authentication may be completed even if a call connection is not established. However, as described above, when a process necessary for authentication is set so that a call connection is performed for enhancing non-repudiation, a partial process to be performed before or after a call connection can be variously selected. In this case, however, it is preferable that at least part of the process is performed during the call connection wait.

The authentication system 100 includes a control module 110, a reception module 120, a ring back tone module 130, an authentication signal confirmation module 140, and / or a DB 150 ).

The authentication system 100 may include hardware resources and / or software necessary to implement the technical idea of the present invention, and does not necessarily mean a single physical component or a single device . That is, the authentication system 100 may mean a logical combination of hardware and / or software provided to implement the technical idea of the present invention. If necessary, the authentication system 100 may be installed in a separate apparatus to perform respective functions And may be embodied as a set of logical structures for realizing the technical idea of the present invention. In addition, the authentication system 100 may mean a set of configurations separately implemented for each function or role for implementing the technical idea of the present invention. For example, the control module 110, the receiving module 120, the ring back tone module 130, the authentication signal checking module 140, and / or the DB 150 may be located in different physical devices , Or may be located in the same physical device. Also, according to an embodiment, each module such as the control module 110, the receiving module 120, the RBT module 130, the authentication signal checking module 140, and / or the DB 150 may be different physical Configurations located in different devices and located in different physical devices may be organically coupled to each other to realize functions performed by the respective modules.

In this specification, a module may mean a functional and structural combination of hardware for carrying out the technical idea of the present invention and software for driving the hardware. For example, the module may refer to a logical unit of a predetermined code and a hardware resource for executing the predetermined code, and it does not necessarily mean a physically connected code or a kind of hardware But can be easily deduced to the average expert in the field of the present invention.

The control module 110 may be configured to communicate with other components included in the authentication system 100 such as the receiving module 120, the ring back tone module 130, the authentication signal checking module 140, and / Or the like) and / or resources.

The receiving module 120 may receive an authentication call made by the user via the mobile terminal 400. The receiving module 120 may be implemented as part of an ARS system (e.g., an IVR server or the like), or may be implemented to control the ARS system.

In order for a user to make an authentication call, the user must know the called number of the authentication call. To this end, the authentication system 100 may send an authentication request call to the mobile terminal 400 of the user. In this case, it is needless to say that the authentication system 100 may further include a predetermined sending module (not shown) for sending an authentication request call. Also, the called number of the authentication call may be sent to the service request terminal (e.g., 300, 400) via the service system 200, or may be notified to the user in messaging or other various ways.

When the authentication call is received through the reception module 120, the RBT module 130 may transmit a ring back tone to the terminal during a call connection wait. The ring back tone module 130 may transmit different types of ring back tones to the mobile terminal 400 according to an authentication call, that is, according to a user. To this end, the RBT module 130 confirms the calling number of the authentication call and confirms information about the service to be authenticated or information about the user through the service system 200 based on the confirmed calling number It is possible. For example, when the service requested by the service request terminal (for example, 300 or 400) is a payment for a predetermined commodity or service, the RBT module 130, through communication with the service system 200, (For example, a payment amount, a payment target, a site to be paid (i.e., information on the service system), and the like). Then, a ring back tone including the service information may be generated and transmitted to the mobile terminal 400. The manner in which the RBT module 130 generates the RBT tone may vary. According to an example, the RBT module 130 combines predefined template voice information with service information corresponding to the authentication call, generates a RBT to be transmitted to the mobile terminal 400, Lt; / RTI > The average expert in the technical field of the present invention can easily infer that it is possible to generate ring back tones in various other ways as well.

Also, the RBT module 130 may transmit various kinds of guide information (e.g., guidance information for inputting an authentication signal or guidance information for calling a predetermined voice during a call connection wait, or a call connection) It may be included in the connection tone and transmitted to the mobile terminal 400. As a matter of course, even if the guide information is included in the ring back tone, the time after the call connection can be shortened compared to the case where authentication is performed after the guide information is transmitted to the mobile terminal 400 after the call connection is established .

The control module 110 determines the validity of the authentication call to authenticate the service requested by the service request terminal (e.g., 300, 400), and when the authentication call determines that the authentication call is legitimate, can do. The control module 110 transmits an authentication success signal to the service system 200 in order to successfully process the authentication for the service, and accordingly, the service system 200 can provide the requested service. It is also possible to transmit a signal indicating that the authentication has been successfully performed to the service request terminal (e.g., 300, 400). If the authentication is successful, the control module 110 controls the RBT module 130 to transmit voice information indicating that the authentication is successful to the mobile terminal 400 during a call connection wait, The voice information may be transmitted later.

The validity of the authentication call determined by the control module 110 may be the case where the calling telephone number of the authentication call corresponds to the service or the user. The fact that the originating telephone number of the authentication call corresponds to the service means that the telephone number of the mobile terminal 400 of the user himself / herself inputted into the service system 200 or the authentication system 100, This can be the case if the telephone number is matched. The fact that the calling telephone number of the authentication call corresponds to the user means that the telephone number registered in the service system 200 or the authentication system 100 by the user matches the calling telephone number in advance.

In addition, the validity of the authentication call determined by the control module 110 may be valid when the authentication signal input from the mobile terminal 400 is valid. When the authentication signal is legitimate, it is determined whether the user's password set by the user in advance in the service system 200 or the authentication system 100 matches the authentication signal or the disposable password notified by the authentication system 100 to the user, It may be the case that the authentication signal is corresponding. The authentication signal may be received by the authentication system 100 during a call connection wait time, and may be received by the authentication system 100 after a call connection.

When the control module 110 receives the authentication signal during the call connection wait time, the control module 110 determines the validity of the authentication signal and transmits the information on the determination result to the mobile terminal 400 as a new ringback tone 130).

According to the embodiment, the control module 110 may determine that the authentication call is legitimate even if the authentication signal is received during the call connection wait and the validity of the authentication signal is confirmed.

According to an embodiment, the control module 110 may allow a user to voice a predetermined voice through his or her mobile terminal 400 as described above, and may determine that an authentication call is legitimate until the voice is recorded.

The control module 110 determines the validity of the authentication call in various manners, and if the authentication call is legitimate, the service system 200 transmits the requested service to the user (i.e., the service request terminal 300, 400, ).

The authentication signal confirmation module 140 can confirm the authentication signal input from the mobile terminal 400 during the call connection wait time. When the keypad (including the software keypad) of the mobile terminal 400 is selected by the user, the authentication signal confirmation module 140 can check the DTMF tone corresponding to the selected keypad to confirm the authentication signal. The authentication signal confirmation module 140 can confirm the authentication signal even during the call connection wait time. Needless to say, the authentication signal check module 140 can check the authentication signal input by the user after the call connection is established.

Meanwhile, when the processes required for authentication (e.g., transmission of service information or guide information, reception of an authentication signal, determination of legitimacy of an authentication call, etc.) are performed during a call connection wait, It is possible to prevent the call cost from being generated by terminating the call. However, as described above, even if the process is performed during the call connection waiting for the non-repudiation prevention, it may be determined that the authentication call is legitimate by connecting the call (after transmitting the call connection signal to the calling party) have. Of course, when only a part of the process is performed during the call connection wait, it is needless to say that the remaining processes must be performed after the call connection.

According to an embodiment of the present invention, the control module 110 transmits a predetermined announcement voice to the mobile terminal 400 after the call connection for enhancing non-repudiation prevention, and receives the voice of the user corresponding to the announcement voice And record it. And, it may be judged that the certification call is legitimate only by recording.

As a result, according to the technical idea of the present invention, after making the authentication call to the user requesting the service, the service information or the guidance information is transmitted during the call connection wait of the authentication call, It is possible to shorten the time even if a call connection is not established or a call connection is made, so that it is possible to provide a highly secure authentication scheme while reducing the cost of authentication.

Of course, it is also possible to simply transmit service information or guidance information during a call connection wait. However, in the case of performing authentication for an authentication signal, after the authentication signal is input, a proper voice (for example, The user can be informed of the progress of the authentication through the ringback tone by continuously transmitting the connection tone.

In addition, when the authenticity of the authentication call is recognized after the call connection is established, the control module 110 may terminate the call immediately after the call connection is established, or may terminate the call after transmitting only the voice informing of the authentication , Authentication using the authentication signal may be performed, or a process of recording the user's voice may be performed.

As a result, according to the technical idea of the present invention, if it is determined which authentication process is to be performed, all or a part of the authentication process can be appropriately selected to be performed during a call connection wait, to be.

A specific embodiment of the authentication method using the ring back tone according to the technical idea of the present invention is shown in FIG. 2 to FIG. However, this is only an example, and various changes may be possible according to the change of the authentication process performed through the authentication call.

2 to 4 are views schematically showing an authentication method using a ring back tone according to an embodiment of the present invention.

Referring to FIG. 2, the authentication system 100 may receive an authentication call from a user's mobile terminal 400 (S100). Then, the authentication system 100 confirms the origination number of the received authentication call (S110), and can confirm the service or the user corresponding to the origination number. If the identified service or the user and the originating number do not correspond to each other (e.g., the service request corresponding to the originating number does not exist or the user does not exist), the authenticity of the authentication call may be denied and the call terminated. If the calling number corresponds to a user or a service, the authentication system 100 can check service information corresponding to the requested service. It is also possible to perform communication with the service system 200 for this purpose. Then, the mobile terminal 400 may generate a ring back tone including the service information or guide information (e.g., information for inputting an authentication signal during a call connection or after a call connection, a disposable password, etc.) . Then, the authentication system 100 can receive and confirm an authentication signal (e.g., a user password or a disposable password) during a call connection wait (S130).

The authentication system 100 may determine whether the authentication signal is valid (S140). If the authentication signal is valid, the authentication system 100 may terminate the call without performing the call connection and process the authentication successfully (S170). It goes without saying that it is also possible to transmit to the mobile terminal 400 the information indicating that the authentication is successful before the end of the call. According to an embodiment, a call connection can be made even when the authentication signal is determined to be legitimate (S150). When the call connection is established, the call is terminated and the authentication success process can be performed (S170). At this time, it is also possible to transmit to the mobile terminal 400 information indicating that the authentication is successful before or after the call connection. According to an embodiment of the present invention, the authentication system 100 may transmit the voice guidance information to the mobile terminal 400 to voice a predetermined voice after the call connection, and then record the corresponding voice (S160). If the voice is recorded, authentication may be successfully performed (S170).

Another embodiment is shown in Fig.

Referring to FIG. 3, the authentication system 100 may receive an authentication call from the user's mobile terminal 400 (S200). Then, the authentication system 100 confirms the origination number of the received authentication call (S210), and can confirm the service or the user corresponding to the origination number. If the identified service or the user and the origination number do not correspond to each other (e.g., the service request corresponding to the origination number does not exist or the user does not exist), the authenticity of the authentication call may be denied and the call terminated. If the calling number corresponds to a user or a service, the authentication system 100 can check service information corresponding to the requested service. Then, the mobile terminal 400 may generate a ring back tone including the service information or the guide information (for example, information for inputting an authentication signal during a call connection or after a call connection, a disposable password, etc.) .

After the authentication system 100 connects the call of the authentication call (S230), the authentication system 100 may receive the authentication signal (S240). Then, the authentication system 100 determines the validity of the authentication signal (S250), and can successfully process the authentication (S260). Of course, the authentication system 100 may perform the process of recording a predetermined voice as shown in FIG. 2 before or after determining the validity of the authentication signal.

Another embodiment is shown in Fig.

Referring to FIG. 4, the authentication system 100 may receive an authentication call from the user's mobile terminal 400 (S300). Then, the authentication system 100 can confirm the origination number of the received authentication call and identify the service or the user corresponding to the origination number. If the identified service or the user and the origination number do not correspond to each other (e.g., the service request corresponding to the origination number does not exist or the user does not exist), the authenticity of the authentication call may be denied and the call terminated. If the calling number corresponds to a user or service, the authentication system 100 may receive an authentication signal during a call connection wait (S310). That is, service information may not be transmitted to the mobile terminal 400 separately. In this case, only the guide information may be transmitted to the mobile terminal 400 during the call connection wait. Depending on the implementation, even such guidance information may not be transmitted to the mobile terminal 400 but only the authentication signal may be received. In this case, the service system 200 or the authentication system 100 makes an authentication call in advance to the UI or web page provided to the service request terminal (for example, 300 or 400) and then transmits a predetermined authentication signal For example, a user password or a disposable password).

Then, the authentication system 100 can determine the validity of the authentication signal (S320). Then, the authentication is successfully performed (S350) without connecting the call as described above with reference to FIG. 2 (S350), the authentication is successfully performed after the connection of only the call (S330, S350) After the process of recording the voice of the user, the authentication process may be successfully performed (S340, S350). It goes without saying that the result of the action or action to be performed by the user through the appropriate voice may be guided between the respective steps.

In the DB 150, a calling telephone number or user information corresponding to service information or service information received from the service system 200 may be temporarily stored. In addition, a template of various voice information to be included in the ring back tone may be stored in the DB 150 in advance. It is needless to say that the information (for example, user password, disposable password, etc.) necessary for implementing the technical idea of the present invention can be stored in the DB 150.

According to the embodiment, the control module 110 of the authentication system 100 may recognize the validity of the authentication call only in the authentication call received from the mobile terminal 400 rather than the wired telephone. There is a problem in that it is not suitable for authentication because anyone can use the landline telephone because it is not a personalized terminal even if an authentication call is made with a landline telephone, In addition, when the user uses an authentication call other than the mobile terminal 400 (e.g., a VoIP device such as a computer or a server), the calling number may be manipulated. For this purpose, A process may be performed to determine whether the call originated from a mobile terminal (i.e., a mobile phone).

Also, the authentication system 100 may change the called number of the authentication call every time or at a predetermined period. In this case, it is also possible to prevent the risk of the user who has not received the authentication request call to send the authentication call to the authentication system 100. The authentication system 100 may secure a plurality of destination numbers to be used and then selectively notify the user of a plurality of destination numbers, thereby enhancing security.

Also, the authentication system 100 may send an authentication request call to the user's mobile terminal 400. In this case, at least a part of the information to be transmitted during the call connection wait as described above may be transmitted using the authentication request call You may be notified in advance.

In addition, the authentication system 100 may be configured such that, after the service request is received by the service system 200 or after the authentication request call is performed by the authentication system 100, May be considered legitimate.

The authentication method using the ring back tone according to the embodiment of the present invention can be implemented in the form of a program command readable by a computer and stored in a computer readable recording medium. May also be stored in a computer-readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored.

Program instructions to be recorded on a recording medium may be those specially designed and constructed for the present invention or may be available to those skilled in the art of software.

Examples of the computer-readable recording medium include magnetic media such as a hard disk, a floppy disk and a magnetic tape, optical media such as CD-ROM and DVD, a floptical disk, Such as magneto-optical media and hardware devices that are specially configured to store and execute program instructions, such as ROM, RAM, flash memory, etc. Also, computer- Distributed on a networked computer system, computer readable code can be stored and executed in a distributed fashion.

Examples of program instructions include machine language code such as those produced by a compiler, as well as devices for processing information electronically using an interpreter or the like, for example, a high-level language code that can be executed by a computer.

The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

It will be understood by those skilled in the art that the foregoing description of the present invention is for illustrative purposes only and that those of ordinary skill in the art can readily understand that various changes and modifications may be made without departing from the spirit or essential characteristics of the present invention. will be. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive. For example, each component described as a single entity may be distributed and implemented, and components described as being distributed may also be implemented in a combined form.

It is intended that the present invention covers the modifications and variations of this invention provided they come within the scope of the appended claims and their equivalents. .

Claims (13)

An authentication system for authenticating a user who requests a service in a predetermined service system,
A receiving module for receiving an authentication call made by the user to the authentication system via the terminal for authentication of the service;
A ring back tone module for transmitting a ring back tone to the terminal during a call connection wait when the authentication call is received; And
And a control module for determining the validity of the authentication call for authentication of the service and for successfully processing the authentication for the service when the authentication call is determined to be valid,
The RBT module includes:
And transmits the call connection tone including the service information corresponding to the service or the guide information to be guided to the user for authentication to the terminal.
The apparatus of claim 1,
Wherein the authenticating unit confirms the calling telephone number of the authentication call and determines that the authentication call is legitimate when the confirmed outgoing telephone number corresponds to the service or the user.
The system of claim 1, wherein the authentication system using the ring back tone comprises:
Further comprising an authentication signal confirmation module for confirming an authentication signal input from the terminal during the call connection wait,
The control module includes:
Wherein the authenticating unit judges that the authentication call is legitimate if the validity of the authentication signal confirmed by the authentication signal checking module is confirmed.
The control module according to claim 3,
And an authentication system using a ring back tone for controlling the RBT module so as to transmit information on a result of the legitimacy determination of the authentication signal to the terminal during a call connection wait when the validity of the authentication signal confirmed by the authentication signal checking module is confirmed .
The control module according to claim 2 or 3,
An authentication system using an RBT that determines that the authentication call is legitimate by connecting a call of the authentication call and ending a call after the call is connected.
6. The apparatus of claim 5,
And a call connection tone for transmitting a predetermined announcement voice to the terminal after receiving the call and recording the voice of the user corresponding to the announcement voice.
The system of claim 1, wherein the authentication system using the ring back tone comprises:
Further comprising an authentication signal confirmation module for confirming an authentication signal input from the terminal after the call of the authentication call is connected by the control module,
The control module includes:
Wherein the authenticating unit judges that the authentication call is legitimate if the validity of the authentication signal confirmed by the authentication signal checking module is confirmed.
An authentication system for authenticating a user who requests a service in a predetermined service system,
A receiving module for receiving an authentication call made by the user to the authentication system via the terminal for authentication of the service;
An authentication signal confirmation module for confirming an authentication signal input from the terminal during a call connection wait when the authentication call is received; And
And a control module for determining the validity of the authentication call for authentication of the service and for successfully processing the authentication for the service when the authentication call is determined to be valid,
The control module includes:
Wherein the authenticating unit judges that the authentication call is legitimate if the validity of the authentication signal confirmed by the authentication signal checking module is confirmed.
9. The apparatus of claim 8,
Wherein the authenticating unit authenticates the authentication signal, and then connects the call of the authentication call and terminates the call after the call is connected.
An authentication method using an authentication system for authenticating a user who requests a service in a predetermined service system,
The authentication system receiving an authentication call via the terminal to the authentication system for authentication of the service;
When the authentication system receives the authentication call, transmitting a ring back tone including service information corresponding to the service or guidance information to be guided to the user for authentication to the terminal during a call connection wait; And
And if the authentication system determines that the authentication call is valid, processing the authentication for the service successfully.
The method of claim 10, wherein the authentication method using the ring back tone comprises:
Confirming an authentication signal input from the terminal during the call connection wait; And
Further comprising the step of, when the authentication system confirms the validity of the confirmed authentication signal, transmitting information on a result of the legitimacy determination of the authentication signal to the terminal during a call connection wait.
An authentication method using an authentication system for authenticating a user who requests a service in a predetermined service system,
Receiving, by the authentication system, an authentication call made by the user via the terminal to the authentication system for authentication of the service;
When the authentication system receives the authentication call, checking an authentication signal input from the terminal during a call connection wait; And
Wherein the authentication system judges the validity of the verified authentication signal, and when authentication of the authentication signal is judged to be valid, authentication of the service is successfully performed.
A computer program installed in a data processing apparatus and recorded in a computer-readable recording medium for performing the method according to any one of claims 10 to 12.

Images