KR101762615B1 - Identification system and user terminal using usage pattern analysis - Google Patents

Abstract

A user authentication system and a user terminal utilizing an analysis of a usage pattern of a user are disclosed. An authenticated user terminal utilizing an analysis of a usage pattern of a user according to an embodiment of the present invention includes a usage pattern collection unit for collecting usage patterns of a user's user terminal; A usage pattern analyzing unit for analyzing the usage pattern to determine whether the usage pattern is normal; And an authentication level adjuster for adjusting the authentication level of the user according to the determination result.

Description

Identification system and user terminal using usage pattern analysis using user '

The present invention relates to a user authentication system and a user terminal utilizing an analysis of a usage pattern of a user.

As the IT technology such as electronic devices and communication develops, various tasks are processed electronically, and financial transactions such as commerce and insurance contracts such as purchase and sale, and account opening are also carried out electronically.

Therefore, various methods for non - confidential self - certification have been studied. Most commonly, there are many methods from simple methods of inputting ID and password to methods using various biometric and behavior authentication such as fingerprint, handwritten signature, and face recognition.

Korean Patent Publication No. 10-2015-0096063 (Publication date 2015.08.24) - Authentication device and method based on digital signature

According to the analysis result of the utilization pattern of the user terminal such as the smart phone, it is determined that the user is in the possession state and the authentication level is lowered. If the authentication level is different from the usual one, And to provide a user authentication system and a user terminal that utilize a usage pattern analysis of a user that can achieve improved accuracy with simplification of authentication.

Other objects of the present invention will become more apparent through the following preferred embodiments.

According to an aspect of the present invention, there is provided an information processing apparatus including a usage pattern collecting unit for collecting usage patterns of user terminals of a user; A usage pattern analyzing unit for analyzing the usage pattern to determine whether the usage pattern is normal; And an authentication level adjusting unit for adjusting the authentication level of the user based on the determination result.

Wherein the usage pattern is related to a location of the user terminal, and the usage pattern analyzing unit analyzes at least one of the GPS information of the user terminal and the identification information of the Wi- It can be judged whether or not it is normal.

The usage pattern is related to a call history through the user terminal. The usage pattern analyzer determines whether the usage pattern analyzer is normal according to a result of analyzing the communication party and the call duration, and if necessary, It is possible to determine whether the usage pattern analyzing unit is normal according to a result of whether or not the result of STT-converting the voice includes the specified seatedness for the user.

The utilization pattern is related to the use history of the SNS. The usage pattern analyzing unit determines whether or not the usage pattern analyzing unit is normal according to the result of analyzing the SNS chatting party and the chatting time, and if the user uses the specific emoticon The input pattern analyzing unit may analyze the input deleted by the backspace when the backspace is input when the character is input and determine whether the input pattern analyzer is normal or not based on whether the input is corresponded to the typed data for the user have.

The usage pattern may include at least one of the location of the user terminal, the call history of the user terminal, the SNS usage history, and the usage share of the application, and the usage pattern analyzer may determine whether the usage pattern is normal .

The authentication level adjusting unit may set the authentication level of the user relatively low when the usage pattern is analyzed as being normal and may set the authentication level of the user as relatively high when the usage pattern is analyzed as abnormal.

And a message transmission unit for transmitting the personal authentication level adjusted by the authentication level adjustment unit in the form of a message.

And a key registration unit for registering a private key paired with a public key to be registered in the message authentication server with the user terminal, wherein the message transmission unit transmits the authentication level message to the web server by encrypting the authentication level message with the private key.

According to another aspect of the present invention, there is provided a user terminal for collecting and analyzing a usage pattern of a user and transmitting a personal authentication level message in which the personal authentication level adjusted according to whether the usage pattern is normal is encrypted with a private key; A web server that receives the encrypted authentication level message and performs log level login according to the authentication level of the user included in the authentication level message only when the authentication of the authentication level message of the user is successful; And a public key corresponding to the private key is registered. The public key is decrypted by the public key in accordance with the message authentication request from the web server, and the message authentication is performed to transmit the authentication result to the web server There is provided a personal authentication system utilizing a usage pattern analysis of a user including a message authentication server.

The message authentication server transmits the message authentication success as the authentication result when the decryption is successful with the public key, and may transmit the message authentication failure as the authentication result when decryption is failed with the public key.

The message authentication server can transmit the decrypted identity authentication message to the web server in the case of message authentication success.

The web server may be able to log in by only checking the n specified ones of the handwritten signature, iris recognition, fingerprint authentication, and password input corresponding to the authentication level of the user.

Other aspects, features, and advantages will become apparent from the following drawings, claims, and detailed description of the invention.

According to the embodiment of the present invention, when the result of analyzing the usage pattern of the user terminal such as the smart phone is the same as usual, the user is judged to be in the possession state and the degree of the personal authentication is lowered. It is possible to simplify the authentication of the user by increasing the authentication level and to obtain the improved accuracy.

Brief Description of the Drawings Fig. 1 is a schematic block diagram of a user terminal for authenticating a user using analysis of a usage pattern of a user according to an embodiment of the present invention; Fig.
FIG. 2 is a flow chart of the authentication method performed by the user terminal of FIG. 1,
FIG. 3 is a schematic block diagram of a personal authentication system utilizing a user's usage pattern analysis according to an exemplary embodiment of the present invention,
4 is a schematic block diagram of a financial server included in the personal authentication system,
5 is a schematic block diagram of a message authentication server included in the identity authentication system.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It is to be understood, however, that the invention is not to be limited to the specific embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The terms first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. The singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, the terms "comprises" or "having" and the like refer to the presence of stated features, integers, steps, operations, elements, components, or combinations thereof, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

It is to be understood that the components of the embodiments described with reference to the drawings are not limited to the embodiments and may be embodied in other embodiments without departing from the spirit of the invention. It is to be understood that although the description is omitted, multiple embodiments may be implemented again in one integrated embodiment.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Reference will now be made in detail to the preferred embodiments of the present invention, examples of which are illustrated in the accompanying drawings, wherein like reference numerals refer to the like elements throughout. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail.

FIG. 1 is a schematic block diagram of a user terminal for authenticating a user using an analysis of a usage pattern of a user according to an embodiment of the present invention, and FIG. 2 is a flowchart of a user authentication method performed in the user terminal of FIG. 1 .

The user terminal 100 for user authentication using the user's usage pattern analysis according to an embodiment of the present invention collects and analyzes a usage pattern of a user and determines whether the user is present or not according to a degree similar to a pattern that the user normally uses And the authentication level of the user can be adjusted in a situation where authentication of the user is required.

The user terminal 100 for authenticating the user according to the present embodiment includes a usage pattern collecting unit 110, a usage pattern analyzing unit 120, and an authentication level adjusting unit 130. The usage pattern collecting unit 110, the usage pattern analyzing unit 120 and the authentication level adjusting unit 130 may be implemented as software in the form of an application installed in the user terminal 100 such as a smart phone.

The usage pattern collection unit 110 collects information on a usage pattern of a user using the user terminal 100 (step S10). The usage pattern collection may be limited to a predetermined time (for example, 3 hours) from the current time. This is because it may be difficult to grasp the recent state of the user terminal 100 by information collected in the past despite the fact that the recent state of the user terminal 100 has been changed due to loss or the like.

The collection time of the usage pattern can be variously set according to at least one of the user attributes such as the age and the residence of the user to be collected, and the type of the usage pattern.

The utilization pattern to be collected may include at least one of location information of the user terminal, call information through the user terminal, SNS (social network service) utilization information using the user terminal, and application usage share.

The usage pattern analyzing unit 120 analyzes the usage pattern collected by the usage pattern collecting unit 110 to determine whether or not the usage pattern is normal (step S15). That the usage pattern is normal means that the usage pattern is expected to be performed by the designated user for the user terminal 100. [

The analysis when the usage pattern is the location information of the user terminal is as follows.

If the designated user has the user terminal 100, it is determined whether or not the user terminal 100 exists at a position where the user is expected to be present.

For example, if the main location of the user is home and company, it is determined that the location information collected by the user terminal 100 is a home or a company established for the user. However, if the location is a third place It can be determined that the usage pattern of the user terminal is abnormal.

The location information of the user terminal may be used for analysis in association with the time information. For example, if the position set for the user is home and company, if the user terminal is located at the company or its vicinity, the usage pattern is normal if it is a weekday business hours (e.g., 9:00 to 18:00 from Monday to Friday) If the location of the user terminal is home even though it is weekday business hours, it can be judged that the usage pattern is abnormal.

The location information of the user terminal used in the analysis of the usage pattern in this embodiment may be a GPS value. For this, the usage pattern collection unit 110 may acquire the location information of the user terminal from the GPS module separately provided in the user terminal 100. [

Or the location information of the user terminal may be the identification information of the Wi-Fi router connected to the user terminal 100. The GPS value described above indicates an accurate position when the user terminal 100 is located outdoors, but can not be utilized because the GPS signal is not received when the user terminal 100 is located indoors. Therefore, it is possible to utilize WiFi communication which is widely used in the user terminal 100 such as a smart phone.

In order to perform Wi-Fi communication, a user terminal must access a Wi-Fi router installed in an arbitrary position in the room. At this time, the connected Wi-Fi router has identification information (for example, a MAC address) that can be distinguished from the other Wi-Fi router. At this time, if the identification information of the WiFi router currently connected to the user terminal is one of the identification information of the WiFi router that has the history of connection previously registered in the database, it can be determined that the usage pattern of the user terminal is normal. However, when the user terminal compares the identification information of the WiFi router currently connected with the identification information of the WiFi router with the history of connection previously registered in the database, if the same information does not exist, It can be determined that the usage pattern of the user terminal is abnormal.

Next, the analysis when the usage pattern is call information through the user terminal is as follows.

As a result of checking the latest call history of the user terminal, it can be judged that the usage pattern of the user terminal is normal when it is analyzed that the user has frequently communicated with the caller in comparison with the past history registered in the database. Herein, the frequency of calls may be designated by the user, or the top few persons having a large number of calls may be set as a criterion for determining a normal pattern in the usage pattern analysis according to a result of analysis of past history.

However, as a result of checking the latest call history of the user terminal, it can be determined that the usage pattern of the user terminal is abnormal when the user is not the first user to talk or frequently call, compared with the past history registered in the database. Also, as a result of analyzing the latest call history, it can be determined that the usage pattern of the user terminal is abnormal even when the call time with a specific counterpart is abnormally long or short compared with the past history registered in the database.

In addition, the result of STT (Speech to Text) conversion of the voice of the latest call history of the user terminal may be analyzed, and it may be determined whether the usage pattern of the user terminal is normal or not according to whether or not the voice corresponding to the user is included .

The user's corresponding speech is analyzed by analyzing past call history registered in the database, but it is unnecessary in addition to keywords that are important for conversation, but there is a unique kind of churning frequently appearing more frequently than the predetermined number of times for the user (for example, ',' Ah ~ ', etc.).

Next, the analysis of the case where the usage pattern is the use history of the SNS using the user terminal is as follows.

As a result of analyzing the content of the recently used SNS in the user terminal, it can be determined whether the usage pattern of the user terminal is normal by analyzing who is the SNS partner and when the chat time is when performing chat through the user terminal . It is possible to determine whether the usage pattern is normal based on whether the chat partner has frequently chatted with the chat partner more frequently than the predetermined threshold based on the past history registered in the database .

Also, when replies are posted to the SNS posts, it can be determined that the usage pattern of the user terminal is normal when there is a unique phrase or emoticon frequently used by the user.

Or to analyze a previous input that was deleted by backspace when entering a backspace to correct a typo in the process of chatting or typing letters to reply. If the deleted previous input is included in the typedata registered in the database corresponding to the user, it can be determined that the usage pattern of the user terminal is normal. The typedata may be the result of collecting the previous input that has been deleted according to the backspace input for more than a predetermined period of time. This is based on the result of inputting characters that are frequently wrong in the process of inputting characters.

Next, the case where the usage pattern is the application usage share of the user terminal is as follows.

It is possible to determine that the usage pattern of the user terminal is normal when the usage share of recently executed applications is analyzed by the user terminal and the similarity is equal to or greater than a predetermined ratio with the predefined usage share for the user. For example, an application frequently used for each user may be different, and even if the same applications are used, the usage time for each application may be different depending on the user's tendency. Accordingly, it is possible to estimate the tendency of the user terminal of the user terminal based on the types of applications and the usage share of the applications that have been used for a certain period of time.

The usage pattern analyzing unit 120 may be utilized as a usage pattern for analyzing at least one of the location of the user terminal, the call history of the user terminal, the usage history of the SNS, and the usage share of the application. If there are a plurality of usage patterns It is possible to judge whether or not it is normal through OR condition calculation. That is, if one of the usage patterns is determined as a normal pattern, the user terminal is regarded as having a normal user. This is because even if it is a real user, every usage pattern can not satisfy the normal condition (threshold value for normal pattern) at every moment. Even if any usage pattern satisfies the normal condition, it is enough to judge as a true user.

The authentication level adjustment unit 130 may adjust the authentication level of the user according to the result of the analysis performed by the usage pattern analysis unit 120. [

If the usage pattern is analyzed as being normal, the authentication level of the user is set relatively low (step S20). If the usage pattern is analyzed as abnormal, the authentication level of the user is set relatively high (step S25).

A low level of self-certification signifies that the self-certification requirement has been eased if the self-certification is required when executing a specific application or performing an action in the application. For example, when there is an autograph, iris recognition, fingerprint authentication, password input, etc. as the authentication requirement for the financial transaction, it is possible to authenticate the user even by confirming only n or less of them.

On the other hand, the high level of self-certification means that the requirement for self-certification has been strengthened so that more than n of the above-mentioned self-certification requirements are confirmed.

The authentication level adjusted by the authentication level adjustment unit 130 when the application requiring authentication is executed can be provided as an API (Application Platform Interface). Or the authentication level may be transmitted in the form of a message to a web server such as a financial server to be described later.

In the present embodiment, the usage pattern collection unit 110 can process the collected usage patterns into a data format that can be analyzed. In addition, the usage pattern collected by the usage pattern collection unit 110 may be stored in a database and used as a past history for future usage pattern analysis.

In addition, the usage pattern collecting unit 110 can be activated and activated every time a usage pattern is generated. The usage pattern analyzing unit 120 and the authentication level adjusting unit 130 can be activated only when authentication of the user is required.

The authentication process in the user terminal according to the present embodiment will be described as follows.

Smartphone users normally use music apps from 8:00 am to 9:00 pm, and listen to music at lunchtime. They analyze patterns such as doing social networking with their friends during lunchtime and use apps that are not used suddenly, Or if the user does not use the music app during his / her work time, he / she may use the stronger authentication means such as mobile banking. However, You can complete your identity verification with a simple login.

As another example of the present invention, In case of mobile banking, remittance to a frequent trader can be made possible by a simple login with the usage pattern being constant. However, when a new person or a new account number is used, You can be authenticated by yourself.

FIG. 3 is a schematic block diagram of a personal authentication system utilizing a user's usage pattern analysis according to an exemplary embodiment of the present invention, and FIG. 4 is a schematic diagram of a financial server included in the personal authentication system And FIG. 5 is a schematic block diagram of a message authentication server included in the personal authentication system.

The identity authentication system 1 using the analysis of the usage pattern of the user according to the present embodiment uses the identity authentication level requested from the web server such as the financial server using the identity authentication level message transmitted from the user terminal It can be applied differently depending on the pattern. In this process, the authentication of the identity authentication level message is additionally performed through the message authentication through the message authentication server, thereby preventing errors in the authentication of the user due to possible problems such as hacking in the message transmission process.

The authentication system 1 according to the present embodiment includes a user terminal 100, a message authentication server 300, and a web server 200.

The user terminal 100 has been described with reference to FIG. 1 and may further include a key registration unit 140 and a message transmission unit 150, which are additional components for message transmission.

The web server 200 includes a message receiving unit 210, an authentication request unit 220, an authentication result receiving unit 230 and a level log-in unit 240. The message authentication server 300 includes a public key registration unit 310, A request receiving unit 320, a message authentication unit 330, and an authentication result transmitting unit 340.

The key registration unit 140 generates and registers a pair of a private key and a public key for security in transmitting the adjusted authentication level in a message format by the authentication level adjuster 130.

The private key generated in the key registration unit 140 is registered in the secure area of the user terminal 100. The public key is transmitted to the message authentication server 300 and is registered in the message authentication server 300 by the public key registration unit 310 (Step S50).

The message transmission unit 150 transmits the personal authentication level adjusted by the authentication level adjustment unit 130 to the web server 200 in the form of a message for transmission to the web server 200 (step S55). The message transmission unit 150 may encrypt and transmit the authentication level message using the private key registered in the key registration unit 140. [

The message receiving unit 210 of the web server 200 receives the authentication level message. At this time, the transmitted authentication level message is encrypted with the private key, and can not be decrypted. Accordingly, the authentication request unit 220 of the web server 200 requests authentication while transmitting the authentication level message transmitted to the message authentication server 300 (step S60). The message authentication request may include a request for decryption in the case of a message from a legitimate user terminal.

The request receiving unit 320 of the message authentication server 300 receives the message authentication request from the authentication request unit 220 of the web server 200. In this case, the message authentication unit 330 performs message authentication (step S65 ).

The message authentication can be performed by determining whether the authentication level message encrypted with the private key can be decrypted using the public key registered in the message authentication server 300.

If the decryption is not performed using the public key registered in the message authentication server 300, it is determined that the private key used for encryption and the public key registered in the message authentication server 300 do not match with each other and that the corresponding message does not come from a legitimate user terminal . In this case, the authentication result transmitting unit 340 may transmit the authentication result due to message authentication failure (step S70).

When decryption is performed using the public key registered in the message authentication server 300, since the private key used for encryption and the public key registered in the message authentication server 300 are matched with each other, the corresponding message is regarded as coming from a legitimate user terminal have. In this case, the authentication result transmitting unit 340 can transmit the authentication result with the message authentication succeeded. And send the decrypted identity authentication level message together with the authentication result.

The authentication result receiving unit 230 of the web server 200 receives the authentication result from the message authentication server 300. If the received authentication result is a message authentication failure, it can be considered that there is a problem in the authentication level message itself and the login itself is disabled.

If the received authentication result is a message authentication success, the level log-in performing unit 240 can perform level-specific log-in according to the decrypted authentication level message received together with the authentication result (step S75).

When the authentication level of the user is relatively low, the user can log in through the simple authentication process. If the authentication level of the user is relatively high, the login process can be performed only through the enhanced authentication process.

The degree of the authentication process for the login according to the authentication level of the user may be variously set as needed.

The authentication method according to the present embodiment described above can be implemented as a computer-readable code on a computer-readable recording medium. The computer-readable recording medium includes all kinds of recording media storing data that can be decoded by a computer system. For example, it may be a ROM (Read Only Memory), a RAM (Random Access Memory), a magnetic tape, a magnetic disk, a flash memory, an optical data storage device, or the like. In addition, the computer-readable recording medium may be distributed and executed in a computer system connected to a computer network, and may be stored and executed as a code readable in a distributed manner.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention as defined in the appended claims. It will be understood that the invention may be varied and varied without departing from the scope of the invention.

1: Personal authentication system 100: User terminal
110: usage pattern collecting unit 120: usage pattern analyzing unit
130: authentication level adjustment unit 140: key registration unit
150: message transmission unit 200: web server
210: message receiving unit 220:
230: authentication result receiving unit 240: level-specific login performing unit
300: message authentication server 310: public key registration unit
320: request reception unit 330: message authentication unit
340: Authentication result transmission unit

Claims (12)

A usage pattern collecting unit for collecting a usage pattern for a user terminal of a user;
A usage pattern analyzing unit for analyzing the usage pattern to determine whether the usage pattern is normal;
And an authentication level adjusting unit for adjusting the authentication level of the user according to the determination result of the usage pattern analyzing unit,
Wherein the usage pattern relates to a location of the user terminal,
Wherein the usage pattern analyzer determines whether the usage pattern analyzer is normal according to a result of comparing at least one of GPS information of the user terminal and identification information of a Wi-Fi router connected to the user terminal at a specific time,
When the identification information of the Wi-Fi router is compared with the identification information of the Wi-Fi router, if the identification information of the Wi-Fi router is one of the identification information of the Wi-Fi router that has been previously registered in the database, the usage pattern is determined to be normal. Otherwise, A user terminal authenticating the user using the analysis of the usage pattern of the user.
delete The method according to claim 1,
Wherein the usage pattern further relates to a call history through the user terminal,
The usage pattern analyzing unit determines whether the user is normal according to a result of analyzing the communication partner and the communication time,
Using the usage pattern analysis of the user, which can determine whether or not the usage pattern analyzer is normal according to a result of whether or not the result of STT conversion of the voice of the call history includes the chitude defined for the user Authenticated user terminal.
The method according to claim 1,
Wherein the usage pattern further includes information related to the use history of the SNS,
The usage pattern analyzing unit determines whether the user is normal according to a result of analyzing the SNS chatting party and the chatting time,
Wherein the usage pattern analyzer is able to determine whether the input pattern is normal or not according to whether the input deleted by the backspace when the backspace is input when the character is input and corresponding to the typedata designated for the user, Self - authenticated user terminal using pattern analysis.
The method according to claim 1,
Wherein the usage pattern includes at least one of a location of the user terminal, a call history through the user terminal, an SNS usage history, and an application usage share,
Wherein the usage pattern analyzing unit determines whether the user is normal through an OR condition calculation.
The method according to claim 1,
The authentication level adjustment unit sets the authentication level of the user to be relatively low when the usage pattern is analyzed as being normal and sets the authentication level of the user to be relatively high when the usage pattern is analyzed as abnormal, Authenticated user terminal.
The method according to claim 1,
And a message transmission unit for transmitting the user authentication level adjusted by the authentication level adjustment unit in a message form and transmitting the same.
8. The method of claim 7,
Further comprising: a key registration unit for registering, in the user terminal, a private key paired with a public key to be registered in the message authentication server,
Wherein the message transmission unit encrypts a personal authentication level message with the private key and transmits the encrypted personal authentication level message to a web server so that the web server can perform personal authentication according to the personal authentication level adjusted in accordance with the personal authentication level message, User authenticated user terminal using analysis of user 's usage pattern.
delete delete delete delete

Images