KR101933438B1 - Method, system and application for user authentication based on mutual cooperation - Google Patents

Abstract

Disclosed by the present invention are a mutual cooperation-based user authentication method, a system thereof, and a user authentication application operating in a mobile device of a user for the same. The mutual cooperation-based user authentication method includes: a step of authenticating the login of a first user by comparing user information received from a first mobile device of the first user with preregistered user information; a step of generating a unique identifier and transmitting the generated identifier to the first mobile device and transmitting information about an authentication request fact to a second mobile device of a second user having authentication authority of information access when an authentication request generated when the first user tries to access specific information from the first mobile device; and a step of authenticating the information access of the first user by comparing the unique identifier with the generated unique identifier when the unique identifier transmitted from the first mobile device to the second mobile device is received from the second mobile device. The present invention is able to perform authentication accessible to information through individual or multiple authentication.

Description

METHOD, SYSTEM AND APPLICATION FOR USER AUTHENTICATION BASED ON MUTUAL COOPERATION < RTI ID = 0.0 >

The present invention relates to a mutual cooperation-based user authentication method, a user authentication system, and a user authentication application applicable to user authentication requiring sharing with other users.

As the number of smartphone users around the world increases, users can easily and easily access personal information in the mobile environment, but the security of personal information is becoming weak.

Since the subscription and access of the Internet service are made easier, the personal information is distributed and stored in various servers, and the environment where the Internet is always available is maintained whenever necessary. Also, as more individuals have more devices with Internet connectivity, more information is being stored on servers connected to the Internet. Usually, most of these web services use the same ID and password to authenticate the user. Therefore, when one device is lost or the ID / password is exposed to other users, a lot of information is leaked There is a high probability of a problem.

The conventional authentication method using the ID / password causes many problems such as security vulnerability. To solve this problem, there is a method of combining OTP (One Time Password), a public certificate, a security card, NFC And various authentication methods such as fingerprint recognition, iris recognition, and PIN code authentication based on FIDO (Fast IDentity Online) technology for authenticating a user without using a password have been proposed and used.

However, this authentication method is limited to authentication requiring sharing with other users, and there is a limit to information protection. For example, where a community, such as a corporation or a hospital, manages information by consultation, its use is often undesirable or difficult to apply.

Organizations spend a lot of time protecting information, but there are still many cases of personal and internal information leakage. For example, if a trade company seizes confidential product imports or exports from its suppliers or leaves the company, it may cause a huge loss if it is approached by information of the people with whom it is familiar.

In addition, hospitals can access information of other patients in addition to the information of the patient's physician by using the medical information system with the peaceful access authority, and the unauthorized administrator can retrieve personal information, leak or delete it There is a serious problem.

Published Japanese Patent Application No. 10-2015-0081387 (Feb.

SUMMARY OF THE INVENTION The present invention has been made to solve the above problems, and it is an object of the present invention to provide a mutual cooperation based user authentication method, a user authentication system, and a user authentication application in which authentication can be performed to access information through individual or multiple authentication.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory and are not intended to limit the invention to the precise forms disclosed. Other objects, which will be apparent to those skilled in the art, It will be possible.

In order to achieve the above object, the present invention provides a method of authenticating a user, comprising: authenticating a login of a first user by comparing user information received from a first mobile device of a first user with registered user information; The method comprising: transmitting a list of information requested by a first user to a first mobile device; generating a unique identifier when a first user's access authentication request for at least one of the information in the list is received from the first mobile device; When the unique identifier transmitted from the first mobile device to the second mobile device is received from the second mobile device, transmitting the unique identifier to the first mobile device, Based user authentication method comprising the steps of:

According to the mutual cooperation based user authentication method of the present invention, the unique identifier can be included in the visually displayable image code.

According to the mutual cooperation based user authentication method of the present invention, the first mobile device outputs the image code to a display, and the second mobile device can photograph the image code through a camera to acquire the unique identifier .

The mutual cooperation based user authentication method of the present invention may further include generating a new unique identifier for maintaining authentication after authenticating the access of the first user and transmitting the new unique identifier to the first and second mobile devices have.

The cooperative-based user authentication method of the present invention may further include, when receiving an authentication revocation request from the second user, revoking the information access authentication of the first user.

According to the mutual cooperation based user authentication method of the present invention, the user information may include a user ID, a password, and an International Mobile Equipment Identity (IMEI).

The cooperative based user authentication method of the present invention may further include transmitting information on the authentication request to the second mobile device of the second user having the authentication right of the information access when generating the unique identifier. Here, the transmission of the information about the authentication request fact can be performed using at least one of e-mail, SMS, and push messages.

According to another aspect of the present invention, there is provided an information processing apparatus including a database server in which information is stored, an authentication server for processing login authentication according to a login request of a first user and information access authentication according to an access authentication request for specific information of a first user, The server includes a step of authenticating the login of the first user by comparing the user information received from the first mobile device of the first user with the registered user information and the step of authenticating the login of the first user by comparing the user information received from the first mobile device of the first user, And transmitting a list of the at least one information to the first mobile device when the at least one information of the list is received from the first mobile device, And when the unique identifier transmitted from the first mobile device to the second mobile device is received from the second mobile device, Comparison initiates collaboration-based user authentication system characterized in that the operation a process including the step of authenticating the information of a first user access.

In the meantime, the present invention provides a mutual cooperation based user authentication application that can be stored in a memory of a first mobile device and executed by a processor of a first mobile device, Processing for transmitting an information access authentication request to the authentication server upon selection of information to be accessed by a first user, processing for transmitting a unique identifier received from the authentication server to a second mobile device of a second user The second mobile device transmits the unique identifier inputted to the second mobile device to the authentication server and outputs the access authorized information as the authentication server permits the information access, Means for executing a process for outputting the mutual cooperation based user authentication application .

According to the mutual cooperation based user authentication application of the present invention, the process of converting the unique identifier may be a process of converting the unique identifier into a form of image code visually displayable on the display.

The cooperative based user authentication application of the present invention may further include a process for pre-registering user information in the authentication server, wherein the user information includes a user ID, a password, and an International Mobile Equipment Identity : IMEI).

According to the mutual cooperation based user authentication application of the present invention, the password can be unidirectionally hashed using the international mobile device identification code (IMEI) as SALT.

According to the mutual cooperation based user authentication application of the present invention, the first mobile device can be connected to the second mobile device through short-range wireless communication. Here, the user authentication application of the first mobile device can perform the process of maintaining or canceling the authentication based on the short-range wireless signal broadcast by the second mobile device. Specifically, the unique identifier included in the short- It is possible to perform the process of canceling the authentication when the received signal strength is inconsistent with the unique identifier received from the authentication server, the received field strength is lower than the preset value, or a signal is not received.

According to the present invention having the above-described configuration, when a user for accessing information requesting mutual trust tries to authenticate, another registered user proceeds authentication together and uses the image code and short- The present invention provides an efficient authentication method in an environment requiring mutual authentication or multiple cooperation.

In addition, according to the present invention, because authentication can be canceled at any time at any time, it can be easily and quickly applied to a security authentication method using a smart phone when accessing sensitive information such as hospital information or confidential information of a company There is an advantage to be able to do.

1 is a configuration diagram of a mutual cooperation based user authentication system according to an embodiment of the present invention;
2 is a signal flow diagram illustrating a user login authentication procedure in a cooperative based user authentication method according to an embodiment of the present invention.
3 is a signal flow diagram illustrating a user registration procedure of a cooperative based user authentication method according to an embodiment of the present invention.
4 is a signal flow diagram illustrating an information access authentication procedure in a mutual cooperation based user authentication method according to an embodiment of the present invention;
5 is a diagram illustrating a screen displayed on a user's mobile device for user login authentication;
FIG. 6 is a diagram illustrating a text list displayed on a screen of a user's mobile device after a user logs in. FIG.
7 is a diagram illustrating a menu displayed on a screen of a mobile device when accessing a user's own article and a user's article, respectively.
8 is a diagram illustrating image codes output on a screen of a user mobile device to obtain an access right of information;
9 is a diagram illustrating an authentication permission request message output on a user mobile device screen and a screen for capturing an image code.

Hereinafter, a mutual cooperation based user authentication method, a user authentication system, and a user authentication application according to the present invention will be described in detail with reference to the drawings.

1 is a configuration diagram of a mutual cooperation based user authentication system according to an embodiment of the present invention.

The cooperative based user authentication system according to the present embodiment includes a database server 110 in which information is stored, and an authentication server 120 that processes a user login authentication procedure and an information access authentication procedure.

The database server 110 is configured to store user authentication information and various kinds of information.

The authentication server 120 is connected to the database server 110 via the network 130 and may be connected to the user's mobile device through the Internet 130. [

The mobile device (e.g., smart phone, tablet, etc.) owned by the user can exchange messages and information with the authentication server 120 in real time. In addition, mobile devices owned by a plurality of users can use short-distance wireless communication (for example, Bluetooth) or send and receive messages, information, and the like using the authentication server 120. The user authentication application (hereinafter 'application') related to the present invention can be stored in the memory of the mobile device and is executed by the processor of the mobile device.

Hereinafter, a user requesting information access permission to access specific information stored in the database server 110 is referred to as a 'first user', and a user who permits authentication at a position close to the first user is referred to as' 2 users ". The mobile device owned by the first user will be referred to as a 'first mobile device', and the mobile device owned by a second user will be referred to as a 'second mobile device'. Also, in this specification, a first user, which is a user requesting permission to access information, and a second user, who is a user who authorizes authentication, are described as singular, but it is also possible that the first user and the second user are respectively plural users.

The mutual cooperation based user authentication method related to the present invention can roughly be divided into a user login authentication procedure and an information access authentication procedure. User login authentication is an authentication procedure used to view a list of information to be accessed, or to access information for which the user has authority. Because companies and hospitals often need to view or collaborate with other people's information unlike accessing personal information, in order to view other people's information or information that others have permission to access, Go ahead.

FIG. 2 shows a user login authentication procedure during the above two authentication procedures.

As shown in FIG. 2, the user login authentication process is performed by comparing the user information transmitted from the first mobile device 10 with the registered user information according to the login request of the first user. In order to do so, a procedure for registering user information in advance must be performed in advance. FIG. 3 shows such a pre-user registration procedure. Referring to this, the user information for user registration includes a user ID, a password, and an International Mobile Equipment Identity (IMEI).

Specifically, the first user inputs the ID and the password to the first mobile device 10. The application of the first mobile device 10 performs an encryption process 12 for the password, wherein encryption may be performed using the IMEI. The IMEI is a unique code assigned by the maker of the mobile device, which includes information such as the manufacturer, model, nationality, and serial number of the mobile device. Therefore, even the same type of mobile device has a unique identification code for each device, so that even the same type of mobile device can be identified and identified using the same identification code.

The encryption process S12 will be described in more detail. The password is unidirectionally hashed using IMEI as SALT. At this time, it is possible to designate the check digit (N: the last digit of the cell phone number, for example) as the repetition number, and in this case, it can be processed as 10 if the check digit is 0.

The first mobile device 10 transmits the ID, the encrypted password, and the IMEI to the authentication server 120 (S13). At this time, it is also possible to transmit the mobile phone number together, and it is possible to distinguish the already registered users by using it, and there is an advantage that the restriction condition of the authentication device can be given.

The authentication server 120 inputs information received from the first mobile device 10 to the database server 120 (S14), and thus the user registration process is completed.

Referring again to FIG. 2, the user login process will be described. The first user requests login through the first mobile device 10. The application of the first mobile device 10 performs a process for requesting the authentication server 120 to log in the user in accordance with the login request of the first user. According to the present embodiment, the user inputs the ID and the password to the first mobile device 10 (S21), and the first mobile device 10 transmits the ID, the password, and the IMEI to the authentication server 120, Authentication is requested (S22).

The authentication server 120 compares the user information received from the first mobile device 10 with previously registered user information to authenticate the login of the first user (S23). If the ID, password, and IMEI received from the first mobile device 10 do not match the ID, password, and IMEI previously registered in the database server 110, the user login is rejected.

When the user login is authenticated, the authentication server 120 transmits a list of information requested or requested by the user to the first mobile device 10 from the database server 10 (S24).

When the first user selects at least one piece of information from the list of the information output to the first mobile device 10 (S25), the application of the first mobile device 10 performs processing for transmitting the authentication request thereto The first mobile device 10 transmits an authentication request to the authentication server 120 (S30). When the first user is the information having the access right, the authentication server 120 permits the information access without a separate authentication procedure. However, if another person's permission to access information is required, the following information access authentication procedure is performed.

In this regard, FIG. 4 sequentially illustrates the signal flow for the information access authentication procedure.

When the authentication request is received from the first mobile device 10, the authentication server 120 confirms whether or not access is permitted (S31). If authentication of the other user is required, (S32), and transmits it to the first mobile device 10 (S33). Here, a universally unique identifier (UUID), which is a one-time universal unique identifier, can be used as the unique identifier.

Then, the authentication server 120 transmits information about the authentication request to the second mobile device 20 of the second user (S34). This information is for informing the second user that the authentication of the specific information is requested from the first user. The transmission of such information can be performed using e-mail, SMS, push message, or the like.

When the unique identifier is transmitted to the first mobile device 10, the application of the first mobile device 10 performs a process of converting the unique identifier into a form that can be input to the second mobile device 20 of the proximate second user do.

For example, the unique identifier can be converted into a form of image code that can be visually output (displayed) on a display of the mobile device, which can be transmitted to another mobile device through a camera installed in another mobile device. The present embodiment exemplifies a QR code (Quick Response Code) as such an image code. Such QR codes can represent various information such as Hangul, Hanja, English, and numbers, and can be recognized from any direction, which is especially advantageous when information is shared using a camera such as a smart phone. However, the image code is not limited to the QR code but may be modified into various types of codes. In addition, the code that can be input to the second mobile device 20 may be implemented not only in the form of an image code but also in another form of code that can be transmitted through the input / output device of the mobile device at a close position.

As illustrated in this embodiment, as the first mobile device 10 generates (S35) an image code containing a unique identifier, the first mobile device 10 outputs the image code to the display, The user shoots (scans) the image code using the camera of the second mobile device 20 to allow the second mobile device 20 to acquire the unique identifier (S36). The application of the second mobile device 20 can be configured to extract a unique identifier included in the captured (scanned) image code.

The second user transmits the unique identifier to the authentication server 120 through the second mobile device 20 to approve the requested information (S37).

The authentication server 120 compares the unique identifier received from the second mobile device 20 with the previously generated unique identifier to authenticate the information access of the first user (S38). If the unique identifier matches, the information is allowed to be accessed, and if there is a discrepancy, the information is denied access.

According to the information access authentication of the authentication server 120, the information requested by the first user is transmitted to the first mobile device 10, and the application of the first mobile device 10 transmits the authorized information to the output means Processing is executed.

Then, the authentication server 120 generates a new unique identifier for maintaining the authentication (S39) and transmits it to the first and second mobile devices 10 and 20, respectively (S40). The newly generated unique identifier is used for authentication maintenance.

According to an embodiment of the present invention, a short-range wireless communication technique is used as a wireless communication technique for maintaining authentication. The first mobile device 10 and the second mobile device 20 may be wirelessly connected via short-range wireless communication, for example, Bluetooth communication. Particularly, it is preferable to use Bluetooth low energy (BLE) technology using low power.

The second mobile device 20 broadcasts or advertises a wireless signal including unique identifier information newly generated as described above in the vicinity (S41), and the first mobile device 10 transmits the wireless signal including the newly generated unique identifier information to the second mobile And scans the radio signal broadcasted by the device 20 (S42). The first mobile device 10 may receive the radio signal broadcasted from the second mobile device 20 and maintain or revoke the authentication based on the received radio signal.

Specifically, the application of the first mobile device 110 maintains or cancels the authentication based on whether the unique identifier of the signal broadcast by the second mobile device 20 is matched and the RSSI (Received Signal Strength Indication) Processing can be performed. That is, if the unique identifier included in the near-field wireless signal is inconsistent with the unique identifier received from the authentication server 120, or the received electric field intensity becomes lower than the preset value (i.e., It is possible to perform a process of automatically canceling the authentication.

On the other hand, when the authentication server 120 receives the authentication revocation request from the second mobile device 20 of the second user, the authentication server 120 revokes the information access authentication of the first user so that the first user can no longer access the corresponding information do.

The form in which the user authentication procedure described above can be implemented in the user's mobile device will be described with reference to Figs. 5 to 9 below.

FIG. 5 illustrates a screen output to a user's mobile device for user login authentication. 5 (a) shows a screen for inputting an ID and a password for user login, and FIG. 5 (b) shows a screen for pre-registration of user information.

FIG. 6 illustrates a text list displayed on the screen of the user's mobile device after the user logs in. In this way, the content of the user's own text is displayed, It will be possible to implement access only through authentication.

FIG. 7 illustrates a menu displayed on a screen of a mobile device when accessing a user's own text and another user's text, respectively. As shown in (a) of FIG. 7, there is a menu for reading, modifying, deleting, etc. in the case of the user's own text.

8 illustrates an image code output on the screen of a user's mobile device in order to obtain the right of information access. According to the example, a QR code including a unique identifier is output on the screen of the first mobile device 10 .

FIG. 9 illustrates an authentication permission request message output on the user mobile device screen and a screen for capturing an image code. According to FIG. 9A, a permission request message is displayed on the second mobile device 20. If the second user touches the Accept button, a process for scanning the QR code is performed as shown in (b). When the information access authentication is normally performed, the content of the information requested to be accessed is displayed on the screen of the first mobile device 10. [

The user authentication method and the application related to the present invention described above can be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. Such computer readable media may include program instructions, data files, data structures, etc., alone or in combination. And program instructions recorded on such media may be those specially designed and constructed for embodiments of the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape, optical media such as CD-ROMs and DVDs, magnetic-optical media such as floppy disks, Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments However, various modifications may be made by those skilled in the art within the scope of the technical idea of the present invention.

10: first mobile device 20: second mobile device
110: Authentication server 120: Database server
130: Internet

Claims (15)

Authenticating the login of the first user by comparing the user information received from the first mobile device of the first user with previously registered user information;
Transmitting to the first mobile device a list of information that the first user can provide or requested by the first user;
Generating a unique identifier and transmitting the unique identifier to the first mobile device when the first authentication request of the first user for at least one of the information in the list is received from the first mobile device;
Transmitting information on the fact of requesting information access authentication to a second mobile device of a second user having an authentication right of information access when generating the unique identifier;
Authenticating the access of the first user by comparing the unique identifier transmitted from the first mobile device to the second mobile device when the unique identifier transmitted from the second mobile device is received from the second mobile device;
Generating a new unique identifier for maintaining authentication and transmitting the new unique identifier to the first and second mobile devices after authenticating access of the first user; And
And maintaining or revoking the information access authentication based on the new unique identifier. The method according to claim 1,
Wherein the unique identifier is included in a visually displayable image code. 3. The method of claim 2,
The first mobile device outputs the image code to a display,
Wherein the second mobile device captures the image code through a camera to obtain the unique identifier. delete The method according to claim 1,
And canceling the information access authentication of the first user when receiving an authentication revocation request from the second user. The method according to claim 1,
Wherein the user information comprises a user ID, a password, and an international mobile device identification code (IMEI). The method according to claim 1,
Wherein the transmission of information about the information access authentication request fact is performed using at least one of an e-mail, an SMS, and a push message. A database server in which information is stored; And
An authentication server for processing login authentication according to a login request of a first user and information access authentication according to an access authentication request for specific information of a first user,
The authentication server includes:
Authenticating the login of the first user by comparing the user information received from the first mobile device of the first user with previously registered user information;
Transmitting to the first mobile device a list of information that the first user can provide or requested by the first user;
Generating a unique identifier and transmitting the unique identifier to the first mobile device when the first authentication request of the first user for at least one of the information in the list is received from the first mobile device;
Transmitting information on the authentication request to the second mobile device of the second user having the authentication right of the information access when the unique identifier is generated;
Authenticating the access of the first user by comparing the unique identifier transmitted from the first mobile device to the second mobile device when the unique identifier transmitted from the second mobile device is received from the second mobile device;
Generating a new unique identifier for maintaining authentication and transmitting the new unique identifier to the first and second mobile devices after authenticating access of the first user; And
And maintaining or revoking an information access authentication based on the new unique identifier. A cooperative based user authentication application stored in a computer readable storage medium, the cooperative user authentication application being executable by a processor of a first mobile device,
A process for requesting a user login to an authentication server according to a login request of a first user;
A process for transmitting an information access authentication request to the authentication server when the first user selects information to be accessed;
A process of converting a unique identifier received from the authentication server into a form that can be input to a second mobile device of a second user having an authentication right of information access;
A process for transmitting information on the fact of requesting the information access authentication to the second mobile device of the second user;
A process for outputting the access-permitted information to the output means as the second mobile device transmits the unique identifier input to the second mobile device to the authentication server and the authentication server permits the information access;
A process for generating a new unique identifier for maintaining the authentication after authenticating the access of the first user and transmitting the new unique identifier to the first and second mobile devices; And
And executes a process for maintaining or revoking an information access authentication based on the new unique identifier. 10. The method according to claim 9,
And converting the unique identifier into a form of an image code visually displayable on a display. 10. The method of claim 9,
Further comprising processing for pre-registering user information in the authentication server,
Wherein the user information comprises a user ID, a password, and an international mobile device identification code (IMEI). 12. The method of claim 11,
Wherein the password is unidirectional hashed using an international mobile device identification code (IMEI) as a salt (SALT). 10. The method of claim 9,
Wherein the first mobile device is coupled to the second mobile device via short-range wireless communication. 14. The method of claim 13,
Based on the short-range wireless signal broadcast by the second mobile device, performs a process of maintaining or canceling authentication based on the short-range wireless signal broadcast by the second mobile device. 15. The method of claim 14,
Characterized by performing a process of canceling the authentication when the unique identifier included in the near-field wireless signal is inconsistent with the unique identifier received from the authentication server, the received electric field strength is lower than the predetermined value, or the signal is not received Based user authentication application stored in a computer-readable recording medium.

Images