KR101946044B1 - Method for authenticating user and apparatus therefor - Google Patents

Abstract

The present invention relates to a user authentication method for performing authentication based on an input trajectory dragged according to an authentication graphics, and an apparatus therefor. According to another aspect of the present invention, there is provided a method of authenticating a user in accordance with an input trajectory coordinate of an authentication diagram for use in an authentication server according to an exemplary embodiment of the present invention includes: calculating a plurality of coordinates and connecting the plurality of coordinates to generate an authentication diagram; Transmitting the authentication graphic to the user terminal; Receiving input trajectory coordinates from the user terminal that senses a drag input according to the authentication graphics; And comparing the input locus coordinate with the calculated plurality of coordinates to authenticate the user.

Description

TECHNICAL FIELD The present invention relates to a method for authenticating a user,

The present invention relates to a user authentication technique, and more particularly, to a user authentication method and apparatus for performing authentication based on an input trajectory dragged according to an authentication graphic form.

Today, a variety of technologies have been developed to authenticate users and are used in real life. In particular, a technique for authenticating a user by using a short text message or using an OTP (One Time Password) is used to confirm whether or not the user currently occupies the mobile communication terminal.

As disclosed in Korean Patent Registration No. 10-1339723, existing technologies that use an OTP (One Time Password) method to perform terminal occupancy authentication for a user must have a separate OTP terminal, There is a problem that the user burden cost and the system construction cost increase and the user convenience is deteriorated.

In addition, as disclosed in Korean Patent Laid-Open Publication No. 10-2009-0097036, existing technologies using a Short Message Service (SMS) reception method to perform terminal occupancy authentication for a user receive SMS and write It is necessary to input the authentication number to the occupied authentication target terminal, which lowers user convenience and increases the communication service cost because a separate SMS fee is charged when the actual communication service is used.

Further, existing technologies have a problem that the authentication procedure is complicated and intuitiveness and user accessibility are inadequate because the user authentication procedure and the terminal occupancy authentication procedure for the user are performed in separate procedures.

SUMMARY OF THE INVENTION The present invention has been proposed in order to solve the above problems, and it is an object of the present invention to provide a user authentication method and an apparatus for improving user convenience while reducing the cost of user burden and establishing an authentication system, .

Other objects and advantages of the present invention will become apparent from the following description, and it will be understood by those skilled in the art that the present invention is not limited thereto. It will also be readily apparent that the objects and advantages of the invention may be realized and attained by means of the instrumentalities and combinations particularly pointed out in the appended claims.

According to a first aspect of the present invention, there is provided a method for authenticating a user in accordance with an input locus coordinate of an authentication object diagram in an authentication server, the method comprising: calculating a plurality of coordinates, ; Transmitting the authentication graphic to the user terminal; Receiving input trajectory coordinates from the user terminal that senses a drag input according to the authentication graphics; And comparing the input locus coordinate with the calculated plurality of coordinates to authenticate the user.

According to a second aspect of the present invention, there is provided an apparatus for authenticating a user according to coordinates of an input trajectory of an authentication graphic, comprising: a coordinate calculation unit for calculating a plurality of coordinates; Generating an authentication use figure by connecting the plurality of coordinates and transmitting the generated authentication use figure to a user terminal; And a user authentication unit for authenticating the user by comparing and analyzing the input trajectory coordinates and the calculated plurality of coordinates when the input trajectory coordinates are received from the user terminal that senses the drag input according to the authentication use figure .

According to a third aspect of the present invention, there is provided a method for authenticating a user in accordance with an input locus coordinate of an authentication diagram for use in an authentication server, the method comprising: calculating a plurality of coordinates; ; Receiving input trajectory coordinates from the user terminal that senses a drag input according to the authentication graphics generated based on the plurality of coordinates; And comparing the input locus coordinate with the calculated plurality of coordinates to authenticate the user.

And at least one processor according to the fourth aspect of the present invention for achieving the above object; Memory; And one or more programs stored in the memory and configured to be executed by the one or more processors, the program comprising: an interface for displaying one or more authentication diagrams based on data received from an authentication server; An interface module for generating and outputting; And a coordinate acquiring module for acquiring input trajectory coordinates in which coordinates are successively recorded according to a drag input when the user drag input is detected according to the authentication graphic form and transmitting the input trajectory coordinates as authentication information to the authentication server .

According to the present invention, authentication of an input trajectory is performed by using an input means already built in a user terminal such as a mouse, a touch screen, a touch pad, etc., thereby reducing the cost of manufacturing the authentication device and the cost of constructing the authentication system.

Further, authentication is performed through the input locus coordinates obtained based on the authentication graphic form, without the procedure of SMS reception or PIN number entry, thereby reducing communication service cost and improving user convenience.

In addition, by requesting the user to input a drag according to the authentication type graphic for authentication success, a game element can be added to the authentication procedure, thereby enhancing the intuitiveness and accessibility of the authentication procedure and inducing the user's interest.

Further, since the authentication is performed through the newly generated authentication graphic every time the authentication is performed, there is an advantage that the security of the authentication procedure is maintained.

BRIEF DESCRIPTION OF THE DRAWINGS The accompanying drawings, which are incorporated in and form a part of the specification, illustrate exemplary embodiments of the invention and, together with the description, serve to explain the principles of the invention. And shall not be construed as limited to such matters.
1 is a diagram showing a configuration of an authentication system according to an embodiment of the present invention.
2 is a diagram illustrating a configuration of an authentication server according to an embodiment of the present invention.
3 is a diagram illustrating a configuration of a user terminal according to an embodiment of the present invention.
4 is a diagram showing an authentication program according to an embodiment of the present invention.
FIG. 5 is a flowchart illustrating a method of authenticating a user by analyzing a user's input locus coordinates in an authentication server according to an exemplary embodiment of the present invention. Referring to FIG.
6 is a diagram showing an authentication interface in which an authentication graphic is displayed according to an embodiment of the present invention.
FIG. 7 is a flowchart illustrating a method for authenticating a user by analyzing a user's input locus coordinates in an authentication server according to another embodiment of the present invention.
8 is a diagram showing an authentication interface in which an authentication graphic is displayed according to another embodiment of the present invention.
9 is a diagram illustrating an authentication interface according to another embodiment of the present invention.

The foregoing and other objects, features and advantages of the present invention will become more apparent from the following detailed description of the present invention when taken in conjunction with the accompanying drawings, in which: There will be. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail. Hereinafter, a preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram showing a configuration of an authentication system according to an embodiment of the present invention.

1, an authentication system according to an exemplary embodiment of the present invention includes a user terminal 100, a service providing server 300, and an authentication server 200, which are connected to each other via a communication network 400 Communication. Here, the communication network 400 is a network that performs communication between devices such as a mobile communication network, a wired communication network, and the like, and corresponds to a well-known conventional technology in the present invention, and thus a detailed description thereof will be omitted.

The user terminal 100 is a communication device such as a communication network 400 and a smart phone, an IPTV (Internet Protocol Television), a tablet PC, a notebook computer, a desktop computer, etc., ) Or the authentication server (200). In particular, when the user terminal 100 receives the authentication use figure (see FIGS. 6, 8, and 9) from the authentication server 200, the user terminal 100 transmits the input log coordinates dragged according to the authentication use figure to the authentication server 200 After that, if the authentication is successful, the online service can be provided from the service providing server 300.

The authentication graphic is generated as graphic information such as a line, an arrow, a circle, a graphic, a polygon, and the like, and is displayed on the user terminal 100. The authentication graphics may include movement path information (e.g., an arrow, starting point, etc.) requesting a drag from a start point to an end point, and may include an inflection point at which the input direction changes.

The input trajectory coordinates are data in which input coordinates (e.g., touch coordinates, mouse coordinates) dragged by the user on the authentication interface are sequentially recorded according to the input time, and include a plurality of coordinate values.

The service providing server 300 is a server for providing online services such as a portal service, a game service, an SNS service, and a financial service through the communication network 400 and may be various types of servers such as a web server, have.

The authentication server 200 performs data communication with the user terminal 100 through the communication network 400 and provides authentication type diagrams to the user terminal 100 for terminal occupancy authentication or user identity authentication, Then, user authentication is performed by analyzing input trajectory coordinates dragged by the user.

2 is a diagram illustrating a configuration of an authentication server according to an embodiment of the present invention.

2, the authentication server 200 according to an exemplary embodiment of the present invention includes a transmitting / receiving unit 210, a coordinate calculating unit 220, a graphic formatter 230 for authentication, a user authentication unit 240, . The transmission / reception unit 210, the coordinate calculation unit 220, the graphic formatter 230 for authentication, and the user authentication unit 240 may be implemented by software or hardware, or may be implemented by software and hardware in the authentication server 200 Can be implemented. In addition, the authentication server 200 may include one or more processors and a memory, and the transmitter / receiver 210, the coordinate calculator 220, the graphic formatter 230 for authentication, and the user authentication unit 240 May be stored in the memory in the form of a program executed by the processor and capable of implementing the following methods.

The transceiver unit 210 communicates with the communication network 400 to transmit or receive various data.

The coordinate calculation unit 220 calculates the starting point coordinates, the inflection point coordinates, and the end point coordinates, which are bases for generating the authentication graphic form.

The starting point coordinate is a pixel coordinate which is a starting point in a touch drag or a mouse drag, and the end point coordinate is a pixel coordinate in which a touch drag or an end point of a mouse drag becomes an end point. The inflection point coordinates are pixel coordinates for a point where the direction of the line changes, and are located between the starting point coordinates and the end point coordinates in the authentication graphics. The coordinate calculation unit 220 may calculate one or more inflection point coordinates and may not calculate the inflection point coordinates. A plurality of the inflection point coordinates may exist in the starting point coordinate and the end point coordinate, and in this case, the order of the inflection point coordinates is given.

The coordinate calculation unit 220 may generate a disposable random number at a certain position and then apply the disposable random number as a seed to a coordinate calculation algorithm to calculate a starting point coordinate, an inflection point coordinate, and an end point coordinate. The disposable random number is a number generated every authentication time, such as OTP, and is not reusable.

When the disposable random number is "123456 ", the first two digits" 12 ", the seed number used to calculate the starting point coordinate, the middle two digits "34 ", the seed number used to calculate the inflection point coordinate, The last "56" can be used as the seed number used to calculate the end point coordinates. As another example, the coordinate calculation unit 220 generates a plurality of disposable random numbers used as a seed in each of a starting point coordinate, an inflection point coordinate, and a starting point coordinate, and applies each random number to a coordinate calculation algorithm to calculate a starting point coordinate, And the starting point coordinates, respectively.

The coordinate calculation algorithm is a program for deriving a result value corresponding to a two-dimensional coordinate value by a mathematical operation (e.g., arithmetic operation, module plus operation, etc.) of the disposable random number, and a variable or constant applied to the inside is periodically can be changed. Further, the start point coordinate, the end point coordinate, and the inflection point coordinate are changed each time the authentication is performed by the disposable random number.

The authentication diagram providing unit 230 functions to provide one or more authentication use figures to the user terminal 100. [ The authentication graphic formatter 230 generates an authentication graphic form based on the starting point coordinate, the end point coordinate, and the inflection point coordinate calculated by the coordinate computing unit 220, and transmits the authentication graphic to the user terminal 100. The authentication graphic formatter 230 can display the direction information for guiding the drag direction on the authentication graphic form. 6A, the graphic rendering unit 230 for authentication displays the starting point 61 in the form of a circle, expresses the end point 62 in the shape of an arrow, and sequentially inputs the input from the starting point to the end point 62 along the graphic (I.e., drag input).

In this case, the authentication graphic modeling unit 230 for authentication can transmit all of the plurality of authentication graphic patterns to the user terminal 100 at one time. And may transmit a plurality of authentication vectors to the user terminal 100 sequentially one by one at intervals of time.

When transmitting the authentication graphic form to the user terminal 100, the authentication graphic formatter 230 intuitively informs the user terminal 100 of a control message (for example, a vibration generation signal or a sound generation signal) So that an input request signal such as vibration is generated in the user terminal 100, so that the user can input the input signal within a predetermined time.

The user authentication unit 240 determines whether the input trajectory dragged by the user is correct or not, and authenticates the user. When the input trajectory coordinates of the user terminal 100 are received through the transceiver 210, the user authenticating unit 240 determines whether or not the input trajectory coordinates include the starting point coordinates, the inflection point coordinates, the end point coordinates And confirms whether or not the input order of the starting point coordinates, inflection point coordinates, and end point coordinates is correct, thereby performing user authentication. The user authentication unit 240 records the start point coordinates, the inflection point coordinates, and the end point coordinates generated by the coordinate calculation unit 220 in the input locus coordinates, and writes the input locus coordinates in the order of the start point coordinates, the inflection point coordinates, If the authentication is successful, it is regarded as a successful authentication of the user. Also, the user authentication unit 240 transmits the result of the user authentication to the service providing server 300.

The user authentication unit 240 confirms the time at which the input trajectory coordinates are received through the transmission / reception unit 210, checks whether or not user input is made within a preset time (for example, one minute) based on the time, If the set time is exceeded, the authentication failure may be handled.

3 is a diagram illustrating a configuration of a user terminal according to an embodiment of the present invention.

3, a user terminal 100 according to one embodiment of the present invention includes a memory 110, a memory controller 121, one or more processors (CPU) 122, a peripheral interface 123, An input / output (I / O) subsystem 130, a display device 141, an input device 142 and a communication circuit 150. These components communicate through one or more communication buses or signal lines. The various components shown in FIG. 3 may be implemented in hardware, software, or a combination of both hardware and software, including one or more signal processing and / or application specific integrated circuits.

The memory 110 may include a high-speed random access memory and may also include one or more magnetic disk storage devices, non-volatile memory such as a flash memory device, or other non-volatile semiconductor memory device. In some embodiments, memory 110 may include a storage device, e.g., communication circuitry 150, located remotely from one or more processors 122, and an Internet, intranet, Local Area Network (WLAN) , A Storage Area Network (SAN), or the like, or any suitable combination thereof. Access to the memory 110 by other components of the user terminal 100, such as the processor 122 and the peripheral interface 123, may be controlled by the memory controller 121.

The peripheral interface 123 connects the input / output peripheral of the device with the processor 122 and the memory 110. The one or more processors 122 execute various software programs and / or a set of instructions stored in the memory 110 to perform various functions and process data for the user terminal 100.

In some embodiments, peripheral interface 123, processor 122, and memory controller 121 may be implemented on a single chip, such as chip 120. In some other embodiments, these may be implemented as separate chips.

The I / O subsystem 130 provides an interface between the input / output peripheral of the user terminal 100, such as the display device 141, the input device 142, and the peripheral interface 123.

The display device 141 may be a liquid crystal display (LCD) technology, a light emitting polymer display (LPD) or a light emitting diode (LED) Lt; / RTI > The touch display provides an output interface and an input interface between the device and the user. The touch display displays a visual output to the user. The visual output may include text, graphics, video, and combinations thereof. Some or all of the visual output may correspond to a user interface object. The touch display forms a touch sensitive surface that accommodates user input.

The input device 142 is an input means such as a keypad, a keyboard, a mouse, and the like, and receives a user's input signal.

Processor 122 is a processor configured to perform an operation associated with user terminal 100 and to perform instructions, such as, for example, using instructions retrieved from memory 110, Reception and manipulation of data can be controlled.

The communication circuit 150 transmits / receives wireless electromagnetic waves through an antenna or transmits / receives data through a wired cable. The communication circuit 150 converts electrical signals to electromagnetic waves and vice versa, and is capable of communicating with the communication network, other mobile gateway devices, and communication devices through the electromagnetic waves. The communication circuit 150 includes, for example, an antenna system, an RF transceiver, one or more amplifiers, a tuner, one or more oscillators, a digital signal processor, a CODEC chipset, a subscriber identity module But are not limited to, well known circuits for performing such functions. The communications circuitry 150 may be implemented over a wireless or wired network, such as the Internet, an intranet and a network and / or mobile communications network, a wireless LAN, and / or a metropolitan area network (MAN), referred to as the World Wide Web And can communicate with other devices.

An operating system 111, a graphic module (instruction set) 112 and an authentication program (instruction set) 113 which are software components are mounted (installed) in the memory 110.

The operating system 111 may be an embedded operating system such as, for example, Darwin, RTXC, LINUX, UNIX, OS X, WINDOWS, VxWorks, Tizen, IOS or Android, For example, memory management, storage device control, power management, and the like).

Graphics module 112 includes a number of well known software components for providing and displaying graphics on display device 141. The term "graphic" includes all objects that can be displayed to a user, including without limitation text, web pages, key buttons, digital images, video,

The authentication program 113 is a program for performing user authentication in cooperation with the authentication server 200. The authentication program 113 provides an authentication interface to a user and acquires the input locus coordinates input by the user and transmits the input locus coordinates to the authentication server 200. [

The authentication program 113 may be loaded into the memory 110 when the authentication application according to the present invention is installed.

4, an authentication program 113 according to an exemplary embodiment of the present invention includes a coordinate acquisition module 41, a server interworking module (" 42 and an interface module 43.

The server interworking module 42 is a module that interlocks with the authentication server 200 through the communication circuit 150. [ That is, the server interworking module 42 receives one or more authentication use figures from the authentication server 200. As another embodiment, the server interworking module 42 may receive a plurality of coordinates from the authentication server 200. [ In addition, the server interworking module 42 transmits the input locus coordinates acquired by the coordinate acquisition module 41 to the authentication server 200.

The interface module 43 outputs the authentication interface to which the authentication graphic is outputted to the display device 141, and performs graphic processing on the authentication interface. Specifically, when the interface use module 43 receives the authentication use figure from the server interworking module 42, the interface module 43 displays the authentication use figure, generates an authentication interface for requesting the user to input according to the authentication use figure, Lt; / RTI > When the interface for authentication is displayed, the interface module 43 can output an input request signal such as vibration, sound, and the like. Further, in a state in which a plurality of authentication-use graphics are output to the authentication interface, the interface module 43 performs the vibration, the authentication, and the authentication at every time when dragging of one authentication graphic is completed and dragging for the next authentication- An input request signal such as sound can be output each time.

In addition, when the graphic form for authentication is dragged, the interface module 43 can display the dragged degree on the authentication interface by filling the interval in which the authentication input is performed among the entire input section with the color identified with another interval have.

When the graphic object for authentication is dragged in the authentication interface, the coordinate acquisition module 41 acquires the input locus coordinate in which the input coordinates are successively recorded in accordance with the drag input. That is, the coordinate acquisition module 41 generates input trajectory coordinates in which, when the user drags the authentication graphics, the detected coordinates are recorded in time order. When the user's input (i.e., drag) is completed on the authentication interface, the coordinate acquisition module 41 transmits the obtained input locus coordinates to the authentication server 200, and requests the user authentication.

FIG. 5 is a flowchart illustrating a method of authenticating a user by analyzing a user's input locus coordinates in an authentication server according to an exemplary embodiment of the present invention. Referring to FIG.

6 is a diagram showing an authentication interface in which an authentication graphic is displayed according to an embodiment of the present invention.

Referring to FIGS. 5 and 6, the user terminal 100 accesses the service providing server 300 to request a specific service (S501). Then, the service providing server 300 determines whether the requested service is a service requiring authentication. If the requested service is a service requiring authentication, the authentication server 200 requests the authentication server 200 to authenticate the user terminal 100 (S503). For example, when the requested service is a service requiring occupancy authentication, the service providing server 300 may request the authentication server 200 to authenticate the user terminal 100.

Then, the transmission / reception unit 210 of the authentication server 200 receives the authentication request, and the coordinate calculation unit 220 generates a disposable random number having a predetermined number of digits (S505). At this time, the coordinate calculation unit 220 of the authentication server 200 can generate one random number and generate a plurality of random numbers.

Next, the coordinate calculation unit 220 calculates the start point coordinate, the inflection point coordinate, and the end point coordinate by applying the generated disposable random number as a seed to the coordinate calculation algorithm (S507). Depending on the seed, which is used for the coordinate calculation algorithm, the inflection point coordinates may not be calculated, or a plurality of points may be calculated. In one embodiment, when one random number is generated, the coordinate calculation unit 220 can calculate both the starting point coordinates, the inflection coordinates, and the end point coordinates using this one random number. In another embodiment, when a plurality of random numbers are generated as a random number, for example, when a plurality of random numbers such as a starting point random number, an inflection point random number, and an end point random number are generated, the coordinate calculating unit 220 calculates it is possible to calculate the starting point coordinate, the inflection point coordinate, and the end point coordinate using a seed.

Next, the authentication graphic formatter 230 generates an authentication graphic form based on the coordinates of the starting point, the coordinates of the end point, and the coordinates of the inflection point calculated by the coordinate computing unit 220, and transmits the authentication graphic to the user terminal 100 (S509, S511). That is, the authentication graphic formatter 230 for authentication generates an authentication graphic to which the starting point coordinates, the inflection point coordinates, and the end point coordinates are sequentially connected, and transmits them to the user terminal 100. When a plurality of inflection point coordinates are present, the authentication use pattern providing unit 230 generates an authentication use figure such that the inflection points are connected in accordance with the order of the calculated inflection point coordinates. For example, when four inflection point coordinates and a creation order are the first inflection point coordinates, the second inflection point coordinates, the third inflection point coordinates, and the fourth inflection point coordinates, the authentication pattern providing unit 230 for authentication uses the starting point coordinates, the first inflection point coordinates, The second inflection point coordinate, the third inflection point coordinate, the fourth inflection point coordinate, and the end point coordinate are sequentially connected to generate an authentication use figure.

Then, the interface module 43 of the user terminal 100 generates an authentication interface (see FIG. 6) in which the authentication graphic is displayed and outputs it to the display device 141 (S513). When the interface module 43 outputs the authentication interface, the interface module 43 generates an input request signal (e.g., a vibration signal) requesting a drag input so that the user can input the input signal within a predetermined time. As another embodiment, when providing the authentication graphic form, the authentication graphic formatter 230 of the authentication server 200 transmits a message instructing the generation of the input request signal to the user terminal 100, The authentication server 200 can control that the user terminal 100 outputs an input request signal.

Referring to FIG. 6, it is again described that an authentication graphic is generated and displayed. 6 includes four inflection points 63 to 66, one starting point 61, and one ending point 62 in the authentication use figure displayed on the authentication interface in Fig. More specifically, when the coordinate calculation unit 220 of the authentication server 200 calculates one starting point coordinate, four inflection point coordinates, and one end point coordinate corresponding to the respective point positions in FIG. 6A, the authentication of the authentication server 200 The use pattern providing unit 230 may generate an authentication use figure as shown in FIG. 6A, connecting the starting point coordinates, the four inflection point coordinates, and the end point coordinates. As shown in FIG. 6A, the authentication graphic formatter 230 for authentication may represent a start point 61 in a circular form, an end point 62 in an arrow shape, and a continuous input That is, a drag input) can be induced.

When the user performs the drag input, the coordinate acquisition module 41 acquires the input trajectory coordinates in which the coordinates detected according to the input drag are recorded in time order (S515). At this time, when the input of the user is started, the interface module 43 displays the dragged state on the authentication interface by filling the dragged section of the entire input section with the color different from the other sections. FIG. 6B shows that a section dragged by the user is displayed in the entire section of the authentication graphic form.

When the dragging of the user is completed, the coordinate acquiring module 41 transmits the acquired input locus coordinates to the authentication server 200 through the server linking module 42 (S517).

Next, the transmission / reception unit 210 of the authentication server 200 receives the input locus coordinates, and the user authentication unit 240 confirms input coordinates, inflection point coordinates, and end point coordinates calculated by the coordinate calculation unit 220 , And performs the user authentication by comparing and analyzing the confirmed coordinates and the received input locus coordinates (S519, S521). That is, the user authentication unit 240 determines whether or not the input coordinates of the starting point, the inflection point, and the end point calculated by the coordinate calculating unit 220 are all included in the input trajectory coordinates and the input sequence of the starting point coordinates, the inflection point coordinates, Is authenticated, thereby performing user authentication.

The user authentication unit 240 determines whether the input order coordinates of the starting point coordinates, the inflection point coordinates, and the end point coordinates are correct in the input trajectory coordinates calculated by the coordinate calculation unit 220, The user authentication process is successful. On the other hand, the user authentication unit 240 may determine that the starting point coordinates, the inflection point coordinates, and the end point coordinates calculated by the coordinate calculation unit 220 are not all included in the input trajectory coordinates, or the input of the starting point coordinates, the inflection point coordinates, If the order is incorrect, user authentication fails.

The user authentication unit 240 of the authentication server 200 transmits the user authentication result to the service providing server 300 using the transmission / reception unit 210 (S523).

Next, when the authentication result is successful, the service providing server 300 provides the online service requested by the user terminal 100 to the user terminal 100 (S525).

Meanwhile, the authentication server 200 may sequentially transmit a plurality of authentication graphic forms to the user terminal 100 to authenticate the user.

Another embodiment of the present invention in which the authentication server 200 authenticates a user using a plurality of authentication graphic forms will be described with reference to FIGS. 7 and 8. FIG.

FIG. 7 is a flowchart illustrating a method for authenticating a user by analyzing a user's input locus coordinates in an authentication server according to another embodiment of the present invention.

8 is a diagram showing an authentication interface in which an authentication graphic is displayed according to another embodiment of the present invention.

Referring to FIGS. 7 and 8, the user terminal 100 accesses the service providing server 300 and requests a specific service (S701). If the requested service is a service requiring authentication, the service providing server 300 requests the authentication server 200 to authenticate the user terminal 100 (S703).

Then, the coordinate calculation unit 220 of the authentication server 200 generates a disposable random number having a predetermined number of digits (S705). Next, the coordinate calculation unit 220 calculates the start point coordinate, the inflection point coordinate, and the end point coordinate by applying the generated disposable random number as a seed to the coordinate calculation algorithm (S707). At this time, the coordinate calculation unit 220 may calculate only the starting point coordinate and the end point coordinate according to the disposable random number, and may not calculate the inflection point coordinate.

Next, the authentication graphic formatter 230 generates a first authentication graphic form connected with the coordinates of the starting point, the inflection point, and the end point calculated by the coordinate computing unit 220, and transmits the first authentication graphic to the user To the terminal 100 (S709, S711). If there is no inflection point coordinate, the authentication diagram providing unit 230 directly connects the starting point coordinate and the end point coordinate to generate an authentication drawing figure.

Then, the interface module 43 of the user terminal 100 generates an authentication interface in which the first authentication graphic form is displayed and outputs it to the display device 141 (S713). When outputting the authentication interface, the interface module 43 generates an input request signal (for example, vibration) for requesting an authentication input so that the user can make an input within a predetermined time. As another embodiment, when providing the first authentication graphic form, the authentication graphic formatter 230 of the authentication server 200 transmits a message instructing the generation of the input request signal to the user terminal 100 , The input request signal can be output from the user terminal 100 under the control of the authentication server 200. [

8A shows a first authentication graphic form. In the first authentication graphic form 81 displayed on the authentication interface in Fig. 8A, there is no inflection point, only the starting point 81a and the end point 81b exist.

When the user performs the drag input from the start point 81a to the end point 81b, the coordinate acquisition module 41 acquires the first input locus coordinate in which the coordinates sensed according to the input drag are recorded in time order (S715 ). At this time, when the input of the user is started, the interface module 43 can display the dragged state on the authentication interface by filling the dragged section of the entire input section with the color different from the other sections.

When the dragging of the user is completed, the coordinate acquisition module 41 transmits the acquired first input locus coordinates to the authentication server 200 through the server link module 42 (S717).

Next, the user authentication unit 240 confirms the input coordinates, the inflection point coordinates, and the end point coordinates calculated by the coordinate calculation unit 220 in step S707, and checks the starting point coordinates, the inflection point coordinates, and the end point coordinates of the first input locus (Step S719). The first input trajectory coordinates are analyzed and checked to determine whether the input order of the starting point coordinates, the inflection point coordinates, and the end point coordinates is correct (S719).

If the user authentication fails, the service providing server 300 notifies the authentication failure, and the service providing server 300 does not provide the requested service to the user terminal 100.

On the other hand, if the primary authentication is successful, the user authentication unit 240 generates a new single-use random number for additional secondary authentication (S721). Then, the coordinate calculation unit 220 calculates the new starting point coordinate, the inflection point coordinate, and the end point coordinate by applying the newly generated disposable random number as a seed to the coordinate calculation algorithm (S723). Next, the authentication diagram providing unit 230 generates a second authentication use figure to which the coordinates of the starting point, the coordinates of the inflection point, and the coordinates of the end point calculated by the coordinate calculating unit 220 are connected, and transmits the generated second authentication drawing to the user terminal 100 S725, S727).

Then, the interface module 43 of the user terminal 100 removes the first authentication use figure from the authentication interface and exposes the second authentication use figure (S729). At this time, when the interface module 43 outputs the authentication interface, the interface module 43 may generate an input request signal (e.g., a vibration signal) requesting an authentication input so that the user can input the input signal within a predetermined time. As another embodiment, when providing the second authentication graphic form, the authentication graphic formatter 230 of the authentication server 200 transmits a message instructing the generation of the input request signal to the user terminal 100 , The authentication request signal can be output from the user terminal 100 under the control of the authentication server 200. [

FIG. 8B illustrates a second authentication graphic form. The second authentication graphic 82 displayed on the authentication interface of FIG. 8B includes a start point 82a, an inflection point 82c, and an end point 82b.

When the user performs the drag input from the start point 82a to the end point 82b along the second authentication graphics, the coordinate acquisition module 41 determines that the coordinate detected according to the input drag is the second The input locus coordinates are obtained (S731). At this time, when the input of the user is started, the interface module 43 can display the dragged state on the authentication interface by filling the dragged section of the entire input section with the color different from the other sections.

When the dragging of the user is completed, the coordinate acquiring module 41 transmits the acquired second input locus coordinates to the authentication server 200 through the server linking module 42 (S733).

Next, the user authentication unit 240 confirms the input coordinates, the inflection point coordinates, and the end point coordinates calculated by the coordinate calculation unit 220 in step S723, and checks the starting point coordinates, the inflection point coordinates, and the end point coordinates of the second input locus (Step S735). In step S735, it is determined whether the input order of the starting point coordinates, the inflection point coordinates, and the end point coordinates is correct in the second input locus coordinates.

The user authenticating unit 240 determines that the input coordinates of the starting point, the inflection point, and the end point calculated by the coordinate calculating unit 220 in the step S723 are all included in the input trajectory coordinates and the input order of the starting point coordinates, the inflection point coordinates, If it is correct, the user authentication is processed successfully. On the other hand, if the starting point coordinates, the inflection point coordinates, and the end point coordinates calculated by the coordinate calculating unit 220 in step S723 are not all included in the input trajectory coordinates, or if the starting point coordinates, the inflection point coordinates, The user authentication is failed.

The user authentication unit 240 of the authentication server 200 transmits the user authentication result to the service providing server 300 using the transmission / reception unit 210 (S737).

If the authentication result is successful, the service providing server 300 provides the online service requested by the user terminal 100 to the user terminal 100 (S739). That is, the service providing server 300 provides the service to the user terminal 100 when the authentication server 200 succeeds both in the primary authentication and the secondary authentication.

7 and 8, it has been described that two authentication graphics are generated and the user is authenticated via the secondary. However, the present invention is not limited to this, and three or more authentication graphics may be generated To the user terminal 100, and the authentication server may additionally authenticate the user in proportion to the number of figures for authentication.

As another embodiment of the present invention, the authentication server 200 can generate a plurality of authentication use figures, and all of the authentication use figures can be transmitted all at once. In this case, the coordinate calculation unit 220 calculates the starting point coordinates, the end point coordinates, and the inflection point coordinates as the bases of the generation of each figure for authentication, for each authentication use figure, and the authentication use type providing unit 230 And transmits the generated graphic form to the user terminal 100. [ At this time, the authentication graphic formatter 230 transmits the input order information of the authentication graphic form to the user terminal 100.

Then, the interface module 43 of the user terminal 100 generates an authentication interface in which a plurality of authentication graphic forms are all displayed, and outputs the generated authentication interface to the display device 141. At this time, the interface module 43 can display the dragging order information for each graphic form for authentication to the authentication interface.

9 is a diagram showing an authentication interface according to another embodiment of the present invention. The authentication interface according to Fig. 9 includes a plurality of authentication use figures 91, 92, and 93, At the starting points 91a, 92a and 93a of the graphic form, numbers indicating the drag sequence are recorded.

Next, the coordinate acquisition module 41 of the user terminal 100 monitors the input of the user and, when a drag of the user is detected, obtains a drag input for each authentication use figure and acquires input trajectory coordinates for each authentication use figure . At this time, when the interface for authentication is outputted, the interface module 43 outputs an input request signal such as vibration or the like to recognize that the user needs to input the authentication intuitively, and when the authentication for the specific authentication purpose is completed, When there remains a graphic form for authentication that requires input, an input request signal may be output to intuitively inform the user of the input of the next graphic form for authentication.

The coordinate acquisition module 41 of the user terminal 100 transmits the input trajectory coordinates for each authentication use figure to the authentication server 200 when the dragging of the entire authentication use figure is completed.

Then, the user authentication unit 240 of the authentication server 200 compares and analyzes the coordinates calculated by the coordinate calculation unit 220 and the received input locus coordinates according to the authentication use diagram to authenticate the user. The user authentication unit 240 checks whether or not the corresponding coordinates are included in the input trajectory coordinates based on the authentication use figure, whether or not the input order of the coordinates is correct, and also confirms whether or not the input order of the authentication use figure is correct Thereby authenticating the user.

As another embodiment, the authentication server 200 may transmit start point coordinates, inflection point coordinates, and end point coordinates to the user terminal 100, instead of generating an authentication use figure, and the user terminal 100 may transmit start point coordinates , Inflection point coordinates, and end point coordinates can be directly generated and output. In this case, the function of the authentication graphic formatter 230 of the authentication server 200 may be omitted, and the coordinate calculation unit 220 may calculate the calculated starting point coordinates, inflection point coordinates, and end point coordinates through the transmission / To the user terminal (100). Then, the interface module 43 of the user terminal 100 generates an authentication use figure for connecting the start point coordinates, the inflection point coordinates, and the end point coordinates received from the authentication server 200, And outputs it to the display device 141. At this time, the interface module 100 generates directional information indicating the direction of the drag input to generate the authentication graphic.

Also, the user authentication unit 240 of the authentication server 200 confirms the time at which the input locus coordinates are received through the transmission / reception unit 210, and inputs user inputs (e.g., 1 minute) within a preset time And if the set time is exceeded, it may be regarded as an authentication failure. At this time, the user authentication unit 240 determines whether the user has performed input for authentication within a preset time based on the interval between the time at which the authentication graphic form is transmitted to the user terminal 100 and the time at which the input locus coordinate is received Can be confirmed.

While the specification contains many features, such features should not be construed as limiting the scope of the invention or the scope of the claims. In addition, the features described in the individual embodiments herein may be combined and implemented in a single embodiment. Conversely, various features described in the singular < Desc / Clms Page number 5 > embodiments herein may be implemented in various embodiments individually or in combination as appropriate.

Although the operations have been described in a particular order in the figures, it should be understood that such operations are performed in a particular order as shown, or that all described operations are performed to obtain a sequence of sequential orders, or a desired result . In certain circumstances, multitasking and parallel processing may be advantageous. It should also be understood that the division of various system components in the above embodiments does not require such distinction in all embodiments. The above-described program components and systems can generally be implemented as a single software product or as a package in multiple software products.

The method of the present invention as described above can be implemented by a program and stored in a computer-readable recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto optical disk, etc.). Such a process can be easily carried out by those skilled in the art and will not be described in detail.

It will be apparent to those skilled in the art that various modifications and variations can be made in the present invention without departing from the spirit or scope of the invention. The present invention is not limited to the drawings.

100: user terminal 110: memory
111: Operating system 112: Graphics module
113: Authentication program 121: Memory controller
122: CPU 123: peripheral interface
130: I / O subsystem 141: Display device
142: Input device 150: Communication circuit
200: Authentication server 210: Transmitting /
220: Coordinate calculating unit 230: Coordinate calculating unit for authentication
240: user authentication unit 300: service providing server
400: communication network 41: coordinate acquisition module
42: server interworking module 43: interface module

Claims (14)

A method for authenticating a user in accordance with an input trajectory coordinate of an authentication purpose graphic form in an authentication server,
Generating one or more disposable random numbers;
Calculating the starting point coordinate, the inflection point coordinate and the end point coordinate using the disposable random number as a seed;
Connecting the start point coordinates, the inflection point coordinates, and the end point coordinates to generate an authentication use figure;
Transmitting the authentication graphic to the user terminal;
Receiving input trajectory coordinates from the user terminal that senses a drag input according to the authentication graphics; And
And comparing the input locus coordinate with the calculated plurality of coordinates to authenticate the user,
Wherein the step of generating the authentication-
Generates the authentication graphic using the direction information indicating the drag input direction,
Wherein the authenticating comprises:
Whether or not both the calculated starting point coordinates, inflection point coordinates, and end point coordinates are included in the input trajectory coordinates, and whether or not the starting point coordinates, the inflection point coordinates, and the end point coordinates are sequentially recorded in the input trajectory coordinates And authenticating the user. delete delete delete delete An apparatus for authenticating a user according to an input locus coordinate of an authentication purpose graphic,
A coordinate calculation unit for generating at least one disposable random number and calculating each of the starting point coordinate, the inflection point coordinate and the end point coordinate using the disposable random number as a seed;
Generating an authentication use figure by connecting the start point coordinate, the inflection point coordinate, and the end point coordinate, and transmitting the authentication use figure to the user terminal; And
And a user authentication unit that receives the input trajectory coordinates from the user terminal that senses a drag input according to the authentication graphic form and authenticates the user by comparing and analyzing the input trajectory coordinates and the calculated plurality of coordinates,
Wherein the authentication-
Generating directional information indicating a drag input direction in the authentication graphic, generating the authentication graphic,
Wherein the user authentication unit comprises:
Whether or not both the calculated starting point coordinates, inflection point coordinates, and end point coordinates are included in the input trajectory coordinates, and whether or not the starting point coordinates, the inflection point coordinates, and the end point coordinates are sequentially recorded in the input trajectory coordinates And authenticates the user. delete delete A method for authenticating a user in accordance with an input trajectory coordinate of an authentication purpose graphic form in an authentication server,
Generating one or more disposable random numbers;
Calculating start point coordinates, inflection point coordinates, and end point coordinates using the disposable random number as a seed, and providing the calculated starting point coordinates, inflection point coordinates, and end point coordinates to a user terminal;
Receiving input trajectory coordinates from the user terminal that senses a drag input according to an authentication diagram generated based on the start point coordinate, the inflection point coordinate, and the end point coordinate; And
And comparing the input locus coordinate with the calculated plurality of coordinates to authenticate the user,
Directional information indicating a drag input direction is included in the authentication graphics,
Wherein the authenticating comprises:
Whether or not both the calculated starting point coordinates, inflection point coordinates, and end point coordinates are included in the input trajectory coordinates, and whether or not the starting point coordinates, the inflection point coordinates, and the end point coordinates are sequentially recorded in the input trajectory coordinates And authenticating the user. One or more processors;
Memory; And
A communication device, comprising one or more programs stored in the memory and configured to be executed by the one or more processors,
The program includes:
A server interworking module for receiving start point coordinates, inflection point coordinates, and end point coordinates calculated by the authentication server on the basis of the disposable random number from the authentication server;
An interface module for generating and outputting an interface in which the authentication graphic is displayed by connecting the coordinates of the start point, the coordinates of the inflection point, and the coordinates of the end point received from the server interworking module; And
And a coordinate acquiring module for acquiring input trajectory coordinates in which coordinates are successively recorded according to a drag input when the user drag input is detected according to the graphic form for authentication and transmitting the input trajectory coordinates as authentication information to the authentication server ,
Wherein the interface module generates the authentication graphic using the direction information indicating the drag input direction,
Wherein when both the starting point coordinates, the inflection point coordinates, and the end point coordinates are included in the input trajectory coordinates, and the starting point coordinates, the inflection point coordinates, and the end point coordinates are sequentially recorded in the input trajectory coordinates, Is processed. delete delete 11. The method of claim 10,
Wherein the interface module comprises:
And displays progress of the drag input performed in accordance with the authentication graphics on the interface. 14. The method according to claim 10 or 13,
Wherein the interface module comprises:
Generates an interface in which a plurality of authentication graphic forms are displayed, and outputs an input request signal at each time when a drag input of each authentication graphic form is requested,
Wherein the coordinate acquisition module acquires the input trajectory coordinates for each of the authentication purpose graphics and transmits the acquired coordinates to the authentication server.

Images