KR102054424B1 - Service providing system and method for security supporting multi-channel authentication with user equipment, and non-transitory computer readable medium having computer program recorded thereon - Google Patents

Abstract

The present invention relates to a security service providing system and method for supporting multi-channel authentication with a user terminal, and a non-volatile recording medium on which a computer program is recorded. More particularly, the present invention relates to a user terminal supporting communication through different channels. A user who provides a one-time authentication information through a first channel and receives a one-time authentication information from a user terminal through a second channel and prompts the user to input the one-time authentication information upon authentication through a plurality of channels for authenticating the user. The present invention relates to a security service providing system and a method for supporting multi-channel authentication with a user terminal so as to increase the security by being authenticated by a user, and a nonvolatile recording medium on which a computer program is recorded. The present invention supports the authentication of the user to the server that requires authentication in addition to the authentication using a plurality of different channels for the user in the server providing a specific service to the user through the authentication between the service provider and the service user By preventing authentication information from being stolen in the transmission process, the authentication process using a special number that is difficult to forgery based on MO and MT service is supported on the server, thereby preventing hackers from manipulating the sender to guide users. As a result, the security of the authentication process can be greatly improved.

Description

Service providing system and method for security supporting multi-channel authentication with user equipment, and non-transitory computer readable medium having computer program recorded thereon}

The present invention relates to a security service providing system and method for supporting multi-channel authentication with a user terminal, and a non-volatile recording medium on which a computer program is recorded. More particularly, the present invention relates to a user terminal supporting communication through different channels. A user who provides a one-time authentication information through a first channel and receives a one-time authentication information from a user terminal through a second channel and prompts the user to input the one-time authentication information upon authentication through a plurality of channels for authenticating the user. The present invention relates to a security service providing system and a method for supporting multi-channel authentication with a user terminal so as to increase the security by being authenticated by a user, and a nonvolatile recording medium on which a computer program is recorded.

Currently, various services such as web services or application-based services are essentially equipped with various security services for user authentication.In addition to the development of hacking technologies, various authentication methods for improving the weaknesses of these security services have emerged. have.

Accordingly, a user authentication method using two-channel authentication has emerged by improving the security problem caused by the existing single-channel authentication that information is easily seized by only one-time hacking, and these two-channel authentication cross each other using different communication paths. This is to reduce the risk of hacking by performing authentication.

When using two channels, security is higher than using a single channel. However, since the hacking technique is being advanced and intelligent, the reliability of the authentication method is being lowered.

In particular, the existing two-channel authentication method performs authentication based only on the authentication process provided by the user through the authentication service, and no verification is performed by the user during the authentication process. If the user is sent to send the security information to the contact, there is a problem that the user's security information is easily hijacked by the hacker because no verification of the sender is performed.

Korean Laid-Open Patent No. 10-2000-0017997 [Name of the Invention: User Authentication System and Method for Internet Electronic Commerce using Wireless Communication Terminal]

The present invention supports the authentication of the user to the server that requires authentication in addition to the authentication using a plurality of different channels for the user in the server providing a specific service to the user through the authentication between the service provider and the service user The purpose of the present invention is to prevent authentication information for authentication from being stolen during transmission, and to prevent hackers from inducing a user by manipulating a sender, thereby increasing the security of multi-channel authentication.

In addition, an object of the present invention is to provide a security service that can increase the security without increasing the user's operation required in the existing multi-channel authentication process.

The security service providing method for supporting multi-channel authentication with a user terminal of a security service providing system including a first server and a second server communicating with a user terminal through a different communication network according to an embodiment of the present invention, The first server receives user identification information from the user terminal connected to the data network, and transmits authentication request information including terminal information on the user terminal preset in correspondence to the user identification information to the second server. The requesting step and the second server storing the randomly selected special number from the preset special number list corresponding to the authentication request information with the terminal information, generating the authentication information corresponding to the authentication request information, and then generating the selected special number. A transmission step of transmitting to the first server together with the special information about the first server; A display step of allowing the server to transmit the special number information and the authentication information to the user terminal and to be displayed through the user terminal; and a text message for the second server to request the authentication information to the special number to the user terminal. Comparing the authentication information included in the response message received from the user terminal with the special number and the authentication information previously generated corresponding to the special number, and authenticating the user according to a match and transmitting the authentication result information to the first server. It may include the authentication completion step.

As an example related to the present invention, the authentication information may be characterized in that the OTP information.

As an example related to the present invention, the authentication request may further include generating, by the first server, the authentication request information upon user authentication based on the user identification information.

As an example related to the present invention, a method of providing a security service determines whether to allow a user terminal to access the first server according to the authentication result information when the first server receives the authentication result information after the authentication completion step. It may be characterized in that it further comprises a step.

As an example related to the present invention, the first server may be configured as a web server, and the second server may be configured as an authentication server.

As an example related to the present invention, the special number may be a preset number for receiving the response message through the MO service, and the text message may be transmitted through the MT service.

As an example related to the present invention, the authentication completion step may further include requesting, via the text message, one or more digit codes selected at random from the authentication information including a plurality of digits by the second server. can do.

Security for supporting multi-channel authentication with a user terminal of a security service providing system including a first server and a second server and an application unit configured to communicate with a user terminal through a different communication network according to another embodiment of the present invention The service providing method may further include receiving user identification information from the user terminal connected to the data network by the first server, and transmitting authentication request information including terminal information corresponding to the user identification information to the second server. And storing, by the second server, a randomly selected special number from a preset special number list corresponding to the authentication request information with the terminal information, generating authentication information corresponding to the authentication request information, and then generating the authentication information for the selected special number. Transmitting the special information together with the first server to the first server; Transmitting the special number information and the authentication information to the application unit of the user terminal, displaying the special number information and the authentication information through the user terminal, and wherein the second server transmits the authentication information to the special number. Transmitting a text message for requesting to the user terminal, and comparing the calling number of the text message with a special number according to the special information when the text message is received by the application unit to receive the preset notification information. Displaying through the user terminal and transmitting a response message to the second server in response to the corresponding text message and including authentication information according to a user input, and the second server receiving the special message from the user terminal. The authentication information included in the above It is to may comprise a Certified transmitting the authentication result information to authenticate the user according to the match to the first server compares the authentication information generated in advance.

The computer-readable non-volatile recording medium having recorded thereon the program according to an embodiment of the present invention may store a computer program for performing the method according to the above-described embodiment.

A security service providing system for supporting multi-channel authentication with a user terminal including a first server and a second server communicating with a user terminal through a different communication network according to an embodiment of the present invention, the user connected via a data network Receiving user identification information from a terminal, and transmits authentication request information including terminal information about the user terminal set in advance corresponding to the user identification information to the second server, and corresponding to the authentication request information. By matching the terminal information randomly selected from the preset server list corresponding to the first server and the authentication request information for transmitting the special information and authentication information received from the server to the user terminal to be displayed through the user terminal Store the authentication information corresponding to the authentication request information. After generating and transmitting to the first server with the special information about the selected special number, and transmits a text message for requesting the authentication information to the special number to the user terminal, received from the user terminal with the special number And a second server that compares the authentication information included in the response message with the previously stored authentication information corresponding to the special number and authenticates the user according to whether the authentication information is matched, and transmits the authentication result information to the first server.

The present invention supports the authentication of the user to the server that requires authentication in addition to the authentication using a plurality of different channels for the user in the server providing a specific service to the user through the authentication between the service provider and the service user By preventing authentication information from being stolen in the transmission process, the authentication process using a special number that is difficult to forgery based on MO and MT service is supported on the server, thereby preventing hackers from manipulating the sender to guide users. As a result, the security of the authentication process can be greatly improved.

In addition, the present invention has a special number list for a plurality of different special number in the server, every time the user terminal is connected to the server, the special number is set as a calling number for the source of the authentication information for user authentication in the special number list By supporting the random selection and the authentication information is transmitted through the MO service at the time of receiving the authentication information from the server, it is possible to support the hacker can not identify the channel through which the authentication information is transmitted, thereby greatly improving the security.

In addition, the present invention provides a user with a one-time authentication information transmitted from the server through a first channel to a user terminal supporting a plurality of channels including a data network and a mobile communication network as a text message to the user through the second channel It supports automatic verification and authentication at the user terminal for the originator that induces the input and reply of one-time authentication information through a special number that is difficult to forgery in the two-channel authentication process transmitted to the user. It can be easily prevented to transmit, through this can not only increase the security without increasing the operation of a separate user, but also increases the user convenience.

1 is a block diagram of a security service providing system supporting multi-channel authentication with a user terminal according to an embodiment of the present invention.
2 is an exemplary diagram illustrating a user authentication process of a web server in a security service providing system supporting multi-channel authentication with a user terminal according to an exemplary embodiment of the present invention.
3 is an exemplary diagram illustrating a user authentication process by interworking an authentication server with a web server in a security service providing system supporting multi-channel authentication with a user terminal according to an exemplary embodiment of the present invention.
4 is an exemplary view illustrating a process of transmitting authentication information based on automatic verification of a sender in a user terminal according to an exemplary embodiment of the present invention.
5 is a flowchart illustrating a security service providing method supporting multi-channel authentication with a user terminal according to an exemplary embodiment of the present invention.

It should be noted that the technical terms used in the present invention are merely used to describe specific embodiments, and are not intended to limit the present invention. In addition, the technical terms used in the present invention should be interpreted as meanings generally understood by those skilled in the art unless the present invention is defined in any other meaning in the present invention, and is excessively comprehensive. It shall not be construed in the sense of or in the sense of being excessively reduced. In addition, when a technical term used in the present invention is an incorrect technical term that does not accurately express the spirit of the present invention, it should be replaced with a technical term that can be properly understood by those skilled in the art. In addition, the general terms used in the present invention should be interpreted as defined in the dictionary or according to the context before and after, and should not be interpreted in an excessively reduced sense.

Also, the singular forms used in the present invention include the plural forms unless the context clearly indicates otherwise. Terms such as “consisting of” or “comprising” in the present invention should not be construed as necessarily including all of the various components or steps described in the present invention, and some of the components or some steps may not be included. It should be construed that it may further include, or further include, additional components or steps.

In addition, terms including ordinal numbers such as first and second used in the present invention may be used to describe components, but the components should not be limited by the terms. The terms are used only to distinguish one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as the second component, and similarly, the second component may also be referred to as the first component.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings, and the same or similar components will be given the same reference numerals regardless of the reference numerals and redundant description thereof will be omitted.

In addition, in describing the present invention, when it is determined that the detailed description of the related known technology may obscure the gist of the present invention, the detailed description thereof will be omitted. In addition, it should be noted that the accompanying drawings are only for easily understanding the spirit of the present invention and should not be construed as limiting the spirit of the present invention by the accompanying drawings.

According to the present invention, when a user accesses and logs in to a first server through a data network using a first terminal, the server generates one-time authentication information and transmits the one-time authentication information to the first terminal. And a text message requesting the one-time authentication information arrives at the second terminal, which is different from the first terminal and is another terminal possessed by the user, when the one-time authentication information is transmitted through the second terminal. It may have a multi-channel authentication configuration for authenticating the user by comparing the generated one-time authentication information and the one-time authentication information received from the second terminal.

Recently, however, a user terminal 10 such as a smart phone supporting both a data network and a mobile communication network has emerged. Accordingly, a single user terminal 10 supports a two-channel authentication configuration with a server.

Accordingly, the present invention performs the above-described two-channel authentication process of receiving the one-time authentication information through the data network which is the first channel in the single user terminal 10 and then transmitting the one-time authentication information through the mobile communication network which is the second channel. When the user checks the corresponding text message and sends all or part of the one-time authentication information configured on the user terminal 10 as a reply and transmits it through the mobile communication network, the user at the server side through the mobile communication network-based MO service After receiving the one-time information inputted by the user, all or part of the one-time information is verified to authenticate the user, and only the authenticated user is allowed to access the server to which the user terminal 10 accesses various services provided by the server. It may be configured to be available.

In this way, the present invention is to change the authentication subject, the first channel is responsible for verifying the user's login information and the one-time authentication information delivery, and the second channel reveals the authentication request subject through the MO service and receives the one-time authentication information as a response It may be configured to perform authentication.

That is, the risk of hacking can be reduced by changing the authentication subject that can be accessed through the first channel to an authentication subject that exists in a second channel different from the first channel.

In this case, the first channel and the second channel are composed of different communication networks, and the risk of hacking can be reduced by separating the networks.

However, in this continuous authentication process, if the hacker intervenes in the middle of the authentication process and requests the user for the one-time authentication information to the originator specified by the hacker, the user who uses the authentication service performs the abnormal process involving the hacker through the authentication process. Since there is no suspicion at all, the one-time authentication information is sent to the sender specified by the hacker without confirmation of the sender, thereby allowing the hacker to steal the user's one-time authentication information, thereby allowing the hacker to impersonate the user and access the web server 100. Will be.

Therefore, in the present invention, while performing the two-channel authentication in the same operation as the user operation required in the two-channel authentication process as described above, it is possible to further increase the security with a simple configuration without adding a separate user operation.

To this end, the present invention secures a plurality of special numbers (special number or special number) (for example, # 1234) for using the MO and MT services on the server side or by extending n or more one or more special numbers assigned to the server. (For example, # 123456 for two-digit extension), increase the number of available special numbers, and enter the one-time authentication information for each authentication of the user, and set the calling number to be returned to the special number, but the special number is random. At the same time, a random message selected by the user terminal 10 is transmitted and displayed through the data network, and the user terminal 10 requests a one-time authentication information to the special number through the mobile communication network. Text message set through the selected special number) and the text message received through the MO service of the mobile communication network and the special number received through the data network. By informing the user to authenticate (or verify) the user's comparison between the calling party's calling party number so that the user can be prompted to enter one-time authentication information at a telephone number other than the normal calling party, It helps to prevent leakage of one-time authentication information in advance.

Based on the above description, an embodiment of the present invention will be described with reference to the drawings, Figure 1 is a block diagram of a security service providing system supporting multi-channel authentication with the user terminal 10 according to an embodiment of the present invention As illustrated, the first server 100 and the second server 200 may communicate with the user terminal 10 through a plurality of different communication networks.

In this case, the first server 100 and the second server 200 may communicate with each other through a communication network, and may also communicate with each other by wire connection.

In addition, of course, any one of the first server 100 and the second server 200 may be included in the other.

In addition, a security service providing system that supports multi-channel authentication with the user terminal 10 may be implemented by more components than those shown in FIG. 1, and the user terminal 10 may be implemented by fewer components. A security service providing system supporting multi-channel authentication of may be implemented.

In addition, the user terminal 10 described in the present invention is a smart phone, a portable terminal, a mobile terminal, a mobile terminal that supports both a communication using a data network and a communication using a mobile communication network. Personal Digital Assistant (PDA), Portable Multimedia Player (PMP) Terminal, Telematics Terminal, Navigation Terminal, Slate PC, Tablet PC, Wearable Device, For example, various terminals such as a watch type terminal (smartwatch), a glass type terminal (smart glass), a head mounted display (HMD), and the like may be applied.

In addition, the communication network described in the present invention may include a wired / wireless communication network. Examples of such a wireless communication network include a wireless LAN (WLAN), a digital living network alliance (DLNA), a wireless broadband (Wibro), World Interoperability for Microwave Access (Wimax), Global System for Mobile Communication (GSM), Code Division Multi Access (CDMA), Code Division Multi Access 2000 (CDMA2000), Enhanced Voice-Data Optimized or Enhanced Voice- Data Only (WCDMA), Wideband CDMA (WCDMA), High Speed Downlink Packet Access (HSDPA), High Speed Uplink Packet Access (HSUPA), IEEE 802.16, Long Term Evolution (LTE), Long Term Evolution- Advanced), Wireless Mobile Broadband Service (WMBS), Bluetooth, Radio Frequency Identification (RFID), Infrared Data Association (IrDA), Ultra Wideband (UWB), ZigBee, Near Field Communication (NFC), seconds Ultra Sound Communication (USC), Visible Light Communication (VLC), Wi-Fi, Wi-Fi Direct, and the like may be included. In addition, wired communication networks include wired LAN (Local Area Network), wired Wide Area Network (WAN), Power Line Communication (PLC), USB communication, Ethernet, serial communication, optical / coaxial Cable and the like.

In this case, as described above, the user terminal 10 supports both communication through a data network and a mobile communication network, and includes a wired LAN (Local Area Network), a wired WAN (Wide Area Network), and power line communication (PLC). , USB communication, Ethernet, serial communication, optical / coaxial cable communication, Wireless LAN (WLAN), Digital Living Network Alliance (DLNA), Wireless Broadband (Wibro), WiMAX (World) Interoperability for Microwave Access (Wimax), Wi-Fi, Wi-Fi Direct (Wi-Fi Direct) and the like can be configured to communicate with the first server 100 via a wired or wireless data network.

In addition, the user terminal 10 may include Global System for Mobile Communication (GSM), Code Division Multi Access (CDMA), Code Division Multi Access 2000 (CDMA2000), Enhanced Voice-Data Optimized or Enhanced Voice-Data Only (EV-DO). Wideband CDMA (WCDMA), High Speed Downlink Packet Access (HSDPA), High Speed Uplink Packet Access (HSUPA), IEEE 802.16, Long Term Evolution (LTE), Long Term Evolution-Advanced (LTE-A), The second server 200 may communicate with the second server 200 through a mobile communication network such as a wireless mobile broadband service (WMBS).

Through the above-described configuration, the present invention is configured so that the first and second servers 100 and 200 communicate with the user terminal 10 carried by the user through different types of communication networks, thereby distributing the network in the authentication process. (Or channel distribution) to increase security.

In addition, the first server 100 may be configured as a web server (web server) that provides a web service, a plurality of registered through a web site (web site) provided by the web server 100 It may include a member DB (101) that stores different user information for each user.

In addition, the member information may include a user's name, contact information, address, terminal information on the user terminal 10, login information (for example, member ID and password (password)), and the like. In this case, the terminal information may include a mobile directory number (MDN), a mobile IP, a mobile MAC, subscriber identity module (SIM) card unique information, a serial number, and the like.

In addition, some of the information stored in the member information may be set as user identification information, and the user identification information may be used as information for user authentication in at least one of the first server 100 and the second server 200. have.

In addition, the second server 200 accesses the first server 100 to use the web service provided by the first server 100 and transmits the user identification information to the normal user whose user identification information matches the corresponding user identification information. It may be configured as an authentication server 200 for authenticating whether or not.

In addition, the first server 100 and the second server 200 may be implemented in the form of a web server, a database server, a proxy server. In addition, the first server 100 and the second server 200 may be installed with a network load balancing mechanism, or one or more of a variety of software for allowing the server to operate on the Internet or other network, thereby computerized It can be implemented as a system. The network may also be an http network, and may be a private line, an intranet, or any other network. In addition, the connection between the first server 100 and the second server 200 and the user terminal 10 may be connected to a secure network so that data is not attacked by any hacker or another third party. In addition, the first server 100 and the second server 200 may include a plurality of database servers, which may be connected to the first server 100 through any type of network connection, including distributed database server architecture. And it may be implemented in a manner that is connected to the second server 200 separately.

Based on the above-described configuration, the first server 100 may receive user identification information from the user terminal 10 connecting to the first server 100 through a data network.

In this case, the first server 100 may store data related to a web site for providing a web service, and the corresponding web site may include a plurality of web pages.

In addition, the plurality of web pages may include a landing page, a login related web page, a product page for each product, a payment page, a purchase management page related to a purchase history corresponding to a user, and a content providing page for providing various contents.

Accordingly, the user terminal 10 may access a web site provided by the first server 100 and receive a web page included in the web site, based on a user input through the received web page. The user identification information may be generated and transmitted to the first server 100 through the data network.

In this case, the user terminal 10 may transmit the corresponding user identification information as log-in information.

On the other hand, when receiving the user identification information, the first server 100 compares the user identification information according to the member information stored in the member DB 101 and the user identification information received from the user terminal 10 to match the user according to whether or not match. You can authenticate.

At this time, when the first server 100 authenticates the user only with the user identification information, the user easily disguises the user identification information through hacking to use the web service, and there exists a risk of leaking the user's personal information. do.

Accordingly, even if the first server 100 succeeds in authenticating the user based on the user identification information, the first server 100 maintains a state of blocking access to another web page other than the currently connected web page or responds to the user. The connection state of the user terminal 10 may be set to a standby state in which a state in which the first server 100 is blocked from being logged in with a user-related account registered in advance is maintained.

In addition, when the first server 100 completes user authentication with respect to the user terminal 10, the user who accesses the first server 100 and transmits user identification information has access rights to the corresponding website or the user's personal information. (Or member information) to allow access to the first server 100 only to normal users who have login privileges, and to block access of abnormal users who impersonate users (most likely) by taking user identification information of users. In order to communicate with the second server 200, the user who is connected through the user terminal 10 may be authenticated through another channel different from the data network.

To this end, the first server 100 includes terminal information on the user terminal 10 preset in the user related member information of the member DB 101 corresponding to the user identification information upon completion of user authentication based on the user identification information. The authentication request information may be generated and transmitted to the second server 200.

In this case, the first server 100 may generate the authentication request information only when the user is authenticated by comparing the user identification information with the predetermined member information of the user.

Meanwhile, upon receiving the authentication request information, the second server 200 extracts the terminal information included in the corresponding authentication request information, and selects the user information from among a plurality of different special numbers included in a special number set in advance for the MO (Mobile Originated) service. You can choose a random number to use for authentication.

In this case, the MO (Mobile Originated) service described in the present invention is a service for relaying a text message transmitted from the user terminal 10 to the second server 200, and a special number is used to use the corresponding MO service. When the text message is transmitted from the terminal of the user to the special number, the second server 200 may receive the text message transmitted from the terminal of the user.

In addition, the second server 200 may transmit a text message to the user terminal 10 through the MT service, which is a concept opposite to the MO service.

That is, in the text message transmission mode, there are MO (Mobile Originated) and MT (Mobile Terminated), where MO is a text message generated from a user terminal and MT is a text message generated at a server.

In addition, in the message transmission between the user's mobile terminal and the server, the service transmitted from the mobile terminal to the server is called the MO service, and the service transmitted from the server to the mobile terminal is called the MT service.

In the case of such MO service, in order to transmit a message from a mobile communication terminal to a specific server, a mobile communication company generally assigns a special number (called "special number") to the message destination transmission destination, for example, "# 1234". When the user transmits a message to the mobile communication terminal, if the receiver transmits the message to the special number assigned to the specific server, the message is relayed to the server corresponding to the special number.

In addition, the MO and MT services are provided based on a mobile communication network provided by a mobile carrier, but a relay service server for a separate MO and MT service exists in the mobile communication network to relay corresponding text messages based on the MO and MT services. Can be.

Accordingly, in order for the second server 200 to receive a text message from the user terminal 10 through the MO service, a special number list including a plurality of different special numbers may be set in advance in the second server 200.

In this case, the mobile communication company may provide a MO and MT service by setting a plurality of different special numbers corresponding to the second server 200, and the second server 200 is allocated from the MO service provider (or mobile communication company). By generating a special number list including a plurality of different special numbers by extending a preset number of special digits by a predetermined number of digits, and setting the special number on the relay service server or mobile communication server of the corresponding MO service provider, Different special numbers are available for MT and MO services. For example, when the second server 200 is assigned # 1234 as a special number, the number of digits of the special number is extended by two digits to generate a special number list including a plurality of different special numbers such as # 123411, # 123412, and the like. The special number list may be registered in the service server of the MO service provider to use the special number of the special number list for the MO and MT services.

Meanwhile, upon receiving the authentication request information, the second server 200 may generate one-time authentication information in response to the authentication request information. The second server 200 may include the one-time authentication information and the special information about the special number selected corresponding to the authentication request information in the special number list. In response to the authentication request information received from the first server 100 may be transmitted to the first server 100.

In addition, the first server 100 may transmit one-time authentication information and special number information received in response to the authentication request information from the second server 200 to the user terminal 10 through the data network.

Accordingly, the user terminal 10 may display the one-time authentication information and the special information received through the data network so that the user can check it.

Meanwhile, the second server 200 may store the one-time authentication information generated corresponding to the special number information and the authentication request information selected in correspondence with the authentication request information with the terminal information included in the authentication request information, and at this time, The second server 200 may include a separate authentication DB 102 and match and store special number (or special number information), one-time authentication information, and terminal information in the authentication DB 102.

In addition, the second server 200 generates a text message for requesting one-time authentication information with the special number selected in correspondence with the authentication request information and requests the one-time authentication information with the special number, and matches the selected special number in correspondence with the authentication request information. The corresponding text message may be transmitted to the user terminal 10 according to the stored terminal information based on the MT service through the mobile communication network.

Accordingly, the user terminal 10 displays the corresponding text message upon receiving the text message, and the user of the user terminal 10 displays the special number (calling number) corresponding to the sender of the text message and the special number information displayed on the user terminal 10. It is possible to authenticate the originator according to the match by comparing the special numbers according to.

Through this, the user terminal 10 generates a response message including one-time authentication information displayed on the user terminal 10 in response to the corresponding text message based on the user input when the user checks the sender and completes the transmission to the corresponding special number. The response message may be transmitted to the second server 200 through the MO service.

Accordingly, when receiving the response message from the user terminal 10, the second server 200 compares the one-time authentication information included in the response message with the terminal information of the corresponding user terminal 10 and compares the one-time authentication information stored in advance. Check whether there is a match, and generate authentication result information according to the match.

For example, if the one-time authentication information of the response message and the pre-stored one-time authentication information coincide with each other, the second server 200 determines that the authentication is successful, generates authentication result information on the authentication success, and one-time authentication of the response message. When the information and the pre-stored one-time authentication information are inconsistent with each other, authentication result information for authentication failure may be generated.

In addition, the second server 200 may transmit the authentication result information to the first server 100, the first server 100 when the authentication is successful according to the corresponding authentication result information when receiving the authentication result user terminal 10 ) May be allowed to access the website, or provide the user terminal 10 with content requiring security or a web page or personal information related to the user.

As described above, the present invention provides the first channel-based authentication for the user terminal 10 connected to the first server 100 through the data network based on user identification information transmitted through the data network, which is the first channel. Perform one-time authentication information provided to the user terminal 10 through the first server 100 according to communication between the first server 100 and the second server 200 through the mobile communication network which is the second channel. By performing the second channel-based authentication received from the (10), performing multi-channel authentication through channel separation, the special information of the sender and the user terminal 10 transmitted to the user terminal 10 in the second channel-based authentication process ) By comparing the calling party number of the sender requesting the one-time authentication information with each other so that the user can confirm the caller requesting the one-time authentication information. The source is authenticated by the user can be made so as to support.

In other words, in addition to providing the one-time authentication information in the first server 100, a special number used as a calling number of a source for requesting (or requesting) the one-time authentication information later is provided to the user terminal 10 through the data network. Special number of special information transmitted from the first server 100 to the user terminal 10 to notify the user in advance of the information on the originator requesting the one-time authentication information, and to request the one-time authentication information from the second server 200. By sending a text message to the originating number of the sender, the user can verify and confirm the originator of the text message requesting the one-time authentication information already received based on the special number, so that the authentication of the originator can be performed.

In other words, the present invention supports the authentication (or verification) of the user to the server that requires authentication in addition to the authentication using a plurality of different channels for the user in the server providing a specific service, the service provider and the service user mutual Authenticating the user by controlling the sender by preventing the authentication information for the user's authentication from being stolen during the transmission process, and by allowing the server to perform the authentication process using a special number that is difficult to forge based on the MO and MT services. By preventing derivation, the security in the authentication process can be greatly improved.

In addition, the present invention has a special number list for a plurality of different special number in the server, every time the user terminal is connected to the server, the special number is set as a calling number for the source of the authentication information for user authentication in the special number list By supporting the random selection and by receiving the authentication information through the MO service at the time of receiving the authentication information from the server, it is possible to support the hacker can not identify the channel through which the authentication information is transmitted, thereby greatly improving the security.

Hereinafter, detailed operation embodiments of a security service providing process of a security service providing system supporting multi-channel authentication with the user terminal 10 according to the above-described configuration will be described in detail with reference to the accompanying drawings. Explain.

In this case, the above-described first server 100 is a web server 100, and the second server 200 will be described with reference to the authentication server 200 by way of example, but is not limited thereto. Of course, the second server 200 may be configured of various types of servers.

First, FIG. 2 illustrates an operation of a user authentication process of the web server 100. As shown in FIG. 2, the user terminal 10 connected to the web server 100 communicates with the first channel through a data network. The web server 100 may transmit a preset web page among a plurality of web pages constituting a web site for providing a web service to the connected user terminal 10.

In this case, the web server 100 may transmit a log-in related web page when the user terminal 10 first accesses.

In addition, the user terminal 10 may include a control unit, and the control unit may be a user through a login related web page displayed on a display unit configured in the user terminal 10 based on a user input through an input unit configured in the user terminal 10. The identification information may be generated and the corresponding user identification information may be transmitted to the web server 100 through a communication unit configured in the user terminal 10.

In this case, the user identification information may be configured as login information including a login ID and a password of the user.

In addition, when the user ID information is received from the user terminal 10, the web server 100 extracts member information corresponding to the user identification information from among a plurality of different user information stored in the member DB 101 in advance, and the corresponding user. The identification information may be compared with each other, and if the comparison result is matched, the user may be first authenticated based on the data network, which is the first channel.

In this case, even if the user authentication is successful according to the first authentication, the web server 100 may block access of an abnormal user such as a hacker who attempts to access the user identification information instead of the normal user corresponding to the user identification information. Secondary authentication can be performed.

In addition, the web server 100 may block the access of the user terminal 10 to other web pages constituting the web site other than the login-related web page until the second authentication for the user is completed, and the user terminal 10 ) May be waiting for accessing a login-related web page.

Meanwhile, referring to FIG. 3, the authentication process for the user through the interworking of the web server 100 and the authentication server 200 will be described. As shown in FIG. Terminal information on the user terminal 10 set in advance in the member information of the member DB 101 corresponding to may be extracted from the member information.

In addition, the web server 100 may generate authentication request information for second authentication including corresponding terminal information and transmit the generated authentication request information to the authentication server 200 interworking with the corresponding web server 100.

In this case, the web server 100 may generate corresponding authentication request information only upon successful user authentication based on the user identification information.

In addition, the authentication server 200 extracts the terminal information from the authentication request information when the authentication request information is received, and the user terminal in the special number list including a plurality of different special numbers related to the MO and MT service preset in response to the terminal information A special number for use in authentication with (10) can be selected at random.

At this time, the special number list may include a plurality of different special numbers assigned to the authentication server 200 by the service provider providing the MO and MT services.

In addition, the service provider providing the MO and MT services may be a mobile carrier.

Meanwhile, the authentication server 200 may generate one-time authentication information for user authentication in response to the corresponding authentication request information when the authentication request information is received.

In this case, the one-time authentication information may be configured as OTP (One Time Password) information.

Accordingly, the authentication server 200 generates response information including one-time authentication information generated in correspondence with the authentication request information and the one-time authentication information generated for the randomly selected special number and the corresponding authentication request information in response to the authentication request information, The response information may be transmitted to the web server 100.

In this case, the authentication server 200 may transmit the terminal information to the web server 100 by including the terminal information in the response information so that the response information corresponding to the authentication request information can be confirmed by the web server 100.

In addition, the authentication server 200 matches the terminal information included in the authentication request information with the one-time information and the one-time authentication information corresponding to the authentication request information to store in the authentication DB 102 included in the authentication server 200. Can be.

Meanwhile, the web server 100 identifies the response information corresponding to the authentication request information transmitted to the authentication server 200 based on the terminal information included in each of the authentication request information and the response information and identifies the response information. (10) can be transmitted through the data network.

Accordingly, the control unit configured in the user terminal 10 receives response information from the web server 100 through the communication unit configured in the user terminal 10, and transmits the special number information and one-time authentication information included in the response information to the corresponding user terminal. By displaying through the display unit configured in (10) can be displayed so that the user can check the special number and one-time authentication information according to the special information.

In this case, the web server 100 may generate the response information as a pop-up web page and transmit it to the user terminal 10, and the controller of the user terminal 10 may pop the response information. -up).

In addition, the authentication server 200 generates a text message for requesting the one-time authentication information displayed on the user terminal 10 and using the selected special number corresponding to the authentication request information as the source number of the calling party, the terminal information included in the authentication request information. According to the contact of the user terminal 10 can be transmitted through the mobile communication network.

In this case, the authentication server 200 may transmit a corresponding text message through a mobile communication network to a MO and MT service system including one or more relay devices that provide a preset MO and MT service, and transmit a text message from the authentication server 200. The receiving relay device may relay the transmission of the text message so that the corresponding text message is transmitted to the user terminal 10 based on the MT service.

In addition, the text message may be configured as a short messaging service (SMS) message or a multimedia messaging service (MMS) message.

Accordingly, the control unit configured in the user terminal 10 receives a text message transmitted based on the MT service through the mobile communication network from the authentication server 200 through the communication unit configured in the user terminal 10, and the user receives the text message. By displaying through the display unit configured in the terminal 10, a corresponding text message for generating a response message including the one-time authentication information to prompt the user to reply to the text message may be displayed.

In this case, the controller may identify the special number that is the source number of the corresponding text message and display the special number through the display unit of the user terminal 10.

In addition, the text message may include a prompt message such as 'Please return the one-time authentication information (for example, OTP number) to the calling party's phone number if the caller's phone number and the special number displayed on the screen match.' .

Accordingly, the user can compare the special number, which is the calling party number (caller's phone number) of the text message received at the user terminal 10, with the special number information received and displayed at the user terminal 10, thereby allowing one-time authentication information to be compared. The requesting originator may determine whether the requesting originator is the originator authenticated by the service provider of the web server 100 to which the user terminal 10 is connected.

On the other hand, the control unit configured in the user terminal 10 corresponds to the text message based on the user input through the input unit configured in the user terminal 10 generates a response message including one-time authentication information and then corresponds to the originator of the text message. The response message may be transmitted through a communication unit configured in the user terminal 10, and the response message may be transmitted to the authentication server 200 corresponding to the special number which is the destination of the response message based on the MO service through the mobile communication network. Can be.

In this case, the user checks the one-time authentication information displayed on the user terminal 10, inputs a response message including the one-time authentication information to the user terminal 10, and then corresponds to the authentication server 200 through the user terminal 10. Can be sent by special number.

In this case, the response message may also be configured as an SMS or MMS message.

Accordingly, the one or more relay devices receiving the response message may transmit the response message to the authentication server 200, where the one or more relay devices may transmit the response message to the authentication server 200 based on the MO service. have.

Meanwhile, the authentication server 200 extracts one-time authentication information from the response message received from the user terminal 10 through the MO service, and extracts the one-time authentication information extracted from the response message from the authentication DB 102 in the user terminal 10. The match may be determined by comparing the one-time authentication information matched with the terminal information.

At this time, the authentication server 200 identifies the terminal information corresponding to the user terminal 10 in the authentication DB 102 based on the origination number of the response message, and the one-time authentication information corresponding to the terminal information with one-time authentication information. Can be compared with authentication information.

In addition, if the one-time authentication information is mutually matched as a result of the comparison, the authentication server 200 may determine that the authentication is successful, and may generate authentication result information regarding the authentication success and transmit the authentication result information to the web server 100.

In addition, when the one-time authentication information does not match with each other as a result of the comparison, the authentication server 200 may determine that authentication has failed, and may generate and transmit authentication result information on the authentication failure to the web server 100.

In this case, the authentication server 200 may include the terminal information of the user terminal 10 for identification of the user in the authentication result information and transmit it to the web server 100.

Accordingly, the web server 100 checks the authentication result of the corresponding authentication result information upon receiving the authentication result information, and allows the user terminal 10 to access the web site only when the authentication is successful, and when the authentication fails, for the web site. The access of the user terminal 10 may be blocked.

In this case, the web server 100 may allow access of the user terminal 10 to the web site when the authentication fails, but may block the access of the user terminal 10 to some web pages or personal information of the web site. .

Meanwhile, in the above-described configuration, the authentication server 200 randomly selects one or more digits from the one-time authentication information composed of a plurality of digits, and transmits one or more digit codes randomly selected from the one-time authentication information through the corresponding text message. 10 may be requested.

Accordingly, the control unit of the user terminal 10 generates a response message including at least one randomly selected code corresponding to the text message based on the user input and authenticates the authentication server 200 through the communication unit of the user terminal 10. Can be sent to.

At this time, the control unit pre-set in the authentication server 200 for the code of the position that is not selected in the authentication server 200 (the seat does not request the user terminal 10 in the authentication server 200) based on the user input. A special symbol such as "*" may be included in the response message and transmitted, whereby the authentication server 200 may transmit a code corresponding to the above-described randomly selected place through the preset special symbol such as "*" in the response message. Can be identified.

In addition, the authentication server 200 compares one or more digit codes included in the response message with one or more codes constituting preset one-time authentication information corresponding to the user terminal 10 to determine the same digits. After determining whether the authentication is successful according to the match, the authentication result information according to the determination result may be generated and transmitted to the web server 100.

As described above, the present invention can increase the security since the authentication information request and response is made through a special number that is difficult to forgery, and the special number to be used is also clearly identified. Particularly, in the case of the special number used in the present invention, not only the number that any user can apply as desired, but also the service provider assigns the certificate to a trusted authentication company through the audit, and the special number is assigned at the server side according to the present invention. By holding a large number of users, each time a user attempts to access a different special number is randomly selected and used as a source and destination of authentication information, so that hackers can not identify the channel (or channel contact or number) through which authentication information is transmitted and received. It can greatly increase security.

In addition, the present invention provides a one-time authentication information received through the first channel of the user terminal 10 through a second channel of the user terminal 10 in a text message through a two-channel authentication process in the case of forgery and forgery difficult By adding a process of authenticating the user to the calling party's telephone number that leads to input of the authentication information through visual identification of the user, the user can be easily prevented from transmitting the authentication information to an unauthenticated sender. Through this, security can be increased without increasing the user's operation.

In the above configuration, the user terminal 10 may include a communication unit, a storage unit, a display unit, a voice output unit, and a controller.

Not all components of the user terminal 10 are essential components, and the user terminal 10 may be implemented by more components than those of the user terminal 10, and the user terminal may be implemented by fewer components. 10 may be implemented.

The communication unit communicates with any component inside or any at least one terminal outside via a wired / wireless communication network. In this case, any external terminal may include the first server 100 (or the web server 100) and the second server 200 (or the authentication server 200).

The communication unit may include a first communication module communicating through a wireless data network and a second communication module communicating through a mobile communication network.

In this case, the first communication module is a wireless LAN (WLAN), a digital living network alliance (DLNA), a wireless broadband (Wibro), a WiMAX (World Interoperability for Microwave Access (Wimax), a Wi-Fi) The first server 100 may be configured to communicate with the first server 100 through a wireless data network such as Wi-Fi Direct. Here, the first communication module may communicate with the first server through a wired data network such as a wired local area network (LAN), a wired wide area network (WAN), or the like.

In addition, the second communication module may include Global System for Mobile Communication (GSM), Code Division Multi Access (CDMA), Code Division Multi Access 2000 (CDMA2000), Enhanced Voice-Data Optimized or Enhanced Voice-Data Only (EV-DO), Wideband CDMA (WCDMA), High Speed Downlink Packet Access (HSDPA), High Speed Uplink Packet Access (HSUPA), IEEE 802.16, Long Term Evolution (LTE), Long Term Evolution-Advanced (LTE-A), Broadband The mobile station may communicate with the base station, the first and second servers 100 and 200 through a wireless mobile broadband service (WMBS) or the like.

In this case, the second communication module transmits data generated by the control unit of the user terminal 10 to an external server through a corresponding mobile communication network as well as transmitting and receiving a voice call or text message such as SMS or MMS through the mobile communication network. Of course, the data received from the mobile communication network can be delivered to the control unit of the user terminal 10.

That is, the second communication module may support mobile communication network based data communication.

Meanwhile, the communication unit may mutually transmit information with an arbitrary terminal through a universal serial bus (USB).

In addition, the communication unit receives various types of information transmitted from the first server 100 or the second server 200 under the control of the controller.

The storage unit stores various user interfaces (UIs), graphical user interfaces (GUIs), and the like.

In addition, the storage unit stores data and programs required for the user terminal 10 to operate.

That is, the storage unit may store a plurality of application programs (applications or applications), data for operating the user terminal 10, and instructions that are driven in the user terminal 10. At least some of these applications may be downloaded from an external service providing apparatus through wireless communication. In addition, at least some of these application programs may exist on the user terminal 10 from the time of shipment for basic functions of the user terminal 10 (for example, incoming / outgoing / outgoing function / message reception / outgoing function). Meanwhile, the application program may be stored in the storage unit and installed in the user terminal 10 to be driven by the controller to perform an operation (or function) of the user terminal 10.

In addition, the storage unit may include a flash memory type, a hard disk type, a multimedia card micro type, a card type memory (for example, SD or XD memory), a magnetic field. Memory, Magnetic Disk, Optical Disk, Random Access Memory (RAM), Static Random Access Memory (SRAM), Read-Only Memory (ROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Programmable Read- Only memory) may include at least one storage medium. In addition, the user terminal 10 may operate a web storage that performs a storage function of a storage unit on the Internet, or may operate in connection with the web storage.

In addition, the storage unit may store various information received through the communication unit under the control of the controller.

The display unit may display various contents such as various menu screens using a user interface and / or a graphic user interface stored in the storage unit under the control of the controller. Here, the content displayed on the display unit includes various text or image data (including various information data) and a menu screen including data such as icons, list menus, combo boxes, and the like. In addition, the display unit may be a touch screen.

In addition, the display unit includes a liquid crystal display (LCD), a thin film transistor liquid crystal display (TFT LCD), an organic light-emitting diode (OLED), and a flexible display. , At least one of a 3D display, an e-ink display, and a light emitting diode (LED).

In addition, the display unit may be configured as a stereoscopic display unit for displaying a stereoscopic image.

The stereoscopic display unit may be a three-dimensional display method such as a stereoscopic method (glasses method), an auto stereoscopic method (glasses-free method), a projection method (holographic method).

The display unit also displays various information received through the communication unit under the control of the control unit.

The voice output unit outputs voice information included in the signal processed by the control unit by a predetermined signal. Here, the audio output unit may include a receiver, a speaker, a buzzer, and the like.

In addition, the voice output unit outputs the guide voice generated by the controller.

The voice output unit may output voice information corresponding to the information received through the communication unit under the control of the controller.

The controller executes the overall control function of the user terminal 10.

In addition, the controller executes the overall control function of the user terminal 10 by using the program and data stored in the storage. The controller may include a RAM, a ROM, a CPU, a GPU, a bus, and the RAM, a ROM, a CPU, a GPU, and the like may be connected to each other through a bus. The CPU may access the storage unit to perform booting using an operating system (O / S) stored in the storage unit, and perform various operations using various programs, contents, and data stored in the storage unit. .

In addition, the controller performs a member registration procedure for the user of the corresponding user terminal 10 by interworking with the first server 100.

In addition, when performing the membership registration process, the controller must complete the authentication function through an authentication means (for example, mobile phone, credit card, i-pin, email, etc.) to complete the registration process for the first server 100 normally. can do.

In addition, when the user of the controller is not a member registered in advance in the first server 100, the controller may control the corresponding user terminal 10 (or based on guide information related to membership registration provided from the first server 100). The user registration procedure for the user terminal 10) is performed.

In addition, the first server 100 may generate member information when the user registration procedure of the user terminal 10 is completed and store it in the member DB 101 included in the first server 100.

In this case, the second server 200 may access the member DB 101 and share the member DB 101 with the first server 100.

In addition, the user terminal 10 may further include an interface unit (not shown) that serves as an interface with all external devices connected to the corresponding user terminal 10. For example, the interface unit may include a wired / wireless headset port, an external charger port, a wired / wireless data port, a memory card port, a port connecting a device equipped with an identification module, an audio I / O ( Input / Output) port, video I / O (Input / Output) port, earphone port, and the like. Here, the identification module is a chip that stores various information for authenticating the use authority of the user terminal 10, and includes a user identity module (UIM), a subscriber identity module (SIM), and universal user authentication. And a module (Universal Subscriber Identity Module (USIM)). In addition, the device equipped with the identification module may be manufactured in the form of a smart card. Therefore, the identification module may be connected to the user terminal 10 through a port. Such an interface unit may receive data from an external device or receive power to transfer the data to each component inside the user terminal 10 or to transmit the data inside the user terminal 10 to an external device.

In addition, when the user terminal 10 is connected to an external cradle, the interface unit may be a passage for supplying power from the cradle to the corresponding user terminal 10, or various command signals inputted from the cradle by the user may correspond to the corresponding user terminal. It may be a passage to (10). Various command signals or corresponding power input from the cradle may be operated as signals for recognizing that the user terminal 10 is correctly mounted on the cradle.

In addition, the user terminal 10 may include an input unit for receiving a command or control signal generated by an operation such as receiving a signal according to a button operation or an arbitrary function selection by a user, or touching / scrolling a displayed screen ( It may also include a).

The input unit is a means for receiving at least one of a user's command, selection, data, and information, and may include a plurality of input keys and function keys for receiving numeric or text information and setting various functions.

In addition, the input unit includes a key pad, a dome switch, a touch pad (static pressure / capacitance), a touch screen, a jog wheel, a jog switch, a jog shuttle, and a mouse. Various devices such as a stylus pen, a touch pen, and the like may be used. In particular, when the display unit is formed in the form of a touch screen, some or all of the functions of the input may be performed through the display unit.

In addition, each component (or module) of the user terminal 10 may be software stored on a memory (or storage) of the user terminal 10. The memory may be an internal memory of the user terminal 10 and may be an external memory or another type of storage device. The memory may also be a nonvolatile memory. Software stored on the memory may include a set of instructions that, when executed, cause the user terminal 10 to perform a particular operation.

Meanwhile, according to the configuration of the user terminal 10 as described above, when the user terminal 10 receives a text message for inducing input of one-time authentication information from the authentication server 200, the user terminal 10 corresponds to a sender of the corresponding text message. After automatically checking whether the special number is displayed and the special number information displayed on the user terminal 10, the one-time authentication information may be operated to be transmitted to the authentication server 200, which will be described in detail with reference to FIG. 4.

As shown, the user terminal 10 may be configured with an application unit 11 set to connect to the web server 100, the application unit 11 is a dedicated application set to communicate with the web server 100 ( application) may mean a controller in a state where the application is executed, or may include a dedicated application related data stored in a storage unit of the user terminal 10, and may mean a dedicated application in a state executed by the controller in the user terminal 10.

In addition, the application unit 11 may be configured as a controller for controlling each component of the user terminal 10 described above, or may control each component of the user terminal 10 in place of the controller.

In this way, when the corresponding dedicated application is executed in the user terminal 10, the application unit 11 described above in the user terminal 10 may be activated, and the application unit 11 may access the web server 100 to access the user terminal. The user identification information may be transmitted to the web server 100 based on the user input through the input unit of 10.

In addition, the web server 100 transmits the authentication request information to the authentication server 200 as described above, the authentication server 200 response information including the special number information and one-time authentication information generated corresponding to the authentication request information May be transmitted to the web server 100.

In addition, the web server 100 may transmit the corresponding response information to the application unit 11 of the user terminal 10, the application unit 11 transmits the response information through the communication unit of the user terminal 10 ( Received from the 100 may display the corresponding response information through the display unit of the user terminal (10).

In addition, the authentication server 200 may transmit a text message using the special number as the calling number to request the one-time authentication information described above to the user terminal 10.

In this case, the application unit 11 of the user terminal 10 may interwork with a messenger application associated with a text message pre-installed in the user terminal 10, and when the text message is received, the caller number of the sender of the corresponding text message may correspond. Through identification with the messenger application, the caller ID corresponding to the text message and the special number of the special information included in the response information displayed on the user terminal 10 may be compared with each other to directly determine whether there is a match.

Accordingly, the application unit 11 displays a preset notification-related notification information through the display unit of the user terminal 10 when the caller ID identified in correspondence with the text message matches the caller ID. It can provide information about.

In addition, the application unit 11 executes a messenger application for transmitting and receiving a text message and responds to the corresponding text message with the calling number and the special number, and sends a response message including the one-time authentication information through the corresponding messenger application according to a user input. After the generation, it may be transmitted to the authentication server 200 through the communication unit of the user terminal 10.

At this time, the application unit 11 is a dedicated application is switched to the background (background) or deactivated state when the messenger application is executed, and accordingly the application unit 11 is switched to the control unit, the state of the messenger application is executed The controller may generate a corresponding response message according to a user input and transmit the response message to the authentication server 200.

Through the above-described configuration, the authentication server 200 may perform an authentication process for the user as described above in connection with the web server 100 when receiving a response message including one-time authentication information.

On the other hand, in the above-described configuration, the application unit 11 can be hidden without processing the one-time authentication information included in the response information received from the web server 100, the special number according to the special information included in the response information The one-time authentication information may be exposed only when a text message with a calling number is received.

As described above, the present invention provides a caller ID requesting one-time authentication information for user authentication through a dedicated application connected to the first server 100 and a second server 200 authenticated from the first server 100. By comparing the special numbers transmitted to the user terminal 10 with respect to each other and automatically determining whether there is a match, and notifying the user of the result of the determination, it is possible to support the user not to miss the authentication of the sender requesting one-time authentication information or Essentially, verification can be done for the originator.

5 is a diagram for a method of providing a security service of a security service providing system supporting multi-channel authentication with a user terminal 10 including a first server 100 and a second server 200 according to an exemplary embodiment of the present invention. Flowchart.

As shown, the first server 100 receives the user identification information from the user terminal 10 connected to the data network (S1), and authenticates the user based on the user identification information (S2) user identification information In response to the authentication request information including the terminal information for the user terminal 10 is set in advance can be transmitted to the second server (200) (S3).

In addition, the second server 200 stores a randomly selected special number from the preset special number list in correspondence with the authentication request information received from the first server 100 and matches the terminal information, and stores the authentication information in response to the authentication request information. After the generation, it may be transmitted to the first server 100 together with the special information about the randomly selected special number (S4 and S5).

In this case, the second server 200 may store the corresponding authentication information by matching the terminal information and the special number information.

Thereafter, the first server 100 may transmit the response information including the special information and the authentication information to the user terminal 10 so that the corresponding response information is displayed through the user terminal 10 (S6 and S7).

Next, the second server 200 transmits a text message for requesting authentication information to the user terminal 10 as a special number (S8), and the authentication information included in the response message specially received from the user terminal 10; Corresponding to the special number, the previously generated and stored authentication information may be compared (S9 and S10), and the user may be authenticated according to the match, and the authentication result information may be transmitted to the first server 100 (S11).

Accordingly, the first server 100 determines that the user's authentication is completed upon successful authentication based on the authentication result information, and transmits various service-related contents and data requiring the user's authentication to the user terminal 10 to follow up. You can proceed.

The user terminal 10 and the first and second servers 100 and 200 described above may be implemented as hardware components, software components, and / or combinations of hardware components and software components, respectively, It may be configured to include a processor, an engine, and the like.

In addition, the components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable array (FPA), or programmable logic (PLU). unit, microprocessor, or any other device capable of executing and responding to instructions, may be implemented using one or more general purpose or special purpose computers.

The user terminal 10 and the first and second servers 100 and 200 may execute an operating system (OS) and one or more software applications executed on the operating system.

In addition, the user terminal 10 and the first and second servers 100 and 200 may access, store, manipulate, process, and generate data in response to the execution of the software.

For convenience of explanation, each component may be described as being used one by one, but one of ordinary skill in the art, the processing device is a plurality of processing elements and / or a plurality of types of processing It can be seen that the element may be included.

For example, the user terminal 10 and the first and second servers 100 and 200 may include a plurality of processors or one processor and one controller. In addition, other processing configurations are possible, such as parallel processors.

The software may include a computer program, code, instructions, or a combination of one or more of these, and the user terminal 10 and the first and second servers 100, 200 may be desired. It can work as it is, or can be commanded independently or collectively.

The software and / or data may be interpreted by the user terminal 10 and the first and second servers 100 and 200, or commands or data may be sent to the user terminal 10 and the first and second servers 100 and 200. To provide, permanent or temporary embody to any type of machine, component, physical device, virtual equipment, computer storage medium or device, or signal wave transmitted. Can be

The software may be distributed over networked computer systems so that they may be stored or executed in a distributed manner. Software and data may be stored on one or more computer readable recording media.

The security service providing method for supporting multi-channel authentication with the user terminal 10 according to the embodiment of the present invention described in the above-described embodiment can be written as a computer program, and codes and code segments constituting the computer program It can be easily deduced by computer programmers in the field. In addition, the computer program is stored in a computer readable media, and the computer or the user terminal 10 and the first and second servers 100 and 200 according to an embodiment of the present invention. By reading and executing by the user, it is possible to implement a security service providing method that supports multi-channel authentication with the user terminal 10.

The information storage medium includes a magnetic recording medium, an optical recording medium and a carrier wave medium. The computer program implementing the security service providing method for supporting multi-channel authentication with the user terminal 10 according to an embodiment of the present invention is the internal memory of the user terminal 10 and the first and second servers 100 and 200. Can be stored and installed in. Alternatively, an external memory such as a smart card storing and installing a computer program for implementing a security service providing method for supporting multi-channel authentication with the user terminal 10 according to an exemplary embodiment of the present invention may be connected to the user terminal 10 through an interface. ) And the first and second servers 100 and 200.

The various devices and components described herein may be implemented by hardware circuitry (eg, CMOS based logic circuitry), firmware, software, or a combination thereof. For example, it may be implemented using transistors, logic gates, and electronic circuits in the form of various electrical structures.

The above description may be modified and modified by those skilled in the art without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention but to describe the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The protection scope of the present invention should be interpreted by the following claims, and all technical ideas within the scope equivalent thereto should be construed as being included in the scope of the present invention.

The present invention supports the authentication of the user to the server that requires authentication in addition to the authentication using a plurality of different channels for the user in the server providing a specific service to the user through the authentication between the service provider and the service user By preventing authentication information from being stolen in the transmission process, the authentication process using a special number that is difficult to forgery based on MO and MT service is supported on the server, thereby preventing hackers from manipulating the sender to guide users. In addition, the security can be greatly improved in the authentication process, and can be widely used in the payment service field and the security service field.

10: user terminal 11: application unit
100: first server, web server 200: second server, authentication server

Claims (10)

A security service providing method of a security service providing system comprising a first server, which is a web server, and a second server, which is an authentication server, communicating with a user terminal through a different communication network,
Receives user identification information from the user terminal connected to the data network by the first server, and transmits authentication request information including terminal information on the user terminal preset in correspondence with the user identification information to the second server. An authentication request step;
The second server stores a randomly selected special number from the special number list starting with '#' for the MT and MO service in correspondence with the authentication request information and the terminal information, and corresponds to the authentication request information. Generating authentication information and transmitting the authentication information to the first server together with the special information about the selected special number;
A display step of allowing the first server to transmit the special information and the authentication information to the user terminal to be displayed together through the user terminal; And
The second server transmits a text message for requesting authentication information for requesting confirmation of the calling number and the input of the authentication information using the randomly selected special number as the calling number to the user terminal through the MT service. Receive a response message for the text message transmitted through the MT service through the MO service to compare the authentication information included in the response message received with the randomly selected special number and the authentication information previously generated corresponding to the randomly selected special number A method of providing a security service that supports multi-channel authentication with a user terminal, comprising: an authentication completion step of authenticating a user according to a match and transmitting authentication result information to the first server. Claim 2 has been abandoned upon payment of a set-up fee. The method of claim 1,
The authentication information is a security service providing method for supporting multi-channel authentication with the user terminal, characterized in that the OTP information. Claim 3 has been abandoned upon payment of a setup registration fee. The method of claim 1,
The authentication requesting step may further include generating, by the first server, the authentication request information when the user authenticates based on the user identification information. . Claim 4 was abandoned upon payment of a set-up fee. The method of claim 1,
And after the authentication completion step, when the first server receives the authentication result information, determining whether to allow access of the user terminal to the first server according to the authentication result information. How to provide security services that support multichannel authentication. delete Claim 6 has been abandoned upon payment of a set-up fee. The method of claim 1,
The special number is a preset number for receiving the response message through the MO service, and the text message is a security service providing method for supporting multi-channel authentication with the user terminal, characterized in that transmitted through the MT service. Claim 7 was abandoned upon payment of a set-up fee. The method of claim 1,
The authentication completion step further includes the step of requesting the multi-channel authentication with the user terminal by the second server requesting at least one digit code randomly selected from the authentication information consisting of a plurality of digits through the text message. How to Provide Security Services to Support. A security service providing method of a security service providing system comprising a first server, which is a web server, a second server, which is an authentication server, and an application unit configured to communicate with a user terminal through a different communication network from each other,
Receiving user identification information from the user terminal connected to the data network by the first server, and transmitting authentication request information including terminal information corresponding to the user identification information to the second server;
The second server stores a randomly selected special number from the special number list starting with '#' for the MT and MO service in correspondence with the authentication request information and the terminal information, and corresponds to the authentication request information. Generating authentication information and transmitting the authentication information to the first server together with the special information about the selected special number;
Transmitting, by the first server, the special number information and authentication information to an application unit of the user terminal;
Displaying, by the application unit, the special information and the authentication information together through the user terminal:
Transmitting, by the second server, a text message for requesting authentication information of a request for confirming a calling special number and inputting authentication information using the randomly selected special number as a calling number to the user terminal through an MT service;
When the application unit receives the text message with the randomly selected special number, comparing the calling number of the text message with the special number according to the special information, and displaying the preset notification information through the user terminal when mutually matching, and corresponding to the corresponding text message. Transmitting a response message including authentication information according to a user input to a second server; And
The second server receives the response message for the text message transmitted from the user terminal through the MT service through the MO service, and corresponds to the authentication information included in the response message received with the randomly selected special number and the randomly selected special number. And comparing the pre-generated authentication information and authenticating the user according to a match, and transmitting the authentication result information to the first server. Claim 9 was abandoned upon payment of a set-up fee. A non-transitory computer-readable recording medium having recorded thereon a computer program for performing the method according to any one of claims 1 to 4 and 6 to 8. A security service providing system comprising a first server, which is a web server, and a second server, which is an authentication server, communicating with a user terminal through a different communication network,
Receive user identification information from the user terminal connected to the data network, and transmits the authentication request information including the terminal information for the user terminal set in advance corresponding to the user identification information to the second server, the authentication request A first server transmitting special number information and authentication information received from the second server in response to the information to the user terminal to be displayed together through the user terminal; And
A random number selected from a special number list starting with '#' for MT and MO services, corresponding to the authentication request information, is stored and matched with the terminal information, and the authentication information is generated corresponding to the authentication request information. Then, the text message is transmitted to the first server together with the special information about the randomly selected special number, and the request for authentication information requesting confirmation of the calling special number and input of authentication information using the randomly selected special number as the calling number. The authentication information included in the response message received by the randomly selected special number is transmitted to the user terminal through the MT service, and receives a response message for the text message transmitted from the user terminal through the MT service through the MO service. Comparing the authentication information stored in advance corresponding to the randomly selected special number W match in accordance with the security service provider system to authenticate the user supports multiple authentication channel between the user terminal and a second server that transmits the results to the first server certification information.

Images