KR102082356B1 - User authentication system and method thereof, and apparatus applied to the same - Google Patents

Abstract

The present invention discloses a user authentication system, a method thereof, and an apparatus applied thereto. That is, after confirming the user authentication required from the service device in connection with the use of the service provided from the service device, and if the service is determined to be the authentication processing object capable of processing the user authentication, receiving the user authentication information to receive the user authentication By processing the user authentication based on the information and allowing the service device to use the service only as a result of the user authentication processing without receiving the user authentication information, the isolated execution environment and hardware that are not exposed from security threats. It is possible to perform secure user authentication by combining security technology.

Description

USER AUTHENTICATION SYSTEM AND METHOD THEREOF, AND APPARATUS APPLIED TO THE SAME}

The present invention processes the user authentication required for service use based on the TrustZone technology in the user device body and enables the user to use the service even if only the user authentication processing result is delivered to the service provider. It is about a method.

Recently, smartphones have exploded due to the development of hardware such as application processors and displays, the emergence of mobile operating systems, and the activation of the open market.

However, in the case of the mobile terminal such as the above-mentioned smartphone, openness of the operating system, risk of leakage of personal information (eg, address book, text message, financial information, certificate, etc.) due to open market ecosystem that anyone can develop and participate in, malicious code In addition to being able to reproduce security threats on existing PCs such as terminal malfunctions, excessive billing and possible attacks on mobile networks, new types of security threats exist in wireless communication environments.

Accordingly, there is a need for a security platform technology that can provide reliability in a mobile environment to protect users and network assets from security threats caused by malicious attacks.

The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a user authentication required from the service device in connection with the use of a service provided by a service device provided by a trust zone technology. When the service is determined to be an authentication processing target capable of processing the user authentication, receiving user authentication information and processing the user authentication based on the user authentication information, the service apparatus receives the user authentication information. By allowing the service to be used only as a result of the user authentication process without receiving, a secure user authentication is performed by combining an isolated execution environment that is not exposed from a security threat with a hardware security technology.

A user device according to the first aspect of the present invention for achieving the body object, the user unit for requesting the user authentication required from the service device in connection with the use of the service provided from the service device; And when the service is determined to be an authentication processing target capable of processing the user authentication, receives user authentication information, processes the user authentication based on the user authentication information, and the service device does not receive the user authentication information. It is characterized in that it comprises an authentication unit for allowing the user to use the service without the user authentication processing result only.

More specifically, the user device further includes a determining unit that determines whether the service is the authentication processing target, and wherein the determining unit, when the service is included in the service list designated as the authentication processing target, displays the service. Characterized in that it is determined as the authentication processing target.

More specifically, the user device further comprises a storage unit for storing the user verification information specified in connection with the processing of the user authentication, wherein the authentication unit, whether the user authentication information and the user verification information coincide with each other It characterized in that for processing the user authentication.

More specifically, the user verification information, if the service is 2 or more, characterized in that it is designated to correspond to each of the two or more services, or characterized in that it is specified to correspond to both of the two or more services.

More specifically, the user device further includes a first operating system and a second operating system for supporting the service use and the user authentication process, respectively, wherein the first operating system includes the user required in connection with the service use. It is a general-purpose operating system that provides an open API (Open Application Programmer Interface) for supporting the authentication request, wherein the second operating system is to determine the service as the authentication processing target, and determined as the authentication processing target It is characterized in that the operating system for providing an API (Open Application Programmer Interface) for supporting the processing of the user authentication in relation to the service.

More specifically, when the service is determined to be the authentication processing target, the authentication unit displays an information input screen for receiving the user authentication information, and the user authentication information input from the user through the information input screen. It is characterized by receiving.

More specifically, when the service is included in at least one of execution of an application, access of a web page, and execution of security content, the user authentication information includes login information for execution of the application and access of a web page. And at least one of login information and an authorization key for executing the secure content.

According to a second aspect of the present invention, there is provided a user device including: a user unit for requesting user authentication required from the service device in connection with service use; And when the service is determined to be the authentication processing target, receives user authentication information, processes the user authentication based on the user authentication information, and the user uses only the user authentication processing result without receiving the user authentication information. It characterized in that it comprises an authentication unit for using the service.

A user authentication method according to a third aspect of the present invention for achieving the above object includes a confirmation step of confirming that the user device is required to authenticate the user from the service device in connection with the use of the service provided from the service device; An authentication processing step of the user device receiving user authentication information and processing the user authentication based on the user authentication information when it is determined that the service is an authentication processing target capable of processing the user authentication; And a permission step of allowing the user device to use the service only with the result of the user authentication process without the service device receiving the user authentication information.

A method of operating a user device according to a fourth aspect of the present invention for achieving the above object comprises: a confirmation step of confirming that user authentication is required from the service device in connection with the use of a service provided from a service device; A reception step of receiving user authentication information when the service is determined to be an authentication processing target capable of processing the user authentication; And an authentication processing step of processing the user authentication based on the user authentication information, and enabling the service device to use the service only as a result of the user authentication processing without receiving the user authentication information. .

More specifically, the method may further include a determining step of determining whether the service is the authentication processing target, before the receiving step, wherein the determining step is performed on the service list designated as the authentication processing target. If included, characterized in that the service is determined as the authentication processing target.

More specifically, the receiving step may include a display step of displaying an information input screen for receiving the user authentication information when the service is determined to be the authentication processing target; And a receiving step of receiving the user authentication information input from the user through the information input screen.

More specifically, the method further includes a storing step of storing user verification information specified in connection with the processing of the user authentication, wherein the authentication processing step, whether the user authentication information and the user verification information coincide with each other. It is characterized in that for processing the user authentication.

More specifically, the user verification information, if the service is 2 or more, characterized in that it is designated to correspond to each of the two or more services, or characterized in that it is specified to correspond to both of the two or more services.

More specifically, when the service is included in at least one of execution of an application, access of a web page, and execution of security content, the user authentication information includes login information for execution of the application and access of a web page. And at least one of login information and an authorization key for executing the secure content.

A user authentication system according to a fifth aspect of the present invention for achieving the above object, a service device for providing a service that requires user authentication to the user device; And when the service is determined to be an authentication processing target capable of processing the user authentication, receives user authentication information and processes the user authentication based on the user authentication information, without the service device receiving the user authentication information. And a user device enabling the service to be used only as a result of the user authentication process.

Therefore, according to the user authentication system and method, and apparatus applied thereto of the present invention, based on the TrustZone technology, user authentication required for service use is processed in the user device body, and the user authentication processing result. The service can be used by the user device even if only the service provider is delivered to the service provider, thereby enabling secure user authentication by combining an isolated execution environment that is not exposed to security threats and hardware security technology.

1 is a schematic configuration diagram of a user authentication system according to an embodiment of the present invention.
2 is a block diagram of a user device according to an embodiment of the present invention.
3 is a block diagram of a user equipment based on TrustZone technology according to an embodiment of the present invention.
4 is a schematic flowchart illustrating an operation flow in a user authentication system according to an embodiment of the present invention.
5 is a schematic flowchart illustrating an operation of a user device according to an embodiment of the present invention.

Hereinafter, with reference to the accompanying drawings will be described an embodiment of the present invention.

1 is a diagram illustrating a user authentication system according to an embodiment of the present invention.

As shown in FIG. 1, a user authentication system according to an exemplary embodiment of the present invention processes a user authentication required in connection with service service 100 and service use that provide a service to a user device 200. Has a configuration including a user device 200 to.

The service device 100 refers to a service server for providing a service requested from the user device 200 to the connected user device 200. After the user authentication process, the service device 100 normally services the user device 200. Make it available.

Here, the service provided by the service device 100 may be, for example, an application execution service, a web page access service, or an execution service of a security content for the connected user device 200.

Thus, in the case of user authentication required in connection with the use of the service, the user authentication information input from the user for the use of each service, that is, the login information (eg ID / PASSWORD, certificate password) can be made in a way On the other hand, with respect to the security content execution service, it can be made through a method of checking the authorization key set in the security content.

The user device 200 refers to a mobile device that processes a user authentication required in connection with service use. For example, the user device 200 may be a smart phone, a tablet PC, a PDA, and the like. Instead of using a service provided from the service device 100 or a device capable of using its own service, all may be included.

Meanwhile, according to an embodiment of the present invention, the user device 200 adopts a hardware security solution as a security platform technology for providing high security against security threats caused by malicious attacks in a mobile service environment.

In this regard, as a hardware security solution that provides high security in a mobile terminal such as the user device 200, there are a Universal Integrated Circuit Card (UICC), a Mobile Trusted Platform Module (TPM), and the like.

Here, the UICC is a smart card that can store personal information such as messages, e-mails, and contacts as well as subscribers, networks, and authentication information in 3G mobile networks, and is generally called a 'USIM (Universal Subscriber Identity Module) card'.

Mobile TPM is a mobile TPM that enables the use of TPM (Trusted Platform Module) defined by the Trusted Computing Group (TCG), a standardization group that develops business standards for hardware-based trusted computing and security technologies. It supports algorithms and provides user, terminal authentication and terminal integrity verification, and user data protection.

However, due to the limited performance of processors and low transmission speeds, UICC cannot satisfy the Trusted Execution Environment (TEE), which defines security hardware and software functions that provide a secure execution environment for security-related applications on mobile terminals.

In addition, the mobile TPM has a disadvantage in that cost increases and application code protection is difficult due to the use of a separate chip.

Therefore, in one embodiment of the present invention, a TrustZone technology that provides an environment that is hardware isolated from security threats, rather than using a separate hardware security chip such as the UICC and the Mobile TPM described above. Will apply.

Here, the trust zone is divided into hardware such that 'Normal World' and 'Secure World' exist in one CPU as shown in FIG. 3, and a general application operates in a 'Normal World' and an application requiring security It will provide an execution environment that will work in Secure World.

In other words, 'Normal World' and 'Secure World' are mutually isolated from each other and operate only by separate operating systems (first operating system and second operating system), so that 'Normal World' is attacked by malicious code. Even under circumstances, applets and stored data on Secure World will be assured of safe management and execution from malware.

In other words, since 'Normal World' operates based on the general operating system (first operating system) open to others, it cannot guarantee safety from various security threats, but in the case of 'Secure World', 'Normal World' Is operating in a hardware-isolated environment and is based on a dedicated operating system (second operating system) that is not open to others, unlike the 'Normal World'. Safety is guaranteed.

As described above, in the embodiment of the present invention, the above-described bar and trust zone technology are applied. Hereinafter, based on the trust zone technology, the user authentication required for service use is processed by the user apparatus 200 in the vehicle body. The present invention proposes a method for delivering only the results of the user authentication process to the service provider. The detailed description thereof is as follows.

The service device 100 performs a function of processing user authentication related to service use.

More specifically, the service device 100 provides a service requested by the connected user device 200, and when user authentication is required for service use, the user device 200 may process the corresponding user authentication. Make sure

In this case, the service device 100 allows the user authentication to be processed in the user device 200 only when a security process for user authentication is notified from the user device 200.

That is, when the service device 100 is notified of security processing for user authentication from the user device 100, the user device 200 processes the user authentication so that user authentication information (eg, ID / PASSWORD, certificate password) is not transmitted from the user device 200.

This means that although the security processing for the user authentication is required, when the service device 100 processes the user authentication itself, the user authentication information (for example, ID / PASSWORD, certificate password) transmitted from the user device 200 is external. This is to prevent the exposure.

Thus, the service device 100 does not need to store user verification information (same information as the user authentication information) for verifying the user authentication information input from the user during the user authentication process, so that personal information may be stored from hacking or the like. You can protect it.

In addition, the service device 100 performs a function of allowing the user device 200 to use the service.

More specifically, the service device 100 receives a user authentication processing result from the user device 200, and confirms that the user device 200 is an authenticated user from the user authentication processing result to the user device 200. Allow the service to function normally.

That is, the service device 100 allows the use of the service for the user device 200 only with the result of the user authentication processing received from the user device 200 without receiving user authentication information required for user authentication from the user device 200. You can do it.

The user device 200 performs a function of confirming that user authentication is required for service use.

More specifically, the user device 200 uses a service provided by the service device 100, and confirms that user authentication is required from the service device 100 in connection with the use of the service.

That is, referring to FIG. 3, the service provided by the service device 100 is used by executing an application (APP) mounted in the 'Normal World', and from the service device 100 in connection with the service use. Confirm that user authentication is required.

In addition, the user device 200 performs a function of determining whether processing of user authentication is possible.

More specifically, if the user device 200 requires user authentication from the service device 100 in connection with service use, whether the service provided from the service device 100 is subject to authentication processing capable of its own user authentication processing. Will be judged.

To this end, the user device 200 designates and manages a service list corresponding to an authentication process in advance, and when it is confirmed that a service provided from the service device 100 is included in the service list, authentication of the corresponding service is performed. It is determined to be the object of processing.

If the user device 200 determines that the service provided from the service device 100 is an authentication target, the user device 200 notifies the service device 100 of security processing, thereby processing the user authentication required for service use by itself. Inform the service device 100 that it will.

That is, referring to FIG. 3, a user authentication is requested to 'Secure World' through an application running in 'Normal World' in order to use a service provided by the service device 100, and ' In the Secure World's applet, it is determined whether or not a service provided from the service device 100 is subject to authentication by checking a list of services designated as authentication targets.

In addition, the user device 200 performs a function of processing user authentication.

More specifically, when the service provided by the service device 100 is determined to be an authentication process, the user device 200 receives user authentication information from the user and processes user authentication based on the received user authentication information. .

To this end, the service apparatus 100 designates and stores user verification information for each service list subject to authentication in advance, and confirms whether user authentication information received from the user and the user verification information coincide with each other during the user authentication process. By checking whether or not, the user authentication related to the use of the service provided from the service device 100 is processed.

Here, the user verification information refers to authentication information (eg, ID / PASSWORD, certificate password) specified by the user, and the user verification information is designated to correspond to each service list or one representative corresponding to both service lists. It can be specified and managed as authentication information (the password specified to access 'Secure World').

That is, referring to FIG. 3, by displaying an information input screen for receiving the user authentication information through execution of an applet mounted in 'Secure World', the user authentication information is received from the user through the information input screen. The user authentication is processed by comparing the user verification information previously stored in the storage area of 'Secure World' with the received user authentication information.

In addition, the user device 200 performs a function of transmitting a user authentication processing result to the service device 100.

More specifically, when the user device 200 confirms that the user authentication information and the user authentication information match each other, the user device 200 transmits the user authentication processing result to the service device 100 to the service device 100. It is possible to allow the user to use the service of the user device 200 only as a result of the user authentication process.

That is, referring to FIG. 3, the user authentication processing result is transmitted to an application running in 'Normal World' through an applet mounted in 'Secure World', and the received application receives the user authentication processing result. By transmitting to the service device 100 or by directly transmitting the result of the user authentication process to the service device 100, the service provided by the service device 100 in the application running in the 'Normal World' can be used normally do.

Hereinafter, the configuration of the user apparatus 200 according to an exemplary embodiment of the present invention will be described in more detail with reference to FIG. 2.

That is, the user device 200 according to an embodiment of the present invention is a user unit 210 for using the service, the determination unit 220 for determining the authentication processing target, the storage unit 230 for storing the user verification information ), And an authentication unit 240 for processing user authentication.

The above-described user unit 210 is a configuration corresponding to an application (APP) mounted in the 'Normal World' among the 'Normal World' and 'Secure World' which are divided in hardware, and calls an open API provided by the first operating system. It is implemented as a form of software module that operates.

Here, the first operating system refers to a general-purpose operating system that provides an open API (Open Application Programmer Interface) for supporting the operation of the user unit 210 located in the 'Normal World'.

In addition, each of the determination unit 220, the storage unit 230, and the authentication unit 240 is a configuration corresponding to the applet mounted in the 'Secure World', and forms a software module that operates by calling an API provided by the second operating system. Will be implemented as

Here, the second operating system refers to a dedicated operating system that provides an API for supporting only operations of each of the determination unit 220, the storage unit 230, and the authentication unit 240 located in 'Secure World'. do.

The user unit 210 performs a function of confirming that user authentication is required for service use.

More specifically, when it is confirmed that the user authentication is required from the service device 100 in connection with the use of the service provided by the service device 100, the user unit 210 requests the corresponding user authentication to the authentication unit 240. do.

In this case, the use unit 210 calls a public API provided by the first operating system to access the service device 100 to use the service provided by the service device 100, and user authentication in connection with service use. If the required is confirmed, the user authentication is requested to the authentication unit 240 located in the 'Secure World'.

Here, since the use unit 210 is configured to correspond to the application (APP) mounted in the 'Normal World', not only the use of the service provided from the service device 100 but also the use of a service that is executed by itself is possible.

The determination unit 220 performs a function of determining whether processing of user authentication is possible.

More specifically, the determination unit 220 determines whether the service provided from the service device 100 is subject to authentication processing capable of own user authentication processing in relation to the user authentication request received from the user unit 210. do.

To this end, the determination unit 220 designates and manages a service list corresponding to the authentication processing target in advance, and when it is confirmed that a service for requesting user authentication is included in the service list, the service is designated as an authentication processing target. You will be judged.

At this time, the determination unit 230 determines the service provided from the service device 100 as the authentication processing target by checking the list of services previously designated as the authentication processing target by calling the API provided by the second operating system.

When the service provided by the service device 100 is determined to be an authentication process, the determination unit 220 notifies the service device 100 of the security process, thereby requesting the service device 100 in connection with service use. It is possible to recognize that the user authentication is to be handled by the user device 200 itself.

At this time, the determination unit 230 calls the API provided by the second operating system and delivers the determination result to the usage unit 210 located in the 'Normal World', thereby causing the usage unit 210 to process the user authentication itself. It is possible to notify the service device 100 that it will.

The authentication unit 240 performs a function of processing user authentication.

More specifically, if it is determined that the service provided by the service device 100 is an authentication processing target, the authenticator 240 receives user authentication information from the user and processes user authentication based on the received user authentication information. .

To this end, the authentication unit 240 is previously stored in the storage unit 230 by specifying the user verification information for each of the service list subject to the authentication processing, the user authentication information received from the user and the stored user verification information mutually match By checking whether or not, the user authentication is processed.

At this time, the authentication unit 240 calls the API provided by the second operating system to display the information input screen for receiving the user authentication information, thereby receiving the user authentication information from the user through the information input screen, ' By comparing the user verification information previously stored in the storage unit 230 located in Secure World 'and the received user authentication information, the user authentication is processed.

Here, the user verification information is stored and managed in the storage unit 230 located in the 'Secure World' rather than the general memory area located in the 'Normal World' as described above. In order to protect user verification information from various security threats in 'Normal World' by storing and managing user verification information based on the second operating system independent of 'Normal World' .

In addition, the authentication unit 240 performs a function of transmitting the user authentication processing result to the service device 100.

More specifically, the authentication unit 240, if it is confirmed that the user authentication process, the user authentication information and the user verification information coincide with each other, by passing the user authentication processing result to the service device 100, to the service device 100 It is possible to allow the user to use the service only by the user authentication processing result.

At this time, the authentication unit 240 calls the API provided by the second operating system to deliver the user authentication processing result to the user unit 210 located in the 'Normal World' to transmit to the service device 100, or 'Secure By activating a communication function on the World ', the user authentication processing result is directly provided to the service device 100, thereby allowing the service device 100 to use the service of the user unit 210 only with the user authentication processing result.

On the other hand, the authentication unit 240 authenticates the user authentication processing result when the service to be used in the user unit 210 is not a service provided by the service device 100, but is a service running in the user unit 210 itself. By transmitting only to the unit 210, the authenticator 210 can use the service only with the result of the user authentication process.

As described above, according to the user authentication system according to an embodiment of the present invention, a user device based on the TrustZone technology performs user authentication required from the service device in connection with service use provided from the service device. And when the service is determined to be an authentication processing target capable of processing the user authentication, receives user authentication information to process the user authentication based on the user authentication information, and the service device receives the user authentication information. By allowing the service to be normally used only with the result of the user authentication process, secure user authentication can be performed by combining an isolated execution environment that is not exposed from a security threat with a hardware security technology.

Hereinafter, the advertisement service method according to an embodiment of the present invention will be described with reference to FIGS. 4 and 5. Here, for the convenience of description, the configuration shown in FIGS. 1 and 2 described above will be described with reference to the corresponding reference numerals.

First, an operation flow in a user authentication system according to an embodiment of the present invention will be described with reference to FIG. 4.

First, the user device 200 uses a service provided by the service device 100, and confirms that user authentication is required from the service device 100 in connection with the service use (S110-S130).

Then, when the user device 200 requests user authentication from the service device 100 in connection with service use, the user device 200 determines whether the service provided from the service device 100 is subject to an authentication process capable of its own user authentication process. It is determined (S140).

In this case, the user device 200 pre-specifies and manages a service list corresponding to an authentication processing target, and when it is confirmed that a service provided from the service device 100 is included in the service list, the service is authenticated. Judging by the target.

If the user device 200 determines that the service provided from the service device 100 is an authentication target, the user device 200 notifies the service device 100 of security processing, thereby processing the user authentication required for service use by itself. The service device 100 will be notified that it will be performed (S150).

Then, if the service provided from the service device 100 is determined to be the authentication processing target, it receives the user authentication information from the user, and processes the user authentication based on the received user authentication information (S160-S170).

In this case, the service apparatus 100 may designate and store user verification information for each service list subject to authentication in advance, and whether the user authentication information received from the user and the user verification information coincide with each other during the user authentication process. By confirming, the user authentication related to the use of the service provided from the service device 100 is processed.

Next, when it is confirmed that the user authentication processing result, the user authentication information and the user verification information coincide with each other, the user device 200 transmits the user authentication processing result to the service device 100 (S180).

Thereafter, the service device 100 receives the user authentication processing result from the user device 200, and confirms that the user device 200 is an authenticated user based on only the user authentication processing result, thereby causing the user device 200 to service. It can be used normally (S190).

Hereinafter, an operation of the user device 200 according to an embodiment of the present invention will be described in detail with reference to FIG. 5.

First, when it is confirmed that the user authentication is required from the service device 100 in connection with the use of the service provided by the service device 100, the user unit 210 requests the corresponding user authentication from the authentication unit 240 ( S210-S220).

In this case, the use unit 210 calls a public API provided by the first operating system to access the service device 100 to use the service provided by the service device 100, and user authentication in connection with service use. If it is confirmed that the required, it is to request the user authentication to the authentication unit 240 located in the 'Secure World'.

Then, the determination unit 220 determines whether or not the service provided from the service device 100 is subject to authentication processing capable of its own user authentication process in connection with the user authentication request received from the user unit 210. (S230).

At this time, the determination unit 230 determines the service provided from the service device 100 as the authentication processing target by checking the list of services previously designated as the authentication processing target by calling the API provided by the second operating system.

When the service provided by the service device 100 is determined to be an authentication process, the determination unit 220 notifies the service device 100 of the security process, thereby requesting the service device 100 in connection with service use. The user authentication may be recognized by the user device 200 to process itself (S240-S250).

At this time, the determination unit 230 calls the API provided by the second operating system and delivers the determination result to the usage unit 210 located in the 'Normal World', thereby causing the usage unit 210 to process the user authentication itself. It is possible to notify the service device 100 that it will.

Next, if the service provided from the service device 100 is determined to be an authentication process, the authentication unit 240 receives user authentication information from the user and processes user authentication based on the received user authentication information ( S260-S280).

At this time, the authentication unit 240 calls the API provided by the second operating system to display the information input screen for receiving the user authentication information, thereby receiving the user authentication information from the user through the information input screen, ' By comparing the user verification information previously stored in the storage unit 230 located in Secure World 'and the received user authentication information, the user authentication is processed.

Then, the authentication unit 240, if it is confirmed that the user authentication processing result, the user authentication information and the user verification information match each other, by passing the user authentication processing result to the service device 100, the service device 100 It is possible to allow the use of the service of the user unit 210 only by the result of the user authentication process (S290-S310).

At this time, the authentication unit 240 calls the API provided by the second operating system to deliver the user authentication processing result to the user unit 210 located in the 'Normal World' to transmit to the service device 100, or 'Secure By activating a communication function on the World ', the user authentication processing result is directly provided to the service device 100, thereby allowing the service device 100 to use the service of the user unit 210 only with the user authentication processing result.

As described above, according to the user authentication method according to an embodiment of the present invention, a user device based on the TrustZone technology performs user authentication required from the service device in connection with service use provided from the service device. And when the service is determined to be an authentication processing target capable of processing the user authentication, receives user authentication information to process the user authentication based on the user authentication information, and the service device receives the user authentication information. By allowing the service to be normally used only with the result of the user authentication process, secure user authentication can be performed by combining an isolated execution environment that is not exposed from a security threat with a hardware security technology.

Meanwhile, the steps of the method or algorithm described in connection with the embodiments presented herein may be embodied directly in hardware or in the form of program instructions that may be executed by various computer means and recorded on a computer-readable medium. The computer readable medium may include program instructions, data files, data structures, and the like, alone or in combination. Program instructions recorded on the media may be those specially designed and constructed for the purposes of the present invention, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

Although the present invention has been described in detail with reference to preferred embodiments, the present invention is not limited to the above-described embodiments, and the technical field to which the present invention belongs without departing from the gist of the present invention as claimed in the following claims. Anyone skilled in the art will have the technical idea of the present invention to the extent that various modifications or changes are possible.

According to the user authentication system and method, and apparatus applied thereto of the present invention, based on the trust zone (TrustZone) technology, user authentication required for service use is processed in the user device body, and only the user authentication processing result is serviced. By passing on to the provider, the service can be used on the user device, thus exceeding the limitations of the existing technology, and not only the use of the related technology but also the possibility of marketing or sales of the applied device is not only sufficient but also realistically implemented. Since it can be done, it is an invention with industrial applicability.

100: service device
200: user device
210: use unit 220: determination unit
230: storage unit 240: authentication unit

Claims (14)

A user device for using a service,
A use unit for requesting user authentication required from the service device in connection with service use provided from a service device; And
If the service is determined to be an authentication processing object capable of processing the user authentication, receiving user authentication information from a user, and processing the user authentication on the user device itself based on the user authentication information and the user authentication processing result is a service device And an authentication unit for confirming that the user device is an authenticated user only by the result of the user authentication process without receiving the user authentication information from the user device by transmitting the service information to the user device. ,
A first operating system and a second operating system for supporting the service use and the user authentication process, respectively;
The first operating system is a general-purpose operating system that provides an open API (Open Application Programmer Interface) for supporting to request the user authentication required in connection with the use of the service,
The second operating system is dedicated to provide the API (Open Application Programmer Interface) for determining the service as the authentication processing target and for supporting the user authentication in relation to the service determined as the authentication processing target. (專用) A user device characterized in that the operating system. delete delete delete delete delete delete delete delete delete delete delete delete delete

Images