KR102101719B1 - A method and system for simple authentication by using web storage - Google Patents

Abstract

According to one embodiment of the present invention, provided is a simple authentication method using a web storage of a browser, which comprises the following steps. A server generates an authentication token, a public key, and a private key based on a received user key to store the authentication token, the public key, and the private key in a session, and transmits a session key corresponding to the session, the authentication token, and the public key to a terminal. The terminal uses the received public key to encrypt PIN number data input by a user, and transmits the encrypted data to a server together with the received session key. The server uses the private key corresponding to the received session key to decrypt the PIN number data so as to perform simple authentication. The user key and the PIN number data can be stored in a web storage of the terminal and can be differently set for each device or browser.

Description

Simple authentication method and system using web storage of a browser {A METHOD AND SYSTEM FOR SIMPLE AUTHENTICATION BY USING WEB STORAGE}

The present invention relates to a simple authentication method and system using a web storage of a browser, and more specifically, to issue a one-time public key and a private key for each device and browser using the simple authentication data stored in the web storage, and the issued public key. And a method and system for performing simple authentication using a private key.

Due to the development of Internet services, most people use government Internet, educational institutions, medical institutions, telecommunications companies, financial companies, passenger companies, asset management, credit information, portals, social network services (SNS), and games. , Shopping, ticketing, courier, electronic voting, and many other online services.

Therefore, a user who wants to use such a service must authenticate by entering a personal information including his / her real name or the like, or a user by entering a specific ID and password. However, since it is quite cumbersome to repeat such an authentication process for each site, recently, a method for making a financial transaction on the Internet easier by facilitating login is called simple authentication.

On the other hand, in the past, a method mainly used for authenticating these users was a method using a symmetric key. However, this symmetric key method has a problem in that it is not safe from hackers because a single secret key is used by both the server and the terminal.

On the other hand, in order to solve this problem, it has been developed as a method of encrypting data and performing authentication using a combination of a public key and a private key.

However, in using a public key and a private key for authenticating an existing user, the browser storage (local storage) still uses a plaintext storage method, and thus has many security problems. Of course, although it uses an encryption method as a security measure, these methods still have problems with personal information leakage or security. Therefore, in order to solve these problems, it is necessary to safely store and use public key and private key.

Registered Patent Publication No. 10-1666374, 2016.10.14

The problem to be solved by the present invention is a simple authentication method and system using web storage, issuing a one-time public key for each device and browser using simple authentication data stored in web storage, and using the issued public key By performing simple authentication, you can enhance the security of personal information protection.

In addition, it is possible to perform secondary authentication by storing the generated private key in a session of the server and transmitting a session key and a public key for the stored session to the terminal.

The problems to be solved by the present invention are not limited to the problems mentioned above, and other problems not mentioned will be clearly understood by those skilled in the art from the following description.

A simple authentication method using a web storage of a browser according to an aspect of the present invention for solving the above-described problem, the server generates an authentication token, a public key and a private key based on the received user key and stores it in a session, Transmitting a session key corresponding to the session, the authentication token and the public key to a terminal; Encrypting the PIN number data input by the user using the received public key, and transmitting the encrypted data to the server together with the received session key; And the server decrypting the PIN number data using a private key corresponding to the received session key to perform simple authentication, and the user key is stored in the web storage of the terminal and is different for each device or browser. It can be set.

In addition, the step of performing the simple authentication may include: performing the primary authentication by restoring the encrypted PIN number data based on the private key retrieved by the server through the received session key; If the primary authentication passes, encrypting the authentication token at the terminal using the public key, and transmitting the encrypted data to the server together with the received session key; And comparing the authentication token restored on the basis of the private key with the authentication token stored in the session, and performing the second authentication to delete the session.

In addition, the user key may be encrypted with an encryption algorithm, and the PIN number may be hash-encrypted and stored in the web storage.

In addition, the step of transmitting the public key to the terminal, querying the authentication policy of the server; And in accordance with the authentication policy of the server may include the step of inquiring the user key in the simple authentication method or the user public key in the terminal.

In addition, the step of transmitting the public key to the terminal, the terminal determining whether the user key is stored in the web storage; And when the user key is not stored, registering a PIN number from the user.

In addition, the step of performing the simple authentication may update the number of authentication attempts whenever the PIN number is mismatched, and delete the PIN number data stored in the server and / or terminal when the number of authentication attempts increases by a predetermined number or more. .

A simple authentication system using web storage according to another aspect of the present invention for solving the above-described problems, generates an authentication token, a public key, and a private key based on the received user key and stores it in a session, and corresponds to the session Simple authentication by transmitting the session key, the authentication token and the public key to the terminal, and decrypting the PIN number data using the private key corresponding to the received session key when the encrypted data and the session key are received from the terminal A server to perform the; And a terminal that requests issuance of a public key based on the user key, encrypts the PIN number data entered by the user using the public key received from the server, and transmits the encrypted data to the server along with the received session key. Including, the user key is stored in the web storage of the terminal may be set differently for each device or browser.

In addition, the server performs primary authentication by restoring the encrypted PIN number data based on the private key retrieved through the received session key, and when the primary authentication passes, the terminal authenticates the terminal. The token is encrypted using the public key, and the encrypted data is transmitted to the server along with the received session key, and the server compares the authentication token restored based on the private key and the authentication token stored in the session and compares the 2 After performing secondary authentication, an operation of deleting the session may be performed.

In addition, the server may update the number of authentication attempts whenever the restored PIN number is mismatched, and delete the PIN number data stored in the server and / or terminal when the number of authentication attempts increases by a predetermined number or more. .

Other specific matters of the present invention are included in the detailed description and drawings.

According to an embodiment of the present invention, authentication may be performed by issuing a private key differently for each device or browser by using simple authentication data stored in web storage. In addition, since it supports public key-based one-time key generation for each authentication request, it can provide stronger security in a simple authentication method, so it can provide a simple and reliable authentication method that is high enough to replace a public certificate. have.

The effects of the present invention are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art from the following description.

1 is a conceptual diagram illustrating a simple authentication system using a web storage of a browser according to an embodiment.
2 is a flowchart illustrating a simple authentication method using web storage according to an embodiment.
3 is a diagram illustrating an example of registering a PIN number in an embodiment.
4 is a flowchart illustrating an example of performing simple authentication using web storage according to an embodiment.
5 is a flowchart illustrating another example of performing simple authentication using web storage according to an embodiment.
6 is a block diagram schematically showing an internal configuration of a server according to an embodiment.
7 is a block diagram schematically showing the internal configuration of a terminal according to an embodiment.

Advantages and features of the present invention, and methods for achieving them will be clarified with reference to embodiments described below in detail together with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but may be implemented in various different forms, and only the present embodiments allow the disclosure of the present invention to be complete, and are common in the technical field to which the present invention pertains. It is provided to fully inform the skilled person of the scope of the present invention, and the present invention is only defined by the scope of the claims.

The terminology used herein is for describing the embodiments and is not intended to limit the present invention. In the present specification, the singular form also includes the plural form unless otherwise specified in the phrase. As used herein, “comprises” and / or “comprising” does not exclude the presence or addition of one or more other components other than the components mentioned. Throughout the specification, the same reference numerals refer to the same components, and “and / or” includes each and every combination of one or more of the components mentioned. Although "first", "second", etc. are used to describe various components, it goes without saying that these components are not limited by these terms. These terms are only used to distinguish one component from another component. Therefore, it goes without saying that the first component mentioned below may be the second component within the technical spirit of the present invention.

Unless otherwise defined, all terms (including technical and scientific terms) used in the present specification may be used as meanings commonly understood by those skilled in the art to which the present invention pertains. In addition, terms defined in the commonly used dictionary are not ideally or excessively interpreted unless explicitly defined.

The spatially relative terms “below”, “beneath”, “lower”, “above”, “upper”, etc., are as shown in the figure. It can be used to easily describe a correlation between a component and other components. The spatially relative terms should be understood as terms including different directions of components in use or operation in addition to the directions shown in the drawings. For example, when a component shown in the drawing is turned over, a component described as "below" or "beneath" of another component is placed "above" another component. Can lose. Accordingly, the exemplary term “below” can include both the directions below and above. The component can also be oriented in other directions, so that spatially relative terms can be interpreted according to the orientation.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a conceptual diagram illustrating a simple authentication system using a web storage of a browser according to an embodiment.

Referring to FIG. 1, a simple authentication system using a web storage of a browser according to an embodiment may include a server 100 and a terminal 200.

First, the server 100 and the terminal 200 may perform end-to-end encryption for all communication sections 10 through an SSL encryption method. First, the server 100 generates a public key and a private key and stores it in a session. In step 101, while distributing the public key, the session key for the session corresponding to the public key may be transmitted to the terminal 200.

The terminal 200 may perform encryption on the session key received in step 201, and encrypt the simple authentication data using the public key received in step 202. Here, the simple authentication data may include user key and PIN number data. In step 101, the server 100 verifies the integrity of the received authentication information, and when the encrypted data and the session key are received from the terminal 200 in step 102, the PIN number data is used using the private key corresponding to the session key. By decoding, simple authentication can be performed. On the other hand, an authentication token can be used separately to verify the integrity of the delivered information, and security can be further strengthened by performing simple authentication in two steps using an authentication token.

Finally, in step 203, the terminal 200 may perform an operation such as login based on the simple authentication result.

In a simple authentication method according to another embodiment, information for simple authentication is stored in a blockchain and can be verified in an authentication step.

For example, public key information for simple authentication can be stored on the blockchain. The simple authentication information is encrypted and decrypted based on the public key and the private key, which may occur when the public key for encrypting the PIN number entered by the user is tampered / manipulated. Therefore, in order to prevent such a case, the public key can be stored in a blockchain manner to ensure reliability, and a public key can be obtained from the terminal 200 without the server 100 to encrypt the PIN number.

As another example, authentication data (user key and PIN number) encrypted based on the public key may be stored in the blockchain. Therefore, the server 100 or the terminal may increase the reliability by lowering the possibility of tampering by performing authentication and verification of the PIN number input by the user based on the blockchain.

As described above, the simple authentication system using the web storage of the browser according to an embodiment issues a one-time public key for each device and browser using the simple authentication data stored in the web storage, and uses the issued public key. By performing simple authentication, you can enhance the security of personal information protection.

In addition, by storing the generated private key in the session of the server 100 and transmitting a session key and a public key for the stored session to the terminal 200, secondary authentication is performed to enhance security. Can be.

2 is a flowchart illustrating a simple authentication method using web storage according to an embodiment.

Referring to FIG. 2, in the simple authentication method using web storage according to an embodiment, in step S200, the server 100 generates an authentication token, a public key, and a private key based on the received user key and stores it in a session. , The session key corresponding to the session, the authentication token and the public key are transmitted to the terminal 200. Here, the user key may be stored in the web storage of the terminal 200 and set differently for each device or browser.

Next, in step S210, the simple authentication method using web storage according to an embodiment uses the public key received by the terminal 200 to encrypt the PIN number data entered by the user and receives the encrypted data. The transmitted session key is transmitted to the server 100.

Next, in step S220, in a simple authentication method using web storage according to an embodiment, the server 100 performs simple authentication by decrypting the PIN number data using a private key corresponding to the received session key. .

More specifically, the server 100 performs primary authentication by restoring the encrypted PIN number data based on the private key retrieved through the received session key. Here, the first authentication is performed by the server when the server stores the PIN number data corresponding to the user key, and when the terminal has it, authentication is performed by the terminal. Of course, cross-validation can be performed at the server and the terminal. When the primary authentication passes, the terminal 200 encrypts the authentication token using the public key, and transmits the encrypted data to the server 100 together with the received session key. If the PIN number is mismatched and the first authentication fails, the server 100 counts the number of authentication attempts for each user key, and if the cumulative count is greater than or equal to a predetermined value, the server 100 and / or the terminal 200 in consideration of the possibility of hacking ), Delete the PIN number data.

Meanwhile, the server 100 compares the authentication token restored based on the private key and the authentication token stored in the session, performs secondary authentication, and then deletes the session. That is, the session and the session key are generated once for each authentication request, and when authentication is completed, the generated key can be prevented from being leaked.

Hereinafter, an example of registering a PIN number of a user and an example of performing simple authentication will be described in detail with reference to FIGS. 3 to 5.

3 is a diagram illustrating an example of registering a PIN number in an embodiment.

Referring to FIG. 3, when the user requests PIN registration in step 300, the terminal 200 determines in step 301 whether a PIN is registered. If the PIN is registered, the process proceeds immediately to the PIN authentication step. Meanwhile, the PIN authentication step will be described later in detail with reference to FIGS. 4 and 5.

If it is determined in step 301 that the PIN is not registered, the terminal 200 proceeds to step 303 to perform identity authentication or ID / PW authentication. Then, the user information obtained based on the authentication result is transmitted to the server 100. Here, the user information may be information linked to a CI or a user ID or searched through a periodic system.

In step 304, the server generates a registration token based on the user information for PIN registration. Here, the registration token may be hash-encrypted data in the form of a host name and a time stamp combined with the user's browser information.

Then, in step 305, the PIN number policy is queried. In step 306, a public key and a private key are generated using the user information. Then, in step 307, a PIN user key is generated based on the user information. For example, the PIN user key may be data in which browser information and service domain information are added to the user information. Accordingly, the user key may be generated in the terminal 200 and transmitted to the server 100.

In step 308, the server stores the generated registration token and private key in the session, and transmits the PIN number policy, public key, session key, and PIN user key to the terminal.

In step 309, the terminal 200 receives a PIN number from the user. In step 310, the terminal 200 checks whether a PIN number is input according to the received PIN number policy. For example, if the same number or consecutive numbers do not meet the criteria, it is determined as an error and step 309 is repeated.

In step 311, PIN number data conforming to the PIN number policy is encrypted based on the public key. In addition, the terminal 200 transmits the encrypted PIN user key, PIN number, registration token, and session key back to the server based on the public key. At this time, SSL communication may be used between the terminal 200 and the server 100 to enhance security.

In step 312, the server 100 may decrypt the received data using the private key corresponding to the received session key.

In step 313, the server 100 checks the registration token. For example, check whether the registration token has been reused based on the browser and hostname registration information, or check if the validity time has elapsed using a timestamp. If reuse is confirmed, proceed to step 314 to delete the session and terminate the PIN registration procedure in step 315.

Meanwhile, the server 100 checks the PIN number policy once more in step 316 and then checks other policies related to the PIN number in step 317. For example, the date of birth and whether the mobile phone number is included can be inquired through the registration information of the periodic system.

If the other policy check related to the PIN number is passed, the session is deleted in step 318 and the process proceeds to steps 319 and 320 to store the registration token and PIN number for the PIN user key.

Next, the PIN user key, PIN number, and authentication policy are transferred to the terminal 200, and stored in the web storage (322) or stored in a cookie (323), or completed when the storage is completed in step 321. In step 324, the PIN registration process ends. Meanwhile, the PIN user key may be encrypted by an encryption algorithm, and the PIN number may be hash encrypted.

When the PIN number registration is completed according to the above, next, authentication may be performed with the registered PIN number according to an embodiment described later with reference to FIGS. 4 or 5. 4 shows how the server 100 performs primary authentication and the terminal 200 performs verification, and FIG. 5 shows how the terminal 200 performs primary authentication and the server 100 performs verification. Explain how. On the other hand, it will be apparent to those skilled in the art to which the present invention pertains that some simple authentication procedures may be implemented using a blockchain in the operation described below.

4 is a flowchart illustrating an example of performing simple authentication using web storage according to an embodiment.

4, the PIN authentication process is started in step 400. In step 401 to step 409, it is determined whether PIN number registration is required. First, in step 401, the server 100 queries the authentication policy and delivers it to the terminal 200, and the terminal 200 queries the user key to determine whether PIN registration is performed in step 403. If the PIN number is registered in the web storage, the server 100 checks whether the PIN registration has been revoked (404) or the expiration date has expired (405), and thus the PIN number is revoked (406) and the termination log is stored (407). After that, finally, the PIN is revoked (408) at the terminal 200 and the PIN registration procedure may be performed again at step 409.

In step 410, when PIN registration is confirmed, the server 100 generates an authentication token for simple authentication, stores it in a session, and transmits it to the terminal 200. Here, the authentication token may be a combination of host name, IP, and time stamp.

When the authentication token is received, the terminal 200 receives the PIN number from the user in step 411 and requests the public key in step 412.

In step 413, the server 100 generates a public key and a private key based on the user key, but generates a public key and a private key and stores it in a session, and stores the session key and the public key corresponding to the session in the terminal 200 To deliver.

In step 414, the terminal 200 encrypts the PIN number data input by the user using the received public key, and transmits the encrypted data to the server along with the received session key.

In step 415, the server 100 decrypts the PIN number data using the private key corresponding to the received session key, and checks in step 416 whether the number of PIN authentication attempts has been exceeded. If the number of PIN authentication attempts has been exceeded, steps 417 to 421 are performed to end PIN authentication.

In step 422, the number of PIN authentication attempts is increased, and in step 423, primary authentication is performed to check whether the PIN number matches the PIN number stored in the server 100. The same operation may be performed in the terminal 200 and / or the server 100 in step 425. If the PIN numbers do not match, the authentication failure log is stored in step 424 and the PIN number input step of step 411 is repeated. If the primary authentication passes, the terminal 200 encrypts the authentication token using the public key received from the server, and transmits the encrypted data to the server along with the previously received session key.

In step 426, the server 100 checks the authentication token. For example, the second authentication is performed whether the authentication token is reused or the validity time of the authentication has elapsed.

If the check fails, the session is deleted (step 427), the authentication failure log is stored (step 428), and PIN authentication is terminated (step 429). When the authentication token check passes, the server 100 deletes the session (step 430) but separately stores the authentication token (step 431) and initializes the number of authentication attempts (step 432). In step 433, finally, the login of the terminal 200 through the simple authentication of the PIN number is completed.

5 is a flowchart illustrating another example of performing simple authentication using web storage according to an embodiment.

If PIN authentication is started in step 500, it is determined in step 501 whether a PIN is registered, and if PIN registration is not performed, the process proceeds to step 502 and the registration step described in FIG.

In step 503, if it is confirmed that the PIN is registered, the user key stored in the web storage or cookie is inquired and transmitted to the server. In step 504, the server 100 checks whether the PIN registration has been canceled, and in step 505, the PIN number validity period is checked.

If the PIN registration is canceled or canceled, the PIN registration process is performed through steps 506 to 509.

In step 510, when PIN registration is confirmed, the server 100 generates an authentication token for simple authentication, stores it in a session, and transmits it to the terminal 200. Here, the authentication token may be a combination of host name, IP, and time stamp.

When the authentication token is received, the terminal 200 receives the PIN number from the user in step 511, and requests the public key in step 512.

In step 513, the server 100 generates a public key and a private key based on the user key, but generates the public key and the private key in a session and stores the session key and the public key corresponding to the session in the terminal 200 To deliver.

In step 514, the terminal 200 encrypts the PIN number data input by the user using the received public key, and transmits the encrypted data to the server along with the received session key.

In step 515, the server 100 decrypts the PIN number data using the private key corresponding to the received session key, and checks in step 516 whether the number of PIN authentication attempts has been exceeded. If the number of PIN authentication attempts has been exceeded, steps 517 to 522 are performed to end PIN authentication.

In step 523, the server 100 hashes the decrypted PIN number and transmits it to the terminal 200. In step 524, the terminal 200 checks whether the received PIN number and the stored PIN number match. If the PIN numbers do not match, the authentication failure log is stored in step 532 and the PIN number input step of step 511 is repeated. If the primary authentication passes, the terminal 200 encrypts the user key, PIN number, and authentication token received from the server using the public key, and transmits the encrypted data to the server along with the previously received session key.

In step 526, the server 100 decrypts the authentication token, user key, and PIN number using the private key corresponding to the session key, and in step 527, the server 100 checks the authentication token. For example, the second authentication is performed whether the authentication token is reused or the validity time of the authentication has elapsed.

If the check fails, the session is deleted (step 528), the authentication failure log is stored (step 529), and PIN authentication is terminated (step 530). If the authentication token check passes, the server 100 performs a PIN number check (step 531), and if the check fails, the authentication failure log is stored (step 532) and if the check passes, the session is deleted (step 533). do. The server 100 stores the authentication token separately (step 534) and initializes the number of authentication attempts (step 535). In step 536, finally, the login of the terminal 200 through the simple authentication of the PIN number is completed.

6 is a block diagram schematically showing the internal configuration of the server 100 according to an embodiment, and FIG. 7 is a schematic view showing the internal configuration of the terminal 200 according to an embodiment.

6 and 7, only the components necessary for explaining an embodiment of the present invention are shown, but various components such as a display device may be further included. In addition, although omitted from the description of FIGS. 6 and 7, it is apparent to those skilled in the art that the present invention may further include a configuration necessary to perform the method described in FIGS. 1 to 5.

Referring to FIG. 6, the server 100 according to an embodiment may include a processor 130, a memory 140, and a communication unit 150. The operation of the server 100 performing simple authentication may be performed by executing a program stored in the memory 140 through the processor 130.

The operation performed by the processor 130 according to an embodiment generates an authentication token, a public key, and a private key based on the received user key and stores it in a session, the session key corresponding to the session, the authentication token, and When the public key is transmitted to the terminal and the encrypted data and the session key are received from the terminal, simple authentication can be performed by decrypting the PIN number data using the private key corresponding to the received session key.

In addition, the processor 130 may perform the primary authentication by restoring the encrypted PIN number data based on the private key retrieved through the received session key.

In addition, the processor 130 may perform an operation of deleting the session after performing the second authentication by comparing the authentication token restored based on the private key and the authentication token stored in the session.

In addition, the processor 130 may update the number of authentication attempts whenever the restored PIN number is mismatched, and delete the PIN number data stored in the server and / or terminal when the number of authentication attempts increases by a predetermined number or more. .

In one embodiment, the communication unit 150 may perform wireless or wired communication between the terminal 200 and another server or other external device. For example, the communication unit 150 may perform encrypted communication with the terminal 200 in an SSL method, and may transmit a public key and encrypted data.

Referring to FIG. 7, the terminal 200 according to an embodiment may include a processor 230, a memory 240, a communication unit 250, and an input unit 260. The operation of the simple authentication terminal 200 may be performed by executing a program stored in the memory 240 through the processor 230.

The operation performed by the processor 230 according to an embodiment requests a public key issuance based on the user key, encrypts the PIN number data entered by the user, and uses the public key received from the server to encrypt the data. It may include an operation of transmitting data to the server along with the received session key. The user key and PIN number may be stored in the web storage of the terminal and set differently for each device or browser.

As another example, the processor 230 may encrypt the authentication token using a public key, and transmit the encrypted data to the server along with the session key received from the server 100.

As another example, authentication data (user key and PIN number) encrypted based on the public key may be stored in the blockchain. Accordingly, the processor 230 may increase the reliability by lowering the possibility of tampering by performing authentication and verification of the PIN number input by the user based on the blockchain.

As another example, the processor 230 may encrypt the PIN number data entered by the user using a public key stored in the blockchain.

Meanwhile, the server 100 and the terminal 200 described above may include one or more processors 130 and 230 and / or one or more memories 140 and 240. Also, the memory 140 and 240 may include volatile and / or nonvolatile memory. The one or more memories 140 and 240 may store instructions that, when executed by the one or more processors 130 and 230, cause the one or more processors 130 and 230 to perform operations. In the present disclosure, programs or commands are software stored in the memory 140 and 240, and various functions are applied to applications so that an operating system, applications, and / or applications for controlling the resources of the server 100 can utilize resources of the device. It may include middleware provided.

The one or more processors 130 and 230 may control at least one component of the server 100 and the terminal 200 connected to the processors 130 and 230 by driving software (eg, programs and instructions). Also, the processors 130 and 230 may perform various operations related to the present disclosure, such as processing, data generation, and processing. Also, the processor 130 or 230 may load data or the like from the memory 140 or 240 or store the data in the memory 140 or 240.

In one embodiment, at least one of the components of the server 100 and the terminal 200 may be omitted, or another component may be added. In addition, additionally or alternatively, some of the components may be integrated or implemented, or may be implemented as singular or plural entities.

As described above, the communication units 150 and 250 include enhanced Mobile Broadband (eMBB), Ultra Reliable Low-Latency Communications (URLLC), Massive Machine Type Communications (MMTC), long-term evolution (LTE), LTE Advance (LTE-A) , Universal Mobile Telecommunications System (UMTS), Global System for Mobile communications (GSM), Code division multiple access (CDMA), Wideband CDMA (WCDMA), Wireless Broadband (WiBro), Wireless fidelity (WiFi), Bluetooth (Bluetooth), NFC Wireless communication according to a method such as (near field communication), Global Positioning System (GPS) or global navigation satellite system (GNSS) may be performed.

The above-described input unit 260 may include means for inputting the user's simple authentication information (PIN number) to the terminal 200, such as a keyboard, mouse, touch pad, and camera module.

Meanwhile, steps of a method or algorithm described in connection with an embodiment of the present invention may be implemented directly in hardware, a software module executed by hardware, or a combination thereof. The software modules may include random access memory (RAM), read only memory (ROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, hard disk, removable disk, CD-ROM, or It may reside on any type of computer-extractable recording medium well known in the art.

The embodiments of the present invention have been described above with reference to the accompanying drawings, but a person skilled in the art to which the present invention pertains may implement the present invention in other specific forms without changing its technical spirit or essential features. You will understand. Therefore, it should be understood that the above-described embodiments are illustrative in all respects and not restrictive.

100: server
200: terminal

Claims (10)

In the simple authentication method using the web storage of the browser,
The server generates a session key corresponding to the session and the session one-time according to an authentication request, and generates an authentication token, a public key, and a private key based on the user key received from the terminal and stores the session key in the session. Transmitting a key, the authentication token and the public key to a terminal;
Encrypting the PIN number data input by the user by using the public key received by the terminal and transmitting it to the server together with the received session key;
The server decrypts the received encrypted PIN number data using the private key stored in the session corresponding to the received session key, and checks whether the decrypted PIN number data matches the PIN number data previously stored in the web storage. Performing the first authentication;
The result of the primary authentication, when matching, the terminal encrypts the received authentication token using the received public key and transmits the received authentication key to the server together with the received session key;
Performing secondary authentication by confirming whether the received encrypted authentication token matches the authentication token stored in the session using the private key stored in the session corresponding to the received session key by the server; And
And when the second authentication is completed by the server, deleting the session and the session key.
The user key and the PIN number data is stored in web storage and is set differently for each device or browser,
The authentication token, a public key, a private key, a session and a session key are generated once for each authentication request.
delete The method of claim 1, wherein the user key is encrypted with an encryption algorithm, and the PIN number is hash encrypted and stored in the web storage.
delete The method of claim 1, wherein the step of transmitting the public key to the terminal,
The terminal determining whether the user key is stored in the web storage; And
If the user key is not stored, the method further comprising the step of registering a PIN number from the user.
According to claim 1,
The server is a result of the first authentication, if it is mismatched, the number of authentication attempts is updated, and if the number of authentication attempts is greater than or equal to a predetermined value, the PIN number data stored in the server is deleted.
In the simple authentication system using web storage,
Generates a session key corresponding to the session and the session one-time according to an authentication request, generates an authentication token, a public key, and a private key based on the user key received from the terminal and stores it in the session, and stores the session key, When the authentication token and the public key are transmitted to the terminal, and the encrypted PIN number data and session key are received from the terminal, the encrypted PIN number data is decrypted using the private key stored in the session corresponding to the received session key. Then, it checks whether the decrypted PIN number data matches the PIN number data pre-stored in the web storage and proceeds with the first authentication. Upon receiving the encrypted authentication token and session key from the terminal, it connects to the session corresponding to the received session key. A server that performs secondary authentication by confirming whether the received encrypted authentication token matches the authentication token stored in the session using the stored private key, and deletes the session and the session key when the secondary authentication is completed. ; And
Requesting to issue a public key based on the user key to the server, encrypting the PIN number data entered by the user using the public key received from the server, and transmitting it to the server together with the received session key. The first authentication result, if matched, includes a terminal that encrypts the received authentication token using the received public key and transmits the received authentication key together with the received session key to the server,
The user key and the PIN number data is stored in web storage and is set differently for each device or browser,
The authentication token, the public key, the private key, the session and the session key are generated once for each authentication request.
delete The method of claim 7,
The server updates the number of authentication attempts when the first authentication result is mismatched, and deletes PIN number data previously stored in the server when the number of authentication attempts is greater than or equal to a predetermined value.
A simple authentication program stored in a recording medium to execute the method of any one of claims 1, 3, 5, and 6 in combination with a computer that is hardware.

Images