KR102428409B1 - User authentication device, user authentication method using security code and computer program - Google Patents

Abstract

The present disclosure provides a login input receiving unit for receiving login input data including an ID and a password corresponding to the ID from a terminal; a security code generator for generating a first security code based on the ID of the login input data and the input time; and receiving a second security code from the terminal, determining whether the user authentication device matches the first security code and the second security code, and processing the login input data in consideration of the match Disclosed is a user authentication device for authenticating a user using a security code, including; code processing unit.

Description

User authentication device, user authentication method and computer program using a security code {User authentication device, user authentication method using security code and computer program}

The present disclosure relates to a user authentication device, a user authentication method using a security code, and a computer program.

In general, a password login device that is connected to a communication network and provides a certain service Server, SNS site server, Internet web hard disk server, etc.) requires a password for service permission authentication. In some cases, it is necessary to enter the ID and password at the same time. At this time, the password (or ID and password) is usually provided only to one individual, but if the service resource resource provided by the password login device can be shared with others, the password is logged in to someone other than the owner or administrator. You need to share the device's password (or ID and password) together.

The present invention has been devised to overcome the problems of the above technology, and includes a user authentication device that additionally receives a security code corresponding to login input data to determine whether to finally authenticate the login input, a user authentication method using a security code, and A computer program may be provided.

A user authentication method using a security code according to embodiments of the present invention comprises the steps of: receiving, by a user authentication device, login input data including an ID and a password corresponding to the ID from a terminal; generating a first security code based on an ID and an input time point; receiving, by the user authentication device, a second security code from the terminal; and, by the user authentication device, the first security code and the second security code and determining whether codes match, and processing the login input data in consideration of whether the codes match.

The first security code may include one or more input units included in the ID of the login input data converted into a security code generation rule.

The method may further include transmitting output data providing a security code generation rule to the terminal before receiving the second security code.

The first security code may further include a time conversion code converted based on a time value corresponding to an input time point at which the login input data is input.

Prior to generating the first security code, the method further includes transmitting a user code related to generation of a security code from the terminal, wherein the step of generating the first security code includes an ID of the login input data, and input A first security code may be generated based on a time point, and the first security code may be generated by further including the user code.

A user authentication apparatus according to embodiments of the present invention includes: a login input receiving unit for receiving login input data including an ID and a password corresponding to the ID from a terminal; a security code generator for generating a first security code based on the ID of the login input data and the input time; and receiving a second security code from the terminal, determining whether the user authentication device matches the first security code and the second security code, and processing the login input data in consideration of the match The user may be authenticated using a security code, including a code processing unit.

A computer program according to an embodiment of the present invention may be stored in a medium to execute any one of the methods according to an embodiment of the present invention using a computer.

In addition to this, another method for implementing the present invention, another system, and a computer-readable recording medium for recording a computer program for executing the method are further provided.

Other aspects, features and advantages other than those described above will become apparent from the following drawings, claims, and detailed description of the invention.

According to the present invention, it is possible to additionally receive a security code corresponding to the log-in input data to determine whether to finally authenticate the log-in input.

1 and 2 are diagrams of a network environment of a login processing system according to embodiments of the present invention.
3 is a block diagram of a TTP server 100 according to embodiments of the present invention.
4 to 6 are flowcharts of a user authentication method using a security code according to embodiments of the present invention.

Hereinafter, the configuration and operation of the present invention will be described in detail with reference to the embodiments of the present invention shown in the accompanying drawings.

Since the present invention can apply various transformations and can have various embodiments, specific embodiments are illustrated in the drawings and described in detail in the detailed description. Effects and features of the present invention, and a method for achieving them, will become apparent with reference to the embodiments described below in detail in conjunction with the drawings. However, the present invention is not limited to the embodiments disclosed below and may be implemented in various forms.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings, and when described with reference to the drawings, the same or corresponding components are given the same reference numerals, and the overlapping description thereof will be omitted. .

In the following embodiments, terms such as first, second, etc. are used for the purpose of distinguishing one component from another, not in a limiting sense.

In the following examples, the singular expression includes the plural expression unless the context clearly dictates otherwise.

In the following embodiments, terms such as include or have means that the features or components described in the specification are present, and the possibility that one or more other features or components may be added is not excluded in advance.

In the drawings, the size of the components may be exaggerated or reduced for convenience of description. For example, since the size and thickness of each component shown in the drawings are arbitrarily indicated for convenience of description, the present invention is not necessarily limited to the illustrated bar.

In the following embodiments, the x-axis, the y-axis, and the z-axis are not limited to three axes on the Cartesian coordinate system, and may be interpreted in a broad sense including them. For example, the x-axis, y-axis, and z-axis may be orthogonal to each other, but may refer to different directions that are not orthogonal to each other.

In cases where certain embodiments are otherwise practicable, a specific process sequence may be performed different from the described sequence. For example, two processes described in succession may be performed substantially simultaneously, or may be performed in an order opposite to the order described.

In the description of understanding, the same identification symbol means the same configuration, and unnecessary redundant descriptions and descriptions of well-known technologies will be omitted.

In an embodiment of the present invention, 'communication', 'communication network' and 'network' may be used with the same meaning. The above three terms refer to a wired/wireless short-distance and wide-area data transmission/reception network capable of transmitting and receiving files between a user terminal, terminals of other users, and a download server.

In the present specification, a Term Time Password (TTP) is a password (security code) set to operate as a password (security code) for a predetermined time, and may be operated to be changed to another TTP password instead of the previous TTP password when a predetermined time expires. .

1 and 2 are diagrams of a network environment of a login processing system according to embodiments of the present invention.

The login processing system may include a TTP server 100 , user terminals 201 , 202 , 203 , and a database 300 .

The TTP server 100 may process login input data from the user terminals 201 , 202 , and 203 to determine whether to authenticate the login input data. The TTP server 100 receives the login input data from the user terminals 201 , 202 , 203 through the other service server 400 and further performs an authentication process for the login input data through a security code corresponding to the login input data. can be done The security code is set to be valid for a set time, and after the set time expires, it can be changed to another code. The security code is sometimes set by the login user, but also by the administrator. do

The TTP server 100 may communicate with the user terminals 201 , 202 , and 203 through a network to transmit and receive login input data or a security code corresponding to the login input data. Here, the security code corresponding to the login input data is generated in various combinations corresponding to the login input data according to the security code generation rule, and specifically, input units (syllables, syllables, It can be generated in the form of a code of various combinations of alphabets, numbers, special characters, etc.) or a time stamp of the time entered in the code, and can be generated by the user's request or automatically generated by the system. have.

The TTP server 100 may process login input data of the user terminals 201 , 202 , 203 using user information (ID, password, security code, etc.) registered in the database 300 .

The user terminals 201, 202, and 203 are a smart phone, a personal computer (PC), a notebook computer, a mobile phone, a tablet PC, a navigation terminal, and a PDA according to embodiments of the present invention. (personal digital assistants), a smart TV (smart TV), PMP (portable multimedia player), and may be a digital broadcast receiver, but is not limited thereto.

The user terminals 201, 202, and 203 may request authentication for login input data by accessing the TTP server 100 through a network.

The user terminals 201 , 202 , and 203 may transmit login input data including an ID and password and a security code corresponding to the login input data to the TTP server 100 to request an authentication process of the login input data.

As shown in FIG. 2 , the login processing system may be implemented including a TTP server 100 , user terminals 201 , 202 , 203 , and other service servers 400 .

The TTP server 100 may operate in conjunction with another service server 400 that requests additional authentication for login input data. In this case, the TTP server 100 receives the login input data input from the user terminal 201 through the other service server 400 , generates a security code corresponding to the login input data, and a user who inputs the login input data A security code may be requested from the terminal 201 . The TTP server 100 may determine the identity between the generated security code and the security code input from the user terminal 201 to generate authentication information for the login input data. The other service server 400 may process the login input data of the user terminal 201 as success (Y) or failure (N) in response to the authentication information for the login input data received from the TTP server 100 .

The user terminals 201 , 202 , and 203 may access the TTP server 100 or another service server 400 through a network and receive various services.

The user terminals 201 , 202 , and 203 may install a program for transmitting and receiving information such as a security code to and from the TTP server 100 in the process of accessing the other service server 400 and performing a login process. The user terminals 201 , 202 , and 203 may access the TTP server 100 and perform a login process, and may access other service servers 400 with authentication information for the login process.

3 is a block diagram of a TTP server 100 according to embodiments of the present invention.

The TTP server 100 may include a processor 110 , a communication unit 120 , an input unit 130 , an output unit 140 , and a storage medium 150 .

The processor 110 is a configuration for controlling the TTP server 100 as a whole. Specifically, the processor 110 controls the overall operation of the TTP server 100 using various programs stored in the storage medium 150 of the TTP server 100 . For example, the processor 110 may include a CPU, a RAM, a ROM, and a system bus. Here, the ROM is a configuration in which an instruction set for system booting is stored, and the CPU copies the stored operating system of the TTP server 100 to the RAM according to the instructions stored in the ROM, and executes O/S to boot the system. When booting is complete, the CPU can perform various operations by copying various stored applications to RAM and executing them. Although it has been described above that the TTP server 100 includes only one CPU, it may be implemented with a plurality of CPUs (or DSPs, SoCs, etc.).

According to an embodiment of the present invention, the processor 110 may be implemented as a digital signal processor (DSP) processing a digital signal, a microprocessor, or a time controller (TCON). However, the present invention is not limited thereto, and a central processing unit (CPU), a micro controller unit (MCU), a micro processing unit (MPU), a controller, an application processor (AP), or It may include one or more of a communication processor (CP) and an ARM processor, or may be defined by a corresponding term. In addition, the processor 110 may be implemented as a system on chip (SoC), large scale integration (LSI), or a field programmable gate array (FPGA) type having a built-in processing algorithm.

The output unit 140 may display an interface generated by the TTP server 100 by the storage medium 150 . According to an embodiment of the present invention, the output unit 140 may display a user interface for a user input input through the input unit 130 . The output unit 140 may output the stored graphic data, visual data, auditory data, and vibration data under the control of the storage medium 150 .

The input unit 130 may include a user interface for inputting various information to the TTP server 100 . In an optional embodiment, the output unit 140 or the input unit 130 may be implemented integrally with the TTP server 100 or implemented separately. The separate output unit 140 or the input unit 130 may be electrically connected to the TTP server 100 or through a network. The separate output unit 140 or the input unit 130 may selectively communicate with the TTP server 100 .

The communication unit 120 is configured to transmit/receive data to and from devices such as a server and other electronic devices. The communication unit 120 includes a Bluetooth communication unit, a BLE (Bluetooth Low Energy) communication unit, a near field communication unit, a WLAN (Wi-Fi) communication unit, a Zigbee communication unit, an infrared (IrDA, infrared Data Association) communication unit, a WFD ( It may include a Wi-Fi Direct) communication unit, an ultra wideband (UWB) communication unit, a short-distance communication unit such as an Ant+ communication unit, a mobile communication network, or a wired Ethernet network.

The TTP server 100 may further include a storage medium (not shown) storing various data for overall operations, such as a program for processing or controlling the processor 110 . The storage medium 150 may store a plurality of application programs (or applications) driven in the TTP server 100 , data for the operation of the TTP server 100 , and commands. At least some of these application programs may be downloaded from an external server through wireless communication. Also, at least some of these application programs may exist on the TTP server 100 from the time of shipment for the basic function of the TTP server 100 . The application program is stored in the storage medium, and may be driven by the processor 110 to perform the operation (or function) of the TTP server 100 .

The storage medium 150 may include a login input receiving unit 151 , a security code generating unit 152 , and a security code processing unit 153 .

The login input receiving unit 151 receives login input data from the user terminal 201 . Although the user terminal is indicated by 201, the user terminals 202 and 203 may be substituted. The login input receiving unit 151 may receive login input data input from the user terminal 201 from the other service server 400 .

The login input receiving unit 151 may receive encrypted login input data by encrypting login input data including an ID and password.

The login input receiving unit 151 may receive login input data including an ID and password and a time value associated with a time point at which the login input data is input to the user terminal. The login input data may further include a connection link connected to the user terminal 201 in addition to the input ID and password. When receiving login input data from another service server 400 , the TTP server 100 may transmit data to the user terminal 201 through a link to the user terminal 201 .

The security code generator 152 may generate a security code corresponding to the login input data. The security code generator 152 may generate a security code in consideration of a time point when login input data is input. The security code generator 152 may generate a security code by applying a security code generation rule to the ID or password of the login input data.

The security code generation unit 152 may generate a security code including one or more input units included in the ID of the login input data by converting it into a security code generation rule.

The security code generation unit 152 may output a security code generation rule through the output unit of the user terminal prior to generation of the security code.

The security code may further include a time conversion code converted based on a time value corresponding to an input time point at which a login input is input.

The security code may be regenerated at regular intervals. For example, with respect to the login input of the first ID during the first time period, the login input may be authenticated with the first security code. When the first time period expires and the second time period begins, a new second security code may be generated for the login input of the first ID to authenticate the login input.

The security code generator 152 may generate a security code using the user code received from the user terminal 201 . A security code may be generated based on the ID of the login input data and a time value corresponding to the input time, and the final security code may be generated by further including the user code received from the user terminal 201 in the security code.

In another embodiment, the security code generator 152 may transmit the generated security code to a medium associated with the user. For example, the transmission may be performed to the user's email address, the user's electronic device, and the user terminal 201 .

In another embodiment, the security code received from the security code generation unit 152 is the user terminal 201 receives the security code from the security code generation unit 152, and receives the security code from the security code processing unit 153. It can be set to be automatically included in the response signal of the request. For example, there is an area for storing a security code in the memory of the user terminal 201 , and when a request for a security code is received from the user terminal 201 , the commands of the user terminal 201 are stored in the area where the security code is stored. By loading the stored value, the value can be included in the response signal of the request of the security code. In this case, the commands of the user terminal 201 load the first value stored in the first area, which is the area where the security code is stored, and transform the first value stored in the first area in consideration of the current time value of the current time. A value can be generated as a security code and included in the response signal of the request of the security code.

The area in which the security code is stored may be an address area designated by the TTP server, but is not limited thereto and may be an area determined by the system (operating system) of the user terminal 201 . In this way, the trouble of having to enter a security code required for logging in can be saved.

The security code processing unit 153 may transmit output data requesting a security code in addition to the login input data to the user terminal 201 . The security code processing unit 153 may determine whether the generated security code matches the security code input from the user terminal 201 . When the generated security code matches the security code received from the user terminal 201 , the security code processing unit 153 may generate authentication information for a login input.

In another embodiment, the security code processing unit 153 may generate authentication information for the login input by comparing the first security code received from the user terminal 201 with the previously generated second security code. Also, the security code processing unit 153 may generate a third security code in which the previously generated second security code is modified by applying the time value of the current time. The security code processing unit 153 may generate authentication information for a login input by comparing the first security code and the third security code received from the user terminal 201 .

The security code processing unit 153 may process success (Y) or failure (N) for the login input through authentication information for the login input.

The security code processing unit 153 may transmit the security code generated in various ways to at least one of the user terminal 201 , the database 300 , and another service server 400 .

4 to 6 are flowcharts of a user authentication method using a security code according to embodiments of the present invention.

In S110, the user terminal 201 may receive a login input including an ID and a password. The user terminal 201 may transmit login input data to the TTP server 100 .

In S120, the TTP server 100 may generate a first security code corresponding to the login input in response to the login input data.

The TTP server 100 may generate a first security code corresponding to the login input data. In another embodiment, the TTP server 100 may re-generate the second security code in consideration of the time when the login input data is input, the first security code corresponding to the login input data.

In another embodiment, the first security code may be generated by applying a security code generation rule to an ID or password of the login input data.

In another embodiment, the TTP server 100 may generate a first security code including one or more input units included in the ID of the login input data by converting it into a security code generation rule.

The security code may further include a time conversion code, which is a code converted based on a time value corresponding to an input time point at which a login input is input.

In another embodiment, the security code may be regenerated at regular intervals. For example, with respect to the login input of the first ID during the first time period, the login input may be authenticated with the first security code. When the first time period expires and the second time period begins, a new second security code may be generated for the login input of the first ID to authenticate the login input.

The TTP server 100 may generate a security code using the user code received from the user terminal 201 . A security code may be generated based on the ID of the login input data and a time value corresponding to the input time, and the final security code may be generated by further including the user code received from the user terminal 201 in the security code.

In S125 , the TTP server 100 may transmit a request signal for requesting a security code to the user terminal 201 .

In S130, the user terminal 201 may receive the second security code from the user. The TTP server 100 may receive the second security code, and determine whether the generated first security code and the second security code are identical (S135 and S140). When it is determined that the first security code and the second security code are the same, the TTP server 100 processes the login input as a success (Y), and when it is determined that the first security code and the second security code are not the same , the login input can be treated as a failure (N).

As shown in FIG. 5 , in S210 , the user terminal 201 may receive a login input including an ID and a password.

In S215 , the TTP server 100 may receive a login input including an ID and a password from the user terminal 201 .

In S220 , the TTP server 100 may transmit a security code generation rule to the user terminal 201 . The TTP server 100 may generate a security code using the user code received from the user terminal 201 . A security code may be generated based on the ID of the login input data and a time value corresponding to the input time, and the final security code may be generated by further including the user code received from the user terminal 201 in the security code.

In S225, the TTP server 100 may generate a third security code corresponding to the login input.

In S230 , the TTP server 100 may transmit a request signal for requesting a security code to the user terminal 201 .

In S235, the user terminal 201 may receive a user input for inputting a fourth security code. The instructions of the user terminal 201 may execute an operation of automatically generating the fourth security code. A fourth security code may be generated based on the value recorded in the memory of the user terminal 201 . The fourth security code may include a value recorded in the memory of the user terminal 201 or a value modified from the value recorded in the memory of the user terminal 201 .

The value recorded in connection with the generation of the security code may be a value received from a TTP server or a value related to user-related information.

In S240 , the user terminal 201 may transmit the fourth security code to the TTP server 100 .

As shown in FIG. 6 , the TTP server 100 may operate in conjunction with another service server 400 .

In S310, the user terminal 201 executes a login process in order to use the service provided by the other service server 400. The user terminal 201 may receive login input data including an ID and password during a login process. The other service server 400 refers to a server that provides a service that requires a user's login. For example, the other service server 400 may be a server that provides educational institutions such as schools, daycare centers, and private institutes, public institutions such as public health centers and ward offices, cafe services, SNS services, blog services, and the like.

In S315 , the user terminal 201 may transmit login input data to another service server 400 .

In S320 , the other service server 400 may transmit a login input and metadata to the TTP server 100 . In addition to the ID and password input to the user, the other service server 400 may generate, as metadata, an input time point at which the login input data is input, and a link to the user terminal 201 where the login input data is input. The other service server 400 may transmit login input data, metadata, and security code generation rules to the TTP server 100 .

In S325, the TTP server 100 may generate a fifth security code corresponding to the login input. The TTP server 100 may generate a fifth security code corresponding to the login input data and the metadata.

In S330 , the TTP server 100 may transmit a request signal for requesting a security code to the user terminal 201 .

In S335, the user terminal 201 may input the sixth security code in response to the request signal, and transmit the sixth security code to the TTP server 100 (S340).

In S345, the TTP server 100 determines whether the generated fifth security code and the input sixth security code are identical, and when it is determined that the fifth security code and the sixth security code are the same, authentication for the login input information can be generated.

The device described above may be implemented as a hardware component, a software component, and/or a combination of the hardware component and the software component. For example, devices and components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA). , a programmable logic unit (PLU), microprocessor, or any other device capable of executing and responding to instructions, may be implemented using one or more general purpose or special purpose computers. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For convenience of understanding, although one processing device is sometimes described as being used, one of ordinary skill in the art will recognize that the processing device includes a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that may include For example, the processing device may include a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as parallel processors.

The software may comprise a computer program, code, instructions, or a combination of one or more thereof, which configures a processing device to operate as desired or is independently or collectively processed You can command the device. The software and/or data may be any kind of machine, component, physical device, virtual equipment, computer storage medium or device, to be interpreted by or to provide instructions or data to the processing device. , or may be permanently or temporarily embody in a transmitted signal wave. The software may be distributed over networked computer systems and stored or executed in a distributed manner. Software and data may be stored in one or more computer-readable recording media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the embodiment, or may be known and available to those skilled in the art of computer software. Examples of the computer-readable recording medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic such as floppy disks. - includes magneto-optical media, and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

As described above, although the embodiments have been described with reference to the limited embodiments and drawings, various modifications and variations are possible by those skilled in the art from the above description. For example, the described techniques are performed in a different order than the described method, and/or the described components of the system, structure, apparatus, circuit, etc. are combined or combined in a different form than the described method, or other components Or substituted or substituted by equivalents may achieve an appropriate result.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (7)

The step of receiving, by another service server, login input data including an ID and a password corresponding to the ID from the user terminal, and transmitting the login input, metadata, and security code generation rules to the TTP server in response to the login input data - the meta The data includes an input time point at which the log-in input data is input, and a link to a user terminal where the log-in input data is input,
The TTP server receives the login input, metadata, and security code code generation rule from the other service server, and generates a first security code corresponding to the login input by using the received security code generation rule, and receiving a second security code from the user terminal by requesting a security code from the user terminal without going through the other service server by using a connection link to the user terminal;
The TTP server determines whether the first security code and the second security code match, processes the login input data in consideration of the match, and generates authentication information for the login input data to generate authentication information for the login input data. transmitting to a service server and transmitting data to the user terminal through a connection link to the user terminal; and
Including, by the other service server, processing the login input data of the user terminal as success or failure in response to the authentication information for the login input data,
The first or second security code is a code of a combination of input units included in an ID and password included in the login input data, and a type value (time stamp) of the time input in the code is converted into the security code generation rule. In the form, the user authentication method using a security code that is newly generated every predetermined time period. delete delete delete delete A computer program stored in a computer-readable storage medium for executing the method of claim 1 using a computer.
delete

Images