KR102435307B1 - Account management method and device using authentication by vaccine program - Google Patents

Abstract

Disclosed are a method and an apparatus for account management using vaccine program-based authentication. In accordance with one aspect of the present invention, the method for account management using vaccine program-based authentication, which is performed by a server apparatus, includes the following steps of: receiving login information from a task system; generating temporary authentication information corresponding to the login information to transmit the information to the task system; receiving first authentication information in accordance with the temporary authentication information and second authentication information based on a vaccine program, from a user terminal in which the vaccine program pre-registered with an account in accordance with the login information is installed; and providing an authentication processing result to the task system by using the first and second authentication information. Therefore, the present invention is capable of providing convenience by eliminating the need for secondary authentication.

Description

Account management method and device using authentication by vaccine program {Account management method and device using authentication by vaccine program}

The present invention relates to an account management method and apparatus using authentication by a vaccine program.

Organizations, including corporations, use business systems that are accessed and used by multiple users. To manage access to the business system for security reasons, accounts are issued to permitted users, and access rights are granted after login procedures using IDs/passwords, etc.

Since each account is managed by the server side of these business systems, there are cases in which accounts are hijacked by hacking, etc., and due to such account hijacking, there is a security problem in that abnormal users log in and files are leaked or viruses are introduced. occurs

That is, since the user authentication procedure simply determines whether to authenticate based on account information (ID/password, etc.) associated with the user, there is a problem that abnormal user access is allowed due to a hijacked account.

Recently, as a countermeasure against such account hijacking, secondary authentication using e-mail or phone number is sometimes used. In general, access to the work system is not only inconvenient, but there is also a sense of rejection of the access itself.

Republic of Korea Patent Publication No. 10-2013-0123329 Two-factor authentication login system and method

Accordingly, the present invention has been devised to solve the above problems, and to provide an account management method and apparatus using authentication by a vaccine program for authenticating a user using a vaccine program installed in a normal user terminal.

Other objects of the present invention will become clearer through preferred embodiments described below.

According to an aspect of the present invention, there is provided an account management method performed in a server device, the method comprising: receiving login information from a business system; generating temporary authentication information corresponding to the login information and transmitting it to the business system; receiving first authentication information according to the temporary authentication information and second authentication information by the vaccine program from a user terminal in which a vaccine program registered in advance with an account according to the login information is installed; and providing a result of authentication processing using the first authentication information and the second authentication information to the business system.

Here, it is possible to receive the status information from the vaccine program, to analyze the status information to determine the additional operation, and to process the authentication success only when it is confirmed that the additional operation is in progress in the user terminal.

In addition, upon successful authentication, receiving monitoring information from the vaccine program and the business system periodically or from time to time and comparing them with each other; and when it is determined that the account is stolen according to the comparison result, the step of guiding the business system may be further included.

In addition, it is possible to receive the status information from the vaccine program and to analyze the status information to determine the reception time of the monitoring information.

In addition, it receives and manages information related to performing virus inspection from each of the vaccine programs registered in advance, and receives virus inspection information by the vaccine program as third authentication information together with the second authentication information from the user terminal. Therefore, it can be used during the authentication process.

In addition, as the virus scan information, at least one of the scan date and time for the last virus scan and the number of scan files may be used.

In addition, in the account management method performed in a computing device installed with a vaccine program, the method comprising: transmitting login information according to a user input to a connected business system; obtaining, by an authentication server, temporary authentication information generated to correspond to the log-in information received from the work system through the work system; and the first authentication information corresponding to the temporary authentication information and the second by the installed vaccine program so that the authentication server uses the authentication process for the account corresponding to the login information to provide the authentication result to the business system. There is provided an account management method using authentication by a vaccine program, comprising the step of transmitting authentication information to the authentication server.

Here, it is possible to check the security item status information and transmit the authentication information to the authentication server only when an additional operation corresponding to the security item status information is performed.

In addition, when authentication for the account is successful, periodically or from time to time monitoring information according to the use of the business system is generated and transmitted to the authentication server, whereby the authentication server compares the authentication information with the monitoring information received from the business system to take over the account. can be judged whether or not

In addition, whenever the vaccine program performs a virus check, related information may be transmitted to the authentication server, and virus check information on which the virus check has been performed may be transmitted to the authentication server as third authentication information.

According to another aspect of the present invention, as a computer program stored in a computer-readable medium for performing an account management method using authentication by a vaccine program, the computer program causes the computer to perform the following steps, The steps of receiving login information from the business system; generating temporary authentication information corresponding to the login information and transmitting it to the business system; receiving first authentication information according to the temporary authentication information and second authentication information by the vaccine program from a user terminal in which a vaccine program registered in advance with an account according to the login information is installed; and providing a result of authentication processing using the first authentication information and the second authentication information to the business system, a computer program stored in a computer-readable medium is provided.

And, as a computer program stored in a computer-readable medium for performing an account management method using authentication by a vaccine program, the computer program causes the computer to perform the following steps, wherein the steps are transmitting login information to the connected business system; receiving, by the business system, the first authentication information according to the temporary authentication information from the authentication server, which has generated temporary authentication information corresponding to the log-in information by transmitting the log-in information to an authentication server; and the authentication server authenticates the first authentication information together with the second authentication information by the installed vaccine program so that the authentication server uses the authentication process for the account corresponding to the login information to provide an authentication result to the business system. A computer program stored in a computer-readable medium is provided, comprising the step of transmitting to a server.

Other aspects, features and advantages other than those described above will become apparent from the following drawings, claims, and detailed description of the invention.

According to the present invention, in the business system, in addition to the user authentication process using only the login information for the managed account, the security can be strengthened by performing secondary authentication by the authentication server and a specific vaccine program installed in the user terminal, and the user can perform secondary authentication. Convenience can be provided because there is no need to perform the .

1 is a block diagram schematically showing an entire system for account management using a vaccine program according to an embodiment of the present invention.
2 and 3 are flowcharts illustrating an account management process using a vaccine program respectively performed in an authentication server and a user terminal according to an embodiment of the present invention.
4 is an exemplary diagram illustrating an account management method using a vaccine program in the entire system according to an embodiment of the present invention.
5 is a flowchart illustrating an account management process using monitoring in a login state performed in an authentication server according to an embodiment of the present invention.
6 is a flowchart illustrating an account management process using a virus scan history of a vaccine program as authentication information according to an embodiment of the present invention.

Since the present invention can have various changes and can have various embodiments, specific embodiments are illustrated in the drawings and described in detail in the detailed description. However, this is not intended to limit the present invention to a specific embodiment, it should be understood to include all modifications, equivalents and substitutes included in the spirit and scope of the present invention.

When a component is referred to as being “connected” or “connected” to another component, it may be directly connected or connected to the other component, but it is understood that other components may exist in between. it should be On the other hand, when it is said that a certain element is "directly connected" or "directly connected" to another element, it should be understood that the other element does not exist in the middle.

Terms such as first, second, etc. may be used to describe various elements, but the elements should not be limited by the terms. The above terms are used only for the purpose of distinguishing one component from another. For example, terms such as a first threshold value and a second threshold value to be described later may be pre-specified as threshold values that are substantially different or partially identical to each other, but when expressed with the same word threshold value, there is confusion. Since there is room, the terms 1st and 2nd will be used together for convenience of classification.

The terms used herein are used only to describe specific embodiments, and are not intended to limit the present invention. The singular expression includes the plural expression unless the context clearly dictates otherwise. In the present specification, terms such as “comprise” or “have” are intended to designate that a feature, number, step, operation, component, part, or combination thereof described in the specification exists, but one or more other features It is to be understood that it does not preclude the possibility of the presence or addition of numbers, steps, operations, components, parts, or combinations thereof.

In addition, the components of the embodiment described with reference to each drawing are not limitedly applied only to the embodiment, and may be implemented to be included in other embodiments within the scope of maintaining the technical spirit of the present invention, and also Even if the description is omitted, it is natural that a plurality of embodiments may be re-implemented as a single integrated embodiment.

In addition, in the description with reference to the accompanying drawings, the same components regardless of the reference numerals are given the same or related reference numerals, and the overlapping description thereof will be omitted. In describing the present invention, if it is determined that a detailed description of a related known technology may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted.

1 is a configuration diagram schematically illustrating an entire system for account management using a vaccine program according to an embodiment of the present invention.

Referring to FIG. 1 , the entire system according to the present embodiment includes a user terminal 10 installed with a vaccine program, a business system 30 , and an authentication server 50 .

The business system 30 is a system that authorized users access and use, and may be, for example, an accounting system, a human resources management system, a database, a business tool operated in-house, and may be in the form of a web or an application. is implemented Since the business system 30 will be apparent to those skilled in the art, a more detailed description thereof will be omitted.

This business system 30 performs authentication of a user account with respect to the user terminal 10 that accesses so that only users with permission are allowed to use it. Typically, each user authentication for the managed account is performed using login information such as ID/password, but in this embodiment, additional authentication is performed using the authentication server 50 .

The authentication server 50 performs authentication using a vaccine program installed in the user terminal 10. For this purpose, each user who has an account installs a predetermined vaccine program in a user terminal such as his/her PC, laptop, or tablet.

Hereinafter, the account management process using the vaccine program in the authentication server 50 and the user terminal 10 will be described in detail.

2 and 3 are flowcharts illustrating an account management process using a vaccine program respectively performed in the authentication server 50 and the user terminal 10 according to an embodiment of the present invention, and FIG. 4 is an embodiment of the present invention. It is an exemplary diagram illustrating an account management method using a vaccine program in the entire system according to an example.

First, referring to FIGS. 2 and 4 illustrating a process in the authentication server 50 , the authentication server 50 receives login information from the business system 30 ( S210 ). That is, when the user connects to the business system 30 using the user terminal 10 and inputs login information such as ID/password, the business system 30 includes the login information input to the authentication server 50 . Provides user terminal information (eg, connected IP information, etc.) and requests authentication.

The authentication server 50 generates temporary authentication information corresponding to the received login information and transmits it to the business system 30 (S220). As shown in FIG. 4 according to an example, the authentication server 50 generates a temporary QR code that matches login information and access IP information as temporary authentication information and provides it to the business system 30 .

Then, the business system 30 provides the received temporary authentication information to the user terminal 10. As shown in FIG. 4 according to an example, the QR code is opened to the user terminal 10, and the vaccine program of the user terminal 10 is By reading the corresponding QR code information, login information and access IP information are acquired according to the temporary authentication information.

That is, referring to FIG. 3 illustrating a processing process performed in the user terminal 10, log-in information according to a user input is transmitted to the business system 30 (S310), and then generated by the authentication server 50 Temporary authentication information corresponding to the login information is acquired through the business system 30 (S320).

Then, the user terminal 10 transmits the first authentication information (eg, login information and access IP information, etc.) corresponding to the temporary authentication information and the second authentication information (device IP information, program serial number, etc.) by the vaccine program to the authentication server. It is transmitted to (50) (S330).

Referring back to FIG. 2 , when the authentication server 50 receives the first authentication information and the second authentication information as described above from the user terminal 10 ( S230 ), the authentication server 50 uses the two authentication information to access the corresponding account. A user authentication process is performed (S240). In other words, the authentication server 50 receives the first authentication information according to the temporary authentication information and the second authentication information according to the vaccine program from the user terminal 10 in which the vaccine program registered in advance with the account according to the login information is installed. it will be processed

Then, the authentication server 50 provides the authentication processing result to the business system 30 (S250), so that the business system 30 completes the login procedure.

According to the above-described embodiment, the business system 30 performs secondary authentication by a specific vaccine program installed in the authentication server 50 and the user terminal 10 in addition to the user authentication process using only login information for the managed account. In this way, security can be strengthened, and from the user's point of view, there is no need to directly perform secondary authentication, so that convenience can be provided.

Here, although not shown in the drawings, according to an example, the vaccine program of the user terminal 10 checks the security item status information, and provides authentication information to the authentication server 50 only when an additional operation corresponding to the security item status information is performed. can be sent to

As a security item, whether the vaccine is in real-time protection state, whether the vaccine is the latest updated version, whether the operating system such as Windows is the latest updated version, whether the firewall is in operation, whether the screen saver and password are set, and login attempts Whether the web browser (Chrome, etc.) is the latest updated version may be used.

That is, the vaccine program of the user terminal 10 checks the status of the security item of the user terminal 10, selects it as an additional operation when a change in a specific security item is necessary to enhance security, and guides the user to perform additional operation After this is performed, the authentication information is transmitted to the authentication server 50 .

According to an example, the determination of such an additional operation may be performed by the authentication server 50 . That is, the authentication server 50 receives the status information on the security item from the vaccine program, analyzes the status information to determine the additional operation, and only when it is confirmed that the additional operation is in progress in the user terminal 10 , the authentication is successful. to be validated for

A security risk may occur even when the user account is authenticated normally and the login is processed. For example, in a state in which a session cookie value is formed between the user and the business system 30, the session cookie may be hijacked by a hacker, and thereby the hacker computer uses the stolen session cookie to the business system ( 30), you can freely use it while logged into the account.

To prevent this, a monitoring process in a logged-in state may be required.

5 is a flowchart illustrating an account management process using monitoring in a login state performed by the authentication server 50 according to an embodiment of the present invention.

Referring to FIG. 5 , when the authentication process for the user is successful ( S510 ), the authentication server 50 receives and compares monitoring information from the vaccine program installed in the corresponding user terminal 10 and the business system 30 ( S510 ). S520).

That is, the vaccine program provides the usage history of the business system 30 in the user terminal 10 as monitoring information, and the business system 30 uses the usage history of the user terminal 10 as monitoring information as the monitoring information. to periodically (for example, every 30 seconds) or from time to time (for example, when an event such as page viewing or file transfer occurs).

The authentication server 50 determines whether the work in the user terminal 10 and the work system 30 is the same as a result of the comparison of the two monitoring information (S530).

If they are the same, it is confirmed that the business system 30 is used by the normally authorized user (S540),

Otherwise, if they are not identical to each other, it is determined that the account has been hijacked (S550). For example, when the user terminal 10 accessed page A based on the same time point, but monitoring information such as access to page B is acquired in the business system 30, or the user terminal 10 uploads file C However, if different events occur in the business system 30, such as when the E file is uploaded, it may be determined that the account is taken over.

As in this embodiment, security can be further strengthened by monitoring account takeover that occurs even after normal user authentication is performed.

And, according to an example, it is possible to determine the reception time of the monitoring information by analyzing the security item status information received from the vaccine program as described above. For example, when the status of the security item is the best, the receiving cycle of monitoring information is lengthened and the number of monitoring information items is increased. will be.

6 is a flowchart illustrating an account management process using a virus scan history of a vaccine program as authentication information according to an embodiment of the present invention.

Referring to FIG. 6 , the authentication server 50 receives and manages information related to the virus scan from each pre-registered vaccine program (information about scan history such as scan date and time, number of scan target files, virus diagnosis history, etc.) do (S610).

Then, the information on the virus scan history described above is used in the user authentication procedure.

That is, when the virus scan information is received from the user terminal 10 as the third authentication information (S620), it is compared with the virus scan history executed by the pre-stored vaccine program of the user terminal 10 to determine the identity (S630). ). For example, the user terminal 10 may utilize information about the scan date and/or the number of scan target files for the last virus scan as virus scan information.

According to the determination result, authentication success processing (S640) or authentication failure processing (S650).

The above-described account management method using the vaccine program according to the present invention may be implemented as a computer-readable code on a computer-readable recording medium. The computer-readable recording medium includes any type of recording medium in which data that can be read by a computer system is stored. For example, there may be a read only memory (ROM), a random access memory (RAM), a magnetic tape, a magnetic disk, a flash memory, an optical data storage device, and the like. In addition, the computer-readable recording medium may be distributed in computer systems connected through a computer communication network, and stored and executed as readable codes in a distributed manner.

In addition, although the above has been described with reference to the preferred embodiment of the present invention, those of ordinary skill in the art can use the present invention within the scope not departing from the spirit and scope of the present invention described in the claims below. It will be understood that various modifications and variations are possible.

10: user terminal
30: business system
50: authentication server

Claims (9)

In the account management method performed on the server device,
Receiving login information from the business system;
generating temporary authentication information corresponding to the login information and transmitting it to the business system;
receiving first authentication information according to the temporary authentication information and second authentication information by the vaccine program from a user terminal in which a vaccine program registered in advance with an account according to the login information is installed; and
and providing a result of authentication processing using the first authentication information and the second authentication information to the business system,
Receives and manages information related to virus inspection from each of the vaccine programs registered in advance, and receives virus inspection information by the vaccine program together with the second authentication information from the user terminal as third authentication information. An account management method using authentication by a vaccine program, used for authentication processing.
The method according to claim 1,
upon successful authentication, periodically or frequently receiving monitoring information from the vaccine program and the business system, respectively, and comparing them with each other; and
Account management method using authentication by a vaccine program, further comprising the step of guiding to the business system when it is determined that the account is stolen according to the comparison result.
3. The method according to claim 2,
An account management method using authentication by a vaccine program to receive status information from the vaccine program, and to analyze the status information to determine a reception time of the monitoring information.
delete The method according to claim 1,
An account management method using authentication by a vaccine program, wherein at least one of a scan date and a number of scan files for the last virus scan is used as the virus scan information.
In the account management method performed on a computing device installed with a vaccine program,
transmitting login information according to a user input to the connected business system;
obtaining, by an authentication server, temporary authentication information generated to correspond to the login information received from the work system through the work system; and
In order for the authentication server to use the authentication process for the account corresponding to the login information to provide an authentication result to the business system, the first authentication information corresponding to the temporary authentication information and the second authentication by the installed vaccine program Transmitting information to the authentication server,
Each time the vaccine program performs a virus check, related information is transmitted to the authentication server, and the virus scan information on which the virus scan has been performed is transmitted to the authentication server as third authentication information. How to manage your account.
delete A computer program stored in a computer-readable medium for performing an account management method using authentication by a vaccine program, the computer program causing a computer to perform the following steps, the steps comprising:
Receiving login information from the business system;
generating temporary authentication information corresponding to the login information and transmitting it to the business system;
receiving first authentication information according to the temporary authentication information and second authentication information by the vaccine program from a user terminal in which a vaccine program registered in advance with an account according to the login information is installed; and
and providing a result of authentication processing using the first authentication information and the second authentication information to the business system,
Receives and manages information related to virus inspection from each of the vaccine programs registered in advance, and receives virus inspection information by the vaccine program together with the second authentication information from the user terminal as third authentication information. A computer program stored in a computer-readable medium used in authentication processing.
A computer program stored in a computer-readable medium for performing an account management method using authentication by a vaccine program, the computer program causing a computer to perform the following steps, the steps comprising:
transmitting login information according to a user input to the connected business system;
receiving, by the business system, the first authentication information according to the temporary authentication information from the authentication server that has generated temporary authentication information corresponding to the log-in information by transmitting the log-in information to an authentication server; and
In order for the authentication server to use the authentication process for the account corresponding to the login information to provide an authentication result to the business system, the first authentication information together with the second authentication information by the installed vaccine program is transmitted to the authentication server including the step of sending to
stored in a computer-readable medium, which transmits related information to the authentication server whenever the vaccine program performs a virus inspection, and transmits virus inspection information on which the virus inspection has been performed to the authentication server as third authentication information computer program.

Images