KR102545287B1 - Method and system for providing platform for unification of means of authentication or electronic signature - Google Patents

Abstract

Provided is a method and system capable of providing an integrated authentication means/electronic signature platform that can integrate and provide various authentication means/electronic signature solutions from multiple vendors. According to one aspect of the present invention, as a system for providing an integrated platform for authentication means, a receiving module for receiving unified authentication information necessary for authentication by a predetermined authentication means from a user terminal requesting identity authentication for a predetermined online service. ; An implementation storage module for storing authentication method implementations corresponding to each of a plurality of vendors providing the identity authentication solution by the authentication means - authentication method implementations corresponding to each of the plurality of vendors is a pre-implemented code using an API (Application Programming Interface) provided by a corresponding vendor; a vendor specific module for specifying an authentication performing vendor corresponding to the online service from among the plurality of vendors that provide the identity authentication solution by the authentication means; and a calling module for calling an authentication method implementation corresponding to the authentication vendor for authentication through the authentication solution provided by the authentication vendor. is provided.

Description

Method and system for providing platform for providing authentication means/electronic signature integrated platform

The present invention relates to a method and system for providing an authentication means/digital signature integrated platform. More specifically, it relates to a method and system capable of providing an integrated authentication means/electronic signature platform capable of integrating and providing various authentication means and providing an integrated authentication/electronic signature solution of multiple vendors.

BACKGROUND ART In recent years, as wired and wireless communication networks have been developed and computers and the Internet have been spread to each household, various online services such as online commerce or Internet banking have been provided. Due to the nature of these services, it is very important to verify that the user is a user with legitimate authority to use the service.

In the past, an authentication means for self-authentication to properly use each online service is installed and operated directly in a system providing the service. That is, the authentication data for self-authentication by a predetermined authentication method is received from the user terminal, or the authentication process through the interface provided by the vendor providing the authentication solution by the authentication method is directly performed on the online service providing system side. (electronic signature is also the same). As a result, when trying to replace a vendor that provides an authentication/electronic signature solution, it was inevitable to modify the system on a large scale, which made it very difficult to replace the vendor or introduce a new authentication/electronic signature method.

Patent Publication 10-2012-0135838 Patent Publication 10-2019-0027486

The technical problem to be achieved by the present invention is to entrust a system providing online services with an authentication means/electronic signature integrated platform providing system according to the technical concept of the present invention to process identity authentication or digital signature and to receive the result. is to do

In addition, the technical problem to be achieved by the present invention is that there are a number of vendors that provide identity authentication or electronic signature solutions by one authentication means, and if the implementation method or interface provided to the outside of each vendor's identity authentication solution is different, It is to provide a technical idea to convert or integrate into a unified form.

.

According to one aspect of the present invention, as a system for providing an integrated platform for authentication means, a receiving module for receiving unified authentication information necessary for authentication by a predetermined authentication means from a user terminal requesting identity authentication for a predetermined online service. ; An implementation storage module for storing authentication method implementations corresponding to each of a plurality of vendors providing the identity authentication solution by the authentication means - authentication method implementations corresponding to each of the plurality of vendors is a pre-implemented code using an API (Application Programming Interface) provided by a corresponding vendor; a vendor specific module for specifying an authentication performing vendor corresponding to the online service from among the plurality of vendors that provide the identity authentication solution by the authentication means; and a calling module for calling an authentication method implementation corresponding to the authentication vendor for authentication through the authentication solution provided by the authentication vendor. is provided.

In one embodiment, further comprising a UI providing module for providing a unified user interface (UI) for self-authentication by the authentication means to the user terminal, wherein the receiving module includes the unified user interface output from the user terminal. The unified authentication information input through the UI may be received.

In one embodiment, the user terminal may call a unified API provided by the authentication means integrated platform providing system to transmit unified authentication information required for self-authentication by the authentication means.

In one embodiment, an authentication means specifying module for specifying any one of the plurality of usable authentication means as the authentication means may be further included.

In one embodiment, the plurality of usable authentication means is ID-password based authentication, pattern authentication, personal identification number (Personal Identification Number) based authentication, PKI (Public Key Infrastructure) based authentication, OTP (One Time Password) based authentication At least some of authentication, e-mail-based authentication, fingerprint authentication, iris authentication, face authentication, voiceprint authentication, biometric information-based authentication, and open authorization-based authentication may be included.

According to another aspect of the present invention, as a method for providing an integrated platform for authentication means, the system for providing an integrated platform for authentication means requires, from a user terminal requesting self-authentication for a predetermined online service, authentication by a predetermined authentication means. A receiving step of receiving unified authentication information; An implementation storage step of storing an authentication method implementation corresponding to each of a plurality of vendors providing a self-authentication solution by the authentication means in the authentication means integrated platform providing system - each of the plurality of vendors. Authentication method implementation corresponding to is pre-implemented code using an API (Application Programming Interface) provided by a corresponding vendor; a specific step of specifying, by the authentication means integration platform providing system, an authentication performing vendor corresponding to the online service from among the plurality of vendors that provide a self-authentication solution by the authentication means; and an authentication step in which the authentication method integrated platform providing system calls an authentication method implementation corresponding to the authentication vendor to authenticate the user through the authentication solution provided by the authentication vendor. There is provided a method for providing an authentication means integration platform including a.

In one embodiment, the authentication means integration platform providing system further comprises a UI providing step of providing a unified UI (User Interface) for self-authentication by the authentication means to the user terminal, wherein the receiving step, and receiving the unified authentication information input through the unified UI output from the user terminal.

In one embodiment, the user terminal may call a unified API provided by the authentication means integrated platform providing system to transmit unified authentication information required for self-authentication by the authentication means.

In one embodiment, the authentication means integrated platform providing system may further include an authentication means specifying step of specifying any one of the plurality of usable authentication means as the authentication means.

According to another aspect of the present invention, the user terminal, requesting a user authentication to the online service providing system that provides a predetermined online service; requesting, by the online providing service system, a token generation corresponding to the authentication method to the authentication means integrated platform providing system; generating a token corresponding to the identity authentication in response to the token generation request, by the authentication means integrated platform providing system; providing, by the authentication means integrated platform providing system, a token corresponding to the generated identity authentication to the online service providing system; transmitting, by the online service providing system, a token corresponding to the identity authentication to the user terminal; Requesting, by the user terminal, to provide an authentication UI (User Interface) for the authentication means integration platform providing system for the authentication means - Here, the request for providing the authentication UI includes a token corresponding to the authentication; providing, by the authentication means integrated platform providing system, an authentication UI for authentication to the user terminal in response to the authentication UI provision request; Step, by the user terminal, inputting the authentication information required for the authentication through the authentication UI and transmitting to the authentication means integrated platform providing system; the authentication means integration platform providing system transmits the authentication information required for the authentication to an authentication system of a predetermined vendor that provides an identity authentication solution, requests validation, and receives a validation result from the authentication system; generating an authentication token corresponding to the verification result by the authentication means integrated platform providing system; providing the authentication token to the user terminal by the authentication means integration platform providing system; transmitting, by the user terminal, the authentication token to the online service providing system; requesting, by the online service providing system, verification of the authentication token from the authentication means integrated platform providing system; providing a verification result corresponding to the verification token to the online service providing system in response to the verification request of the verification token, by the system for providing the integrated platform for verification means; and determining, by the online service providing system, whether or not the authentication is successful based on the verification result.

According to another aspect of the present invention, a computer program installed in a data processing device and recorded on a computer readable medium for performing the above method is provided.

According to another aspect of the present invention, a system for providing an authentication means integration platform, comprising: a processor; And a memory for storing a computer program, wherein the computer program, when executed by the processor, causes the authentication means integration platform providing system to perform the method described above. Provided is an authentication means integration platform providing system.

Conventionally, an online service providing system that provides online services processes identity authentication/electronic signature requests, but according to an embodiment of the present invention, a system that provides online services is an authentication means/electronic signature With the integrated signature platform providing system, you can delegate the process of self-authentication/electronic signature and receive the result.

In addition, the authentication means/electronic signature integration platform providing system according to an embodiment of the present invention has a plurality of vendors providing a self-authentication solution or an electronic signature solution by one authentication means, and each vendor's solution implementation method or external If the interface provided by is different, it can be converted into a unified form or a technical idea for integrated processing can be provided.

In order to more fully understand the drawings cited in the detailed description of the present invention, a brief description of each drawing is provided.
1 is a diagram showing an operating environment of a system for providing an authentication means/digital signature integrated platform according to an embodiment of the present invention.
2a and 2b are diagrams illustrating a user authentication process to which a method for providing an integrated platform for authentication means according to an embodiment of the present invention is applied.
3 is a block diagram schematically showing the configuration of a system for providing an authentication means integrated platform according to an embodiment of the present invention.
FIG. 4 is a diagram for explaining a method of converting an authentication/electronic signature method by a unified common API called from a user terminal to conform to an operation method or algorithm of an identity authentication/electronic signature solution actually provided by a vendor.
5 is a diagram illustrating an example of using a virtual environment in a process of calling a solution of an authentication vendor in the system for providing an integrated platform for authentication means according to an embodiment of the present invention.
6a and 6b are diagrams illustrating a user authentication process to which a method for providing an integrated digital signature platform according to an embodiment of the present invention is applied.

Since the present invention can apply various transformations and have various embodiments, specific embodiments will be illustrated in the drawings and described in detail in the detailed description. However, it should be understood that this is not intended to limit the present invention to specific embodiments, and includes all transformations, equivalents, and substitutes included in the spirit and scope of the present invention. In describing the present invention, if it is determined that a detailed description of related known technologies may obscure the gist of the present invention, the detailed description will be omitted.

Terms such as first and second may be used to describe various components, but the components should not be limited by the terms. These terms are only used for the purpose of distinguishing one component from another.

Terms used in this application are only used to describe specific embodiments, and are not intended to limit the present invention. Singular expressions include plural expressions unless the context clearly dictates otherwise.

In this specification, terms such as "include" or "have" are intended to designate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, but one or more other It should be understood that the presence or addition of features, numbers, steps, operations, components, parts, or combinations thereof is not precluded.

In addition, in the present specification, when one component 'transmits' data to another component, the component may directly transmit the data to the other component, or through at least one other component. It means that the data can be transmitted to the other component. Conversely, when one component 'directly transmits' data to another component, it means that the data is transmitted from the component to the other component without going through the other component.

Hereinafter, the present invention will be described in detail with reference to the accompanying drawings, focusing on embodiments of the present invention. Like reference numerals in each figure indicate like elements.

1 is a diagram showing an operating environment of a system 100 for providing an authentication means/digital signature integration platform according to an embodiment of the present invention.

The authentication means/digital signature integration platform providing system 100 may include hardware resources and/or software required to implement the technical concept of the present invention, and necessarily means one physical component or one physical component. does not mean the device of That is, the system 100 for providing the authentication means/digital signature integration platform may mean a logical combination of hardware and/or software provided to implement the technical idea of the present invention, and if necessary, in devices spaced apart from each other. It may be implemented as a set of logical components for implementing the technical idea of the present invention by being installed and performing each function. In addition, the authentication means/digital signature integration platform providing system 100 may refer to a set of components implemented separately for each function or role to implement the technical concept of the present invention.

Referring to FIG. 1 , the authentication means/digital signature integrated platform providing system 100 may perform a method for providing an authentication means/digital signature integrated platform according to the technical idea of the present invention.

A method for providing an authentication means/digital signature integrated platform according to the technical idea of the present invention is a variety of authentication means (eg, ID-password based authentication, pattern authentication) provided by a plurality of vendors used by a customer company (ie, an online service provider). , Personal Identification Number-based authentication, PKI (Public Key Infrastructure) based authentication, OTP (One Time Password) based authentication, e-mail based authentication, fingerprint authentication, iris authentication, face authentication, voiceprint authentication, biometric information based authentication, open standard (Open Authorization based authentication, etc.) in a unified form for each same authentication method on one platform, or a method for integrating digital signature solutions provided by multiple vendors within one platform am.

The authentication means/digital signature integrated platform providing system 100 may be an information processing device having a network communication function. The authentication means/digital signature integrated platform providing system 100 may be a processing system such as a desktop computer, a laptop computer, or a server.

The authentication means/electronic signature integrated platform providing system 100 can act as an agent for identity authentication/electronic signature, previously performed by a predetermined online service providing system 200. To this end, the authentication means/digital signature integrated platform providing system 100 is connected to the online service providing system 200 through a wired/wireless communication network (eg, the Internet), and various various necessary to implement the technical idea of the present invention. It can transmit and receive data, information, signals, etc.

The online service providing system 200 may be a system that provides a predetermined service to the user terminal 300 through online. (SNS), e-mail, financial services, insurance services, and the like. In order to receive the service of the online service providing system 200, the user terminal 300 needs to perform self-authentication or electronic signature, such as log-in. Personal authentication/electronic signature can be substituted.

Meanwhile, the user terminal 300 may be an information processing device having a network communication function. For example, the user terminal 300 may be a desktop computer or laptop computer, a mobile phone, a satellite phone, a wireless phone, a Session Initiation Protocol (SIP), a Wireless Local Loop (WLL) station, a smart phone, a tablet PC, a PDA ( It may also be a processing device including a handheld device such as a Personal Digital Assistant).

The authentication means/digital signature integration platform providing system 100 is connected to the user terminal 300 through a wired/wireless network to transmit/receive various information, data, signals, etc. required to implement the technical idea of the present invention. For example, the authentication means/electronic signature integrated platform providing system 100 may provide a user interface (UI) for self authentication/electronic signature to the user terminal 300, and the user terminal 300 Information required for personal authentication//electronic signature may be transmitted to the authentication means/electronic signature integrated platform providing system 100.

The user terminal 300 may request identity authentication or digital signature through any one of a plurality of authentication means provided by the authentication means/electronic signature integrated platform providing system 100, and the user authentication or digital signature by the authentication means / Electronic signature can be performed by any one of a plurality of vendors that provide identity authentication / digital signature solutions. That is, the vendor systems 400-1 to 400-N corresponding to each vendor as shown in FIG. 1 may perform identity authentication/digital signature.

Meanwhile, the integrated platform providing system 100 may be connected to a predetermined management console 310 through a wired or wireless network. The management console 310 may be a console used by an administrator of the system, a terminal device, or a computing system. The management console 310 may store various setting information (eg, policy information, discovery access information, etc.) preset by an administrator, and when a daemon in the management console 310 is initially loaded, the setting information may be provided to the integrated platform providing system 100. Meanwhile, a discovery service daemon may be loaded in the management console 310, and the discovery service daemon may communicate with a gateway and share authentication means service information and various address (IP address and port) information of each authentication vendor. The integrated authentication platform providing system 100 may request authentication/electronic signature from an authentication vendor by referring to the communication path provided from the discovery service daemon. Since the main technical means of the methods are similar, hereinafter, the identity authentication performed by the system according to the technical concept of the present invention will be described first, and then the process of performing the digital signature will be explained focusing on the difference from identity authentication. . Hereinafter, the authentication means/digital signature integrated platform providing system may be referred to as an authentication means integrated platform providing system or a digital signature integrated platform providing system according to a role performed.

2a and 2b are diagrams illustrating a user authentication process to which a method for providing an integrated platform for authentication means according to an embodiment of the present invention is applied.

First, referring to FIG. 2A , the user terminal 300 may request personal authentication from the online service providing system 200 that provides online services (S10). In one embodiment, the user terminal 300 may select one of a plurality of authentication means provided by the online service providing system 200 to perform identity authentication by the corresponding authentication means.

The plurality of authentication methods include ID-password based authentication, pattern authentication, personal identification number (Personal Identification Number) based authentication, PKI (Public Key Infrastructure) based authentication, OTP (One Time Password) based authentication, e-mail based authentication, fingerprint It may include authentication, iris authentication, face authentication, voiceprint authentication, biometric information-based authentication, open authorization-based authentication, and the like.

The online service providing system 200 may request token generation corresponding to the authentication means to the authentication means integrated platform providing system 100 (S20). When requesting token generation, the online service providing system 200 may transmit service code of the online service and information about authentication means together.

Then, the authentication means integration platform providing system 100 may generate a token T corresponding to the authentication in response to the token generation request (S30). The token T may be used for identification of identity authentication requested by the user terminal 300 . The token T is the service code of the online service, URL of the authentication UI page, authentication means information, token issuance date, token expiration date, token issuance requester, token server identifier (value for identifying the token issuance server), It may include session identifiers (identifiers for issuing tokens and limiting use groups), token signature information (signature information for verifying the integrity of tokens), and the like.

The authentication means integration platform providing system 100 may provide the generated token T corresponding to the identity authentication to the online service providing system 200 (S40), the online service providing system 200 A token T corresponding to the identity authentication may be transmitted to the user terminal 300 (S50).

Afterwards, the user terminal 300 may request the provision of an authentication UI (User Interface) for the authentication means integration platform providing system 100 for the authentication means (S60). At this time, the authentication UI provision request may include a token (T) corresponding to the identity authentication, and the system 100 for providing the authentication means integrated platform provides the authentication UI by the token (T) included in the request. Personal authentication corresponding to the authentication UI provision request may be identified.

Meanwhile, the authentication means integrated platform providing system 100 may provide an authentication UI for the user authentication to the user terminal 300 in response to the authentication UI provision request (S70). According to the embodiment, the authentication means integrated platform providing system 100 may transmit the token T along with the UI.

Subsequently, referring to FIG. 2B , the user terminal 300 may input authentication information necessary for self-authentication through the authentication UI and transmit the authentication information to the authentication means integrated platform providing system (S80). At this time, the user terminal 300 may transmit a token T corresponding to the authentication.

The authentication means integration platform providing system 100 may specify a vendor corresponding to the service provided by the online service providing system 200 among a plurality of vendors capable of performing the authentication (S90). There may be a plurality of online services to which the method for providing an integrated platform for authentication means according to the technical idea of the present invention is applied, and the system 100 for providing an integrated platform for authentication means is provided for each online service and the vendor responsible for authenticating the identity of the online service. Mapping information may be stored in advance. The authentication means integration platform providing system 100 may specify a vendor corresponding to the online service providing system 200 through the mapping information. Meanwhile, even in the case of the same company/institution, the corresponding company/institution may provide various online services, and in some cases, departments belonging to each online service may be different. In this case, since the authentication solutions preferred by the person in charge of the department may be different, vendors of a plurality of online services provided by the same company/institution may be different from each other. For example, if Bank A provides Internet banking, online loans, and online fund services, Internet banking, online loans, and online funds may use solutions from different vendors, and the authentication means integrated platform providing system (100 ) stores mapping information of vendors corresponding to each of Internet banking, online loan, and online fund of Bank A, and can specify a vendor using this.

On the other hand, the authentication means integration platform providing system 100 may perform personal authentication based on the authentication information received from the user terminal 300 (S100). That is, the authentication means integration platform providing system 100 transmits the authentication information necessary for the authentication to the authentication system 400 of the vendor providing the authentication solution, requests verification, and verifies from the authentication system 400. You can receive results.

Thereafter, the authentication means integration platform providing system 100 may generate an authentication token A corresponding to the verification result, and may provide the authentication token A to the user terminal 300 (S110).

Thereafter, the user terminal 300 may transmit the authentication token A to the online service providing system 200 (S120), and the online service providing system 200 transmits the authentication means integrated platform providing system 100 to the authentication means integration platform providing system 100. Verification of the authentication token A may be requested (S130).

The authentication means integrated platform providing system 100 may verify the authentication token A in response to the authentication token A verification request (S140). For example, the authentication means integrated platform providing system 100 can verify the authentication token A by checking the identity authentication result corresponding to the authentication token A.

Thereafter, the authentication means integration platform providing system 100 may provide a verification result corresponding to the authentication token A to the online service providing system 200, and the online service providing system 200 may provide the verification result based on the verification result. Success or failure of the authentication may be determined (S160).

If the online service providing system 200 determines that the identity authentication is successful, the online service providing system 200 may provide the online service to the user terminal 300 (S170).

Conventionally, the online service providing system 200 for providing online services has processed the identity authentication request, but according to the method described above, the online service providing system 200 is an authentication means integration platform according to an embodiment of the present invention. The provision system 100 may be delegated to process the identity authentication and the result may be provided.

On the other hand, in the authentication means integrated platform providing system 100 according to an embodiment of the present invention, there are a number of vendors that provide a self-authentication solution by one authentication means, and each vendor's self-authentication solution is implemented or provided externally. If the interfaces to be used are different, it is possible to provide a technical idea for converting them into a unified form or for integrated processing. For example, if there are company A, company B, and company C as vendors that provide FIDO authentication means, and the interfaces provided by company A, company B, and company C are different from each other, the online service providing system 200 identifies the vendor as company A. In order to replace with company B or company C, the part implemented with the interface provided by company A must be re-implemented with the interface provided by company B or company C. In order to solve this inconvenience, the authentication means integrated platform providing system 100 according to an embodiment of the present invention can provide a vendor-independent unified interface to the online service providing system 200, which will be described below. It will be described with reference to FIG. 3 .

3 is a block diagram schematically showing the configuration of a system 100 for providing an integrated authentication means platform according to an embodiment of the present invention.

As shown in FIG. 2, the authentication means integration platform providing system 100 includes an authentication means specific module 110, a UI providing module 120, a receiving module 130, an implementation storage module 140, It may include a vendor specific module 150, a calling module 160, and a token module 170. Depending on the embodiment, the authentication means integration platform providing system 100 may include more configurations than these. For example, the authentication means integrated platform providing system 100 includes at least one communication module capable of communicating with an external system (eg, 200, 300) through a network or the authentication means integrated platform providing system 100 It may further include a control module capable of controlling functions and/or resources of other components included in, and an input/output module capable of interfacing with a user. Also, according to an embodiment, the authentication means integrated platform providing system 100 may not include at least some of the components shown in FIG. 3 .

In this specification, a module may mean a functional and structural combination of hardware for implementing the technical idea of the present invention and software for driving the hardware. For example, the module may refer to a specific code and a logical unit of hardware resources for executing the specified code, and does not necessarily mean a physically connected code or one type of hardware. It can be easily deduced to the average expert in the art of the present invention.

Referring to FIG. 3 , the regular reception module 130 is required for authentication by a predetermined authentication means from the user terminal 300 requesting authentication for the online service provided by the online service providing system 100. Unified authentication information can be received. When the authentication means is the same, the authentication information may be information having the same form regardless of the vendor, that is, unified authentication information independent of the vendor.

In one embodiment, the authentication means integration platform providing system 100 may provide a unified authentication API that can be called by the user terminal 300, and the user terminal 300 provides the authentication means integration platform By calling a unified API provided by the system 100, unified authentication information required for self-authentication by the authentication means can be transmitted.

The authentication means may be any one of a plurality of usable authentication means, and the plurality of usable authentication means are ID-password based authentication, pattern authentication, personal identification number (Personal Identification Number) based authentication, PKI (Public Key Infrastructure) It may be at least some of authentication based authentication, one time password (OTP) based authentication, e-mail based authentication, fingerprint authentication, iris authentication, face authentication, voiceprint authentication, biometric information based authentication, and open authorization based authentication.

On the other hand, the UI providing module 120 may provide a unified UI (User Interface) for self-authentication by the authentication means to the user terminal 300, and at this time, the receiving module 130 may provide the user terminal The unified authentication information input through the unified UI output from may be received. The UI provided to the user terminal 300 by the UI providing module 120 may also be a unified UI independent of vendors. That is, if the authentication means is the same, the same type of UI may be provided to the user terminal 300 even if vendors providing authentication solutions by the corresponding authentication means are different.

Meanwhile, the authentication means specifying module 110 may specify any one of a plurality of usable authentication means as the authentication means. For example, the authentication means specific module 110 may store information on various online services and authentication means previously mapped to the corresponding online service, and the authentication means mapped to the online service that is the object of the user authentication request may be stored. can be identified by means. Alternatively, the authentication means specifying module 110 may specify the authentication means designated by the online service providing system 200 as the authentication means. For example, the online service providing system 200 may request token generation as described above, and designate an authentication means when requesting token generation.

Meanwhile, the implementation storage module 140, the vendor specific module 150, and the calling module 160 actually execute the authentication method by the unified authentication API called by the user terminal 300 from the vendor. You can configure a kind of converter that converts according to the operating method or algorithm of the identity authentication solution provided.

More specifically, the implementation storage module 140 may store authentication method implementations corresponding to each of a plurality of vendors that provide a self-authentication solution by the authentication means. Also, the implementation storage module 140 may store, for each of a plurality of authentication means, authentication method implementations corresponding to each vendor providing an authentication solution based on the plurality of authentication means. In this case, the authentication method implementation corresponding to each of the plurality of vendors may be pre-implemented code using an application programming interface (API) provided by the corresponding vendor.

The vendor specifying module 150 may specify an authentication performing vendor corresponding to the online service from among the plurality of vendors that provide a self-authentication solution by the authentication means. The vendor specific module 150 may pre-store mapping information of a vendor responsible for authentication of the online service for each of a plurality of online services, and services provided by the online service providing system 200 through the mapping information. A corresponding vendor can be specified.

The calling module 160 may call an authentication method implementation corresponding to the authentication vendor for authentication through the authentication solution provided by the authentication vendor. Alternatively, the calling module 160 converts the unified authentication information into authentication information to be used in the authentication method implementation corresponding to the authentication vendor, and then calls the authentication method implementation corresponding to the authentication vendor. can do.

FIG. 4 is a diagram for explaining a method of converting an authentication method by a unified authentication API called by the user terminal 300 to conform to an operation method or algorithm of a user authentication solution actually provided by a vendor.

The authentication means integrated platform providing system 100 configures the same UI regardless of the authentication vendor's solution for the same authentication means, and processes authentication according to the vendor's authentication solution through a converter.

In more detail, referring to FIG. 4 , the authentication means integrated platform providing system 100 uses an API set provided by each vendor 400-1 to 400-3 to pre-implement authentication implementation 12 -1 to 12-3) may be stored in the implementation storage module 140 in advance.

On the other hand, the user terminal 300 is provided with a unified UI 10 corresponding to the authentication means (S210), and the user selects various items required for authentication on the unified UI 10 (for example, item 1 to 4 in FIG. 4). item 3) may be input, and the authentication method 11 may be called through the unified API 11 provided by the authentication means integrated platform providing system 100 (S220). Then, the converter 20 in the authentication means integration platform providing system 100 specifies a vendor corresponding to the service (S230), and uses the API set (13-1 to 13-3) provided by each vendor to pre-create Among the method implementations 12-1 to 12-3, a method implementation of a vendor corresponding to a corresponding service may be called (S240).

In one embodiment of the present invention, the authentication means integrated platform providing system 100 provides load-balance, failover such as fail-over or fail-break, circuit breaker -Breaker) can use a virtual environment.

More specifically, the calling module 160 creates a virtual environment before calling the authentication method implementation corresponding to the authentication vendor, and performs the authentication method implementation corresponding to the authentication vendor in the created virtual environment. can be called. In this specification, a virtual environment is a software implementation of a computing environment, and may mean a modular and isolated computing space or computing environment. Examples of the virtual environment include a virtual machine, an emulator, a container, and a Docker using various virtualization technologies. Each virtual environment may be isolated from each other and may not affect each other, and creation and deletion may be freely performed by a management module such as a hypervisor.

5 is a diagram illustrating an example of using a virtual environment in a process of calling a solution of an authentication vendor in the system for providing an integrated platform for authentication means according to an embodiment of the present invention. In the example of FIG. 5 , a virtual environment based on Docker, which is a representative technology for providing a virtual environment, is shown.

Referring to FIG. 5, the calling module 160 can create a virtual environment-based pod, create one or a plurality of containers in the pod, and implement an authentication method corresponding to a vendor performing authentication in the container. Performing authentication by calling the mention The authentication process can be performed by the solution provided by Bunder.

The calling module 160 may create a container in a pod whenever it is necessary to call an authentication solution of each authentication vendor. Within the created container, the calling module 160 may call an authentication method implementation corresponding to an appropriate authentication performing vendor (eg, 400-1 to 400-3).

During the calling process of the vendor solution, the number of pods or containers can be adjusted according to the usage of each certified vendor. In the example of FIG. 5 , the calling module 160 first creates a container in Pod#1, and if a certain number of calls is exceeded, it creates Pods in the order of Pod#2 and Pod#3, and the generated pods A container can be created within it. When the call volume decreases, the created pods can be removed in turn. Data for each pod is stored in a separate storage space (eg, DB 180) to maintain the data.

On the other hand, if the authentication vendor's solution is provided by an externally installed server, the pod is used for invocation purposes, and if it is necessary to build it in the integrated platform providing system 100, the solution is built in the pod and used.

On the other hand, the technical means for performing the above-described identity authentication may be applied to the digital signature as it is. Specifically, referring to FIGS. 6A and 6B as follows.

The user terminal 300 may request an electronic signature required by the online service providing system 200 that provides the online service (S310). The online service providing system 200 may request token generation corresponding to the digital signature to the electronic signature integration platform providing system 100 (S320). When requesting token generation, the online service providing system 200 may also transmit information about a service code of the online service.

Then, the digital signature integration platform providing system 100 may generate a token T corresponding to the digital signature in response to the token generation request (S330). The token T may be used for identification of identity authentication requested by the user terminal 300 . The token T is the service code of the online service, the URL of the digital signature UI page, the token issuance date, the token expiration date, the token issuance requester, the identifier of the token server (value for identifying the token issuance server), the session identifier ( Identifier for token issuance and usage group restriction), token signature information (signature information for verifying the integrity of the token), etc.

The electronic signature integrated platform providing system 100 may provide a token (T) corresponding to the generated electronic signature to the online service providing system 200 (S40), and the online service providing system 200 A token T corresponding to the digital signature may be transmitted to the user terminal 300 (S350).

Thereafter, the user terminal 300 may request the digital signature integrated platform providing system 100 to provide a UI for the digital signature (S60). At this time, the UI provision request may include a token (T) corresponding to the digital signature, and the electronic signature integrated platform providing system 100 provides the UI by the token (T) included in the UI provision request. A digital signature corresponding to the request can be identified.

Meanwhile, the digital signature integrated platform providing system 100 may provide the UI for the electronic signature to the user terminal 300 in response to the UI provision request (S70). According to the embodiment, the digital signature integration platform providing system 100 may transmit the token T along with the UI.

Subsequently, referring to FIG. 6B , the user terminal 300 may transmit signature information digitally signed with a private key corresponding to the user terminal and a public key to the electronic document integration platform providing system through the UI (S380). At this time, the user terminal 300 may transmit a token T corresponding to the digital signature.

The electronic signature integrated platform providing system 100 may specify a vendor corresponding to the service provided by the online service providing system 200 among a plurality of vendors capable of performing the electronic signature (S390). There may be a plurality of online services to which the method for providing an integrated digital signature platform according to the technical idea of the present invention is applied, and the system 100 for providing an integrated digital signature platform provides information on each online service and the vendor responsible for the electronic signature of the corresponding online service. Mapping information may be stored in advance. The electronic signature integration platform providing system 100 may specify a vendor corresponding to the online service providing system 200 through the mapping information.

The digital signature integration platform providing system 100 may perform verification of the signature information received from the user terminal 300 (S400). That is, the digital signature integration platform providing system 100 transmits the information necessary for the digital signature to the vendor system 400 that provides the digital signature solution, requests verification, and receives the verification result from the vendor system 400. can receive

Thereafter, the digital signature integration platform providing system 100 may generate a signature token A corresponding to the verification result, and may provide the signature token A to the user terminal 300 (S410).

Thereafter, the user terminal 300 may transmit the signature token A to the online service providing system 200 (S120), and the online service providing system 200 may transmit the digital signature integrated platform providing system 100 to the online service providing system 100. Verification of signature token A may be requested (S430).

The digital signature integrated platform providing system 100 may verify the signature token A in response to the verification request of the signature token A (S440). For example, the authentication means integration platform providing system 100 can verify the signature token A by checking the digital signature result corresponding to the signature token A.

Thereafter, the digital signature integration platform providing system 100 may provide the verification result corresponding to the signature token A to the online service providing system 200 (S450), and the online service providing system 200 may provide the verification result Based on this, it is possible to determine whether the electronic signature is successful (S460).

Meanwhile, according to an implementation example, the authentication means integrated platform providing system 100 may include a processor and a memory storing a program executed by the processor. The processor may include a single-core CPU or a multi-core CPU. The memory may include high-speed random access memory and may also include non-volatile memory such as one or more magnetic disk storage devices, flash memory devices, or other non-volatile solid-state memory devices. Access to memory by processors and other components may be controlled by a memory controller.

On the other hand, the method according to the embodiment of the present invention may be implemented in the form of computer-readable program instructions and stored in a computer-readable recording medium, and the control program and target program according to the embodiment of the present invention are also computer-readable. It can be stored on a readable recording medium. The computer-readable recording medium includes all types of recording devices in which data that can be read by a computer system is stored.

Program commands recorded on the recording medium may be specially designed and configured for the present invention, or may be known and usable to those skilled in the software field.

Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, floptical disks and hardware devices specially configured to store and execute program instructions, such as magneto-optical media and ROM, RAM, flash memory, and the like. In addition, the computer-readable recording medium is distributed in computer systems connected through a network, so that computer-readable codes can be stored and executed in a distributed manner.

Examples of program instructions include high-level language codes that can be executed by a device that electronically processes information using an interpreter, for example, a computer, as well as machine language codes generated by a compiler.

The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

The above description of the present invention is for illustrative purposes, and those skilled in the art can understand that it can be easily modified into other specific forms without changing the technical spirit or essential features of the present invention. will be. Therefore, the embodiments described above should be understood as illustrative in all respects and not limiting. For example, each component described as a single type may be implemented in a distributed manner, and similarly, components described as distributed may also be implemented in a combined form.

The scope of the present invention is indicated by the following claims rather than the detailed description above, and all changes or modifications derived from the meaning and scope of the claims and equivalent concepts thereof should be construed as being included in the scope of the present invention. .

Claims (14)

delete delete delete delete delete delete delete delete delete delete delete requesting, by a user terminal, authentication to an online service providing system that provides a predetermined online service;
requesting, by the online providing service system, a token generation corresponding to the authentication method to the authentication means integrated platform providing system;
generating a token corresponding to the identity authentication in response to the token generation request, by the authentication means integrated platform providing system;
providing, by the authentication means integrated platform providing system, a token corresponding to the generated identity authentication to the online service providing system;
transmitting, by the online service providing system, a token corresponding to the identity authentication to the user terminal;
Requesting, by the user terminal, to provide an authentication UI (User Interface) for the authentication means integration platform providing system for the authentication means - Here, the request for providing the authentication UI includes a token corresponding to the authentication;
providing, by the authentication means integrated platform providing system, an authentication UI for authentication to the user terminal in response to the authentication UI provision request;
Step, by the user terminal, inputting the authentication information required for the authentication through the authentication UI and transmitting to the authentication means integrated platform providing system;
the authentication means integration platform providing system transmits the authentication information required for the authentication to an authentication system of a predetermined vendor that provides an identity authentication solution, requests validation, and receives a validation result from the authentication system;
generating an authentication token corresponding to the verification result by the authentication means integrated platform providing system;
providing the authentication token to the user terminal by the authentication means integrated platform providing system;
transmitting, by the user terminal, the authentication token to the online service providing system;
requesting, by the online service providing system, verification of the authentication token from the authentication means integrated platform providing system;
providing a verification result corresponding to the verification token to the online service providing system in response to the verification request of the verification token, by the system for providing the integrated platform for verification means; and
and determining, by the online service providing system, whether or not the authentication is successful based on the verification result.
requesting, by a user terminal, an electronic signature required by an online service providing system that provides a predetermined online service;
requesting, by the online providing service system, a token generation corresponding to the digital signature to a digital signature integrated platform providing system;
generating a token corresponding to the digital signature in response to the token creation request;
providing, by the digital signature integrated platform providing system, a token corresponding to the generated digital signature to the online service providing system;
transmitting, by the online service providing system, a token corresponding to the digital signature to the user terminal;
Requesting, by the user terminal, to provide a digital signature user interface (UI) for the digital signature to the digital signature integrated platform providing system - wherein the request to provide the digital signature UI includes a token corresponding to the digital signature box;
providing, by the digital signature integrated platform providing system, a digital signature UI for the digital signature to the user terminal in response to the request for providing the digital signature UI;
Step, by the user terminal, inputting digital signature target data that is the target of the digital signature through the digital signature UI and transmitting the data to the digital signature integrated platform providing system;
The digital signature integration platform providing system transmits the digital signature subject data, which is the subject of the digital signature, to the electronic signature system of a predetermined vendor providing a digital signature solution, requests verification, and returns the verification result from the digital signature system. receiving;
generating a signature token corresponding to the verification result by the digital signature integrated platform providing system;
providing the signature token to the user terminal by the digital signature integrated platform providing system;
transmitting, by the user terminal, the signature token to the online service providing system;
requesting, by the online service providing system, verification of the signature token to the electronic signature integration platform providing system;
providing, by the digital signature integration platform providing system, a verification result corresponding to the signature token to the online service providing system in response to the verification request of the signature token; and
and determining, by the online service providing system, whether or not the digital signature is successful based on the verification result.
A computer program recorded on a computer readable medium installed in a data processing device and executing the method according to claim 12 or 13.

Images