KR19980019231A - AUTHENTICATION SYSTEM FOR REMOTE BANKING SERVICE USING COMPUTER COMMUNICATION NETWORK - Google Patents

Abstract

The disclosed invention is a system for authenticating a remote financial service based on a challenge / response protocol, comprising: a computer terminal for providing input / output means to a user requiring authentication for a remote financial service, and the computer terminal connected to a computer communication network. After providing a challenge value to the user through, by generating a response value, which is the output value of the one-way function for the challenge value to determine whether or not equal to the user response value input from the user through the computer terminal An authentication determination system for authenticating the authenticity of the user; And generating the user response value corresponding to the challenge value through the built-in one-way function in response to receiving the challenge value from the user so that the user can provide the challenge value to the authentication determination system through the computer terminal. The present invention relates to an authentication system for a remote financial service using a computer communication network composed of an authentication token card displayed externally.

According to the present invention, by fundamentally blocking the external leakage of the authentication password, it is possible to maximize the security and reliability of authentication for the authenticity of the user, and at the same time access to the authentication server through a computer communication network that gradually provides a user-friendly environment By doing so, there is an effect of improving the convenience of the user's communication connection and the reliability of authentication.

Description

Authentication system of remote financial service using computer communication network

The present invention relates to an authentication system for a remote financial service using a computer communication network. More specifically, in an authentication system for a remote financial service based on a challenge / response protocol using a computer communication network, an external leakage of an authentication password is essentially blocked. At the same time, the present invention relates to an authentication system for a remote financial service using a computer communication network which improves the user's convenience of communication and reliability of authentication by accessing an authentication server through a computer communication network, which is gradually providing a user-friendly environment.

Recently, remote banking services such as home trading, phone banking, and personal computer banking have existed in the time / space that exists between financial companies and customers to provide financial services. With the convenience of easily eliminating the restrictions, it is showing high preference among various financial services, and at the same time, the increase in the use population is accelerating.

1 illustrates an example in which a remote financial service system such as home trading, phone banking, personal computer banking, and the like is configured by using an answering system using an authentication password as described above. One configuration example.

As shown in FIG. 1, a remote financial service system using an automatic answering system according to the prior art is a public switched network (PSTN) through which a telephone 10 and a transmission / reception signal of the telephone 10 pass through. 20) an automatic answering system (ARS) 30 which can be accessed through a public telecommunication network 20 at a telephone number provided by a financial institution and provides an acoustic user interface, and the automatic answering system 30 An authentication server for authenticating the authenticity of the user by checking and verifying a preset authentication password (i.e., a password) of the customer entered through the keypad of the telephone 30 with the support of the corresponding customer stored in the database. 40).

In general, if the authenticity of the user is confirmed by the authentication server 40, as the granting of all the authority for the account, the implementation technology of the remote financial service is a key task to maximize the security of the authentication process It is a well known fact.

Today, due to the development of various electronic technologies, the spread of tools that can access specific information that requires security through various paths is being changed. The development and notification of non-experts is expected to lead to the emergence of more sophisticated security technologies to block and protect such information from unauthorized access, access, destruction, cloning, and theft.

It is well known that efforts to secure security related to authentication of a remote financial service system, which is one of the mainstream of security systems, have been advanced from various angles.

The present invention relates to an authentication system for a remote financial service, and a brief description will be made of an authentication system for a remote financial service according to the prior art.

First, a representative method for accessing an authentication server that leads the authentication process of a remote financial service is introduced. One method is to use a telephone and a public communication network based on the above-described answering machine. As a method, there is a method of accessing an authentication server by using a computer communication network which is rapidly popularized recently.

When a connection with the authentication server is established by using such a communication system, an authentication process for verifying the authenticity of the user is performed by the authentication server. An authentication password (or, The most common method is to remember the unique password, password) in the head of each user and authenticate the authenticity of the user by entering it when authentication for financial services is required.

However, as is well known, this method has a high risk that each person's authentication password is exposed to others and detects a fingerprint or inputs an authentication password by using a fixed password. There is a possibility of being easily leaked to others by the mobilization of a certain fraudulent method of recording the video, especially, because it can be easily read by the party staff of the financial institution, etc. There are many financial accidents related to this, and much effort is required to identify the responsibilities.

A more advanced form of authentication that has emerged as an alternative to solve this problem is the authentication method of a remote financial service system that uses a randomly generated random number (or random number plastic), often called a random number. have.

In the above-described prior art, the latter is relatively more confidential than the former by reading a corresponding authentication password on a random number table including a plurality of authentication passwords to form a new session, but the method using the random number is also Although the confidentiality is somewhat higher due to the authentication system operating within the scope of a certain rule, there is no countermeasure in case there is no countermeasure when the random number is copied and leaked or the employee of the relevant financial company uses an illegal method. In addition, questions are raised in terms of safety.

On the other hand, a method of using a telephone and a public communication network based on an answering system, which is one of the methods for accessing the authentication server, is tapped by another person without using advanced technology as it is supported by the voice service of the answering machine. In particular, this type of remote financial service has a problem that it is more likely to be a financial service of uselessness to the hearing impaired or a person with a poor hearing ability compared to a normal person.

Accordingly, the present invention has been made to solve such a problem, in the authentication system of the remote financial service based on the challenge / response protocol using a computer network, generating a response value corresponding to the challenge value provided from the authentication server It is equipped with a portable authentication token card that is displayed externally, and the displayed reference value is transmitted to the authentication server through the computer communication network as the user inputs the key, thereby fundamentally preventing the leakage of the authentication password. The purpose of the present invention is to provide an authentication system for a remote financial service using a computer communication network which improves the user's convenience of communication and reliability of authentication by accessing the authentication server through a computer communication network that provides a user-friendly environment.

1 is a configuration diagram showing an example in which a remote financial service system is configured using an answering machine;

2 is a block diagram showing a preferred embodiment of an authentication system for a remote financial service using a computer communication network according to the present invention;

3 is a flowchart illustrating a preferred embodiment of a method for authenticating a remote financial service using a computer communication network according to the present invention.

* Explanation of symbols on the main parts of the drawing

100: computer terminal 200: computer communication network

300: authentication judgment system 310: communication server

320: authentication server 400: authentication token card

In order to achieve the above object, a remote financial service authentication system using a computer communication network according to the present invention is a remote financial service authentication system based on a challenge / response protocol. A computer terminal providing a means for input and output to a user.

After providing a challenge value to the user through the computer terminal connected to a computer communication network, a self-response value, which is an output value of a one-way function to the challenge value, is generated and the user is transmitted through the computer terminal. An authentication determination system for authenticating the authenticity of the user by determining whether the user response value is equal to the user response value, and the challenge value corresponding to the challenge value through the built-in one-way function in response to receiving the challenge value from the user. And an authentication token card that generates the user response value and displays the user response value so that the user can provide the response value to the authentication determination system through the computer terminal.

Hereinafter, a configuration of a preferred embodiment of an authentication system for a remote financial service using a computer communication network according to the present invention will be described with reference to FIG. 2.

2 is a block diagram showing a preferred embodiment of an authentication system for a remote financial service using a computer communication network according to the present invention.

In the preferred embodiment of the authentication system of the remote financial service using the computer communication network according to the present invention, in the authentication system of the remote financial service based on the challenge / response protocol, as shown in FIG. Computer terminal (100) for providing input and output means to a user requiring authentication for financial services.

After providing a challenge value to the user through the computer terminal 100 connected to the computer communication network 200, and generates a self-response value that is an output value of the one-way function to the challenge value An authentication determination system 300 for authenticating the authenticity of the user by determining whether the user response value is input from the user through the computer terminal 100 and the challenge value are received from the user. An authentication token card that generates the user response value corresponding to the challenge value through the one-way function, and displays the user response value externally for the user to provide to the authentication determination system 300 through the computer terminal 100 It consists of 400.

Here, the authentication determination system 300 forms a communication connection by dialing the computer terminal 100 and receives a preset user identifier to provide bidirectional communication connectivity for performing an authentication procedure of a remote financial service. Recognize a communication server 310 and the user identifier input from the communication server 310, generate a challenge value and transmit the challenge value to the user through the communication server 310, and then By generating a self response value determined by an output value of the unidirectional function for the same and determining whether or not the user response value corresponding to the challenge value applied through the computer terminal 100 and the communication server 310 is equal to the user response value. It consists of an authentication server 320 for authenticating the authenticity of the user.

Here, the computer communication network 200 collectively refers to all wired and wireless networks that can be connected to a computer terminal, such as an existing public telephone network, an integrated service digital network (ISDN), the Internet, and the like.

The operation of the preferred embodiment of the authentication system for the remote financial service using the computer communication network according to the present invention configured as described above will be described with reference to FIG.

3 is a flowchart illustrating a preferred embodiment of a method for authenticating a remote financial service using a computer communication network according to the present invention.

First, a user acquires an authentication token card 400 produced and distributed to users by an institution (eg, a financial company: a bank, a securities company, a trust company, an insurance company, etc.) that requires user authentication. By connecting to the communication server 310 provided by the financial company or a service company on behalf of the computer via the computer communication network 20 to form a two-way communication connection between the user and the communication server (310) (S10).

When communication between the user and the communication server 310 is established, the communication server 310 requires a user identifier that can uniquely identify the user, such as a user's social security number or an opened bankbook number. When a user inputs a user identifier by using the keyboard of the computer terminal 100, the communication server 310 transmits it to the authentication server 320 (S20).

Accordingly, the authentication server 320 determines whether there is an identifier that matches the input user identifier and its own built-in identifier (S30).

As a result of the determination, if there is no own identifier that matches the user identifier, the customer is required to input the correct user identifier again over a predetermined number of error occurrences N allowed by the user with the support of the communication server 310. Finally, if the user's input does not meet such a request, the access is blocked (S40).

On the other hand, if there is a unique identifier that matches the user identifier, the authentication server 320 generates a challenge value for performing the authentication procedure based on the challenge / response protocol to provide to the communication server 310, communication server 310 receives it and delivers it to the user through the computer terminal 100 as a voice (S50).

Thereafter, after the user turns on the authentication token card 400, the user inputs a PIN (Personal Identification Number) of the authentication token card 400, which is stored only by the password itself, to the authentication token card 400. After accessing systemically, the challenge value received from the authentication server 320 via the communication server 310 is input through the keypad of the authentication token card 400. (S60)

Accordingly, the authentication token card 400 calculates a user response value corresponding to the challenge value through a series of operations using the same one-way function as the one-way function built in the authentication server 320 so that the user can use the computer terminal. Displayed to the outside to provide to the authentication determination system 300 through (100) (S70).

At this time, prior to accessing the communication server 310 of the financial company, the user turns on the power of the authentication token card 400, and then the password (PIN: Personal Identification) of the authentication token card 400 that only the password itself is stored. It is well known that a user may attempt to connect to the communication server 310 in a state of systematically accessing the authentication token card 400 by keying in a number).

Thereafter, the user inputs a user response value displayed on the outside through the keyboard of the computer terminal 100 (S80).

At the same time, the authentication server 320 provides a challenge value to a user requiring authentication for the remote financial service, and then outputs itself through a series of operations using a one-way function on the challenge value. Generate the response value.

Subsequently, when the user response value input by the user through the computer terminal 100 is transmitted through the communication server 310, the authentication server 320 determines whether the user response value and its own response value are the same. (S90)

Thereafter, when it is determined in step S90 that the user response value and the own response value are the same as the legitimate user, the communication server 310 transmits permission of the access (access). Subsequently, the communication server 310 transmits the permission of the access received to the authentication server 130 to the user through the computer terminal 100, and proceeds with the remote financial service allowed to the legitimate user according to the legitimate access. (S100)

On the other hand, if it is determined in step S90 that the user response value and the self response value are not the same, in step S110, the predetermined number of occurrences of the error allowed for the number M of inconsistency between the user response value and the self response value is allowed. (M) It determines whether it is below.

As a result of the determination in step S110, if the number M of inconsistency between the user response value and the self response value is less than the predetermined number of error occurrences M allowed, in step 120 a new challenge value is determined through the authentication server 320. After creation, the process returns to step 60, otherwise, the unauthorized user's access is blocked by rejecting the user's request.

For reference, the one-way function used herein refers to a one-way function with back-door, and a typical one-way function is a hash function. The main characteristic of a unidirectional function with a backdoor is that the output value (here, the response value) corresponding to the input value (here, the challenge value) can be calculated by a series of operations, but the input value corresponding to the output value is calculated. There is a feature that can be secured by not being able to do so, except that only the authorized person who has the key value can calculate the input value from the output value, and the term is called back-door.

On the other hand, the challenge value and the response value can be expressed not only by any of numbers and letters, but also by alphanumeric in combination of letters and numbers, but are generally represented by numbers.

In addition, since the above-described bidirectional communication between the computer terminal 100 and the communication server 310 is a well-known technique, detailed description thereof will be omitted.

As described above, the authentication system of the remote financial service using the computer communication network according to the present invention using the challenge / response protocol transmits and receives a secret authentication password instead of an actual authentication password on a channel. Even if the password is tapped, since the actual password (password) that is actually used in the authentication server 320 is not lost, very high security can be secured.

Terminologies used herein are terms defined in consideration of functions in the present invention, which may vary according to the intention or customs of those skilled in the art, and the definitions should be made based on the contents throughout the present application. will be.

Although specific embodiments of the invention have been described and illustrated, it will be apparent that the invention may be embodied in various modifications by those skilled in the art.

In addition, since the present invention has been described through the preferred embodiment of the present invention, in view of the technical difficulty aspects of the present invention, those having ordinary skill in the art can easily be different from another embodiment of the present invention. As modifications may be made, it is obvious that both the embodiments and modifications cited in the above description belong to the appended claims.

As described in detail above, in an authentication system of a remote financial service based on a challenge / response protocol using a computer communication network, a portable authentication token card designed to provide a response value corresponding to the challenge / response protocol According to the authentication system of a remote financial service using a computer communication network according to the present invention employing a token card), as in an authentication system using a random number check, a random number check is duplicated and no authentication password is leaked. Based on the operation of the authentication token card based on the operation, it is possible to completely prevent the authentication password from being observed by others, thereby fundamentally blocking the leakage of the authentication password, thereby maximizing the security and reliability of authentication for the authenticity of the user. Can be gradually and user-friendly at the same time By providing the connection to the authentication server via a computer communication network that the there is an effect that it is possible to enhance the reliability of the user of the communication connection of the convenience and authentication. In addition, it is expected to greatly contribute to the expansion and low change of remote financial services as it can dramatically improve user satisfaction.

Claims (3)

An authentication system for a remote financial service based on a challenge / response protocol, comprising: a computer terminal providing input / output means to a user requiring authentication for a remote financial service, and a challenge to the user through the computer terminal connected to a computer communication network After providing a value, the user's authenticity is determined by generating a self-response value that is an output value of the one-way function with respect to the challenge value and determining whether it is equal to a user response value input from the user through the computer terminal. An authentication determination system for authenticating and generating the user response value corresponding to the challenge value through the built-in one-way function in response to receiving the challenge value from the user so that the user determines the authentication determination system through the computer terminal. Can provide to The authentication system of the remote financial service using a computer communication network, characterized in that consisting of the authentication token card to be displayed on an external lock. The communication system of claim 1, wherein the authentication determination system establishes a communication connection by dialing the computer terminal and receives a predetermined user identifier to provide bidirectional communication connectivity for performing an authentication procedure of the remote financial service. Recognizing the user identifier input from the server and the communication server, generating the challenge value and transmitting the challenge value to the user through the communication server, and then determining its own value determined by the output value of the one-way function for the challenge value. And an authentication server for authenticating the authenticity of the user by generating a punch value and determining whether or not it is equal to a user response value corresponding to the challenge value applied through the computer terminal and the communication server. Authentication of Remote Financial Services Using Computer Network System. The system of claim 1, wherein the computer communication network is one of a public telephone network, an integrated service digital network (ISDN), and the Internet.