KR200211327Y1 - The user-authentication system through second connecting path - Google Patents

Abstract

The user authentication system using the second access path of the present invention is to prevent hacking of user information and illegal user authentication from hackers with high hacking ability in services such as electronic commerce, internet stock trading, and phone banking. .

A user authentication system for achieving the above object is a user authentication system having a first connection path with a user, wherein the user's request through the first connection path is processed within a preset range and processing outside the preset range. Is required, user authentication is performed using the second access path. The second connection path is preferably implemented with a telephone communication network and a communication device thereof.

In addition, when the existing authentication method and the authentication method according to the present invention are organically combined, authentication through the existing first access path is a primary authentication that allows simple access to the device in order to handle user requests within a predetermined range. And, it is preferable that the authentication through the second connection path according to the present invention is applied as the final user authentication to allow access or update of important information outside the predetermined range.

The user authentication system according to the present invention provides improved security effects and reliability, and enables users to securely conduct credit transactions in the use of e-commerce services using a communication network, and further provides an effect of promoting related industrial development. do.

Description

The user-authentication system through second connecting path}

The present invention relates to a user authentication system using a second connection path, and in particular, a second connection path different from the first path where the user connects to the system (for example, telephone communication). The user authentication system using the second access path that ensures superior reliability and stability than the existing user authentication system by performing the final user authentication using the password of the voicemail of the mobile phone as a secondary password through the network) will be.

Nowadays, due to the rapid development of information and communication and high penetration rate of computers, electronic commerce using the Internet or the same type of communication network is becoming active, and its use is increasing day by day.

In order to access the above-mentioned e-commerce, a user ID and a password must be input to access the site of the transaction, and if there is authentication, the following e-commerce is possible.

That is, the user authentication system as described above receives an ID and a password (password) for accessing a specific service system from a user through a single access path and compares it with those of a corresponding user previously stored in the system. According to the user authentication is performed.

In order to prevent hacking of personal credit information or transmission data on the access path, data (ID, password, or contents) transmitted between the user terminal and the service providing system is further encrypted and decrypted (or scrambling) using a predetermined encryption algorithm. And descrambling).

Meanwhile, with the rapid development and dissemination of the Internet, e-commerce, home banking, and telecommuting are increasing, and the related information industry is developing.

In this information industry, various security systems and user authentication systems have been developed to prevent the leakage and damage of personal credit information and important information from hackers with highly specialized hacking ability. Among them, the password encryption system has fundamental technical limitations, and despite the development of security systems (firewalls, etc.), it is incapable of advanced hacker hacking techniques.

Especially, in case hackers with advanced hacking techniques intercept the transmission data (ID, password) on the connection path and decrypt it, the service providing system authenticates the user to an invalid user despite the existence of a perfect firewall. There is no choice but to do it.

Therefore, the technical limitations of the existing user authentication system and the advanced hacking techniques and the increasing risk of hacking are provoking a vague anxiety for general users' use of e-commerce services, and thus, a major obstacle to the development of related industries. It is becoming.

In order to solve the above problems, the present applicant prevents hacking of user information for authentication by a hacker on a general access path, and even in such a case, only the user who has the right can reliably distinguish and authenticate the reliability. And to provide a user authentication system with significantly improved stability.

That is, by the user authentication system using the applicant's first application second connection path of the application number 1999-34850 (Publication No. 1999-0078937) dated August 21, 1999,

Having two user terminals individually connected to different connection paths User interface means,

A service provider system that processes a request from a user through the first access path within a predetermined range and processes processing out of the range, and finally performs user authentication using the second access path and provides a service accordingly; ,

The user who is located on the second connection path between the user interface means and the service provider system, and when the end user authentication is required, makes a call to the second user terminal connected to the user's telephone number to request user authentication information and responds therefrom. A communication connection and management system for transmitting authentication information to the service provider system;

When the user authentication is finally performed by the user authentication and service providing means, it is composed of resource objects that require the right user's access or update the information,

A user operating a first user terminal to access a service provider system through a first access path and performing a task within a predetermined allowance set in the service provider system;

If the above-described system access is primarily permitted, the user authentication and service providing means determines whether final user authentication is necessary;

If the end user authentication is required, the user authentication and service providing means requesting to input the secondary password to the first user terminal through the first access path.

If a user-determined secondary password is input to the user authentication and service providing means through the first user terminal and the first access path, the user authentication and service providing means inputs the inputted secondary password of the user in the database for telephone authentication. Temporarily storing and managing records in,

If the user's secondary password is temporarily set in the DB for phone authentication, the user authentication and service providing means reads the user's phone number stored in the phone authentication DB and transmits it to the communication connection system;

A communication connection system capable of ARS (voice answering system) processing, calling a second user authentication terminal through a second access path using a received user's telephone number, and requesting a second password to be entered;

Receiving the message, the user manipulates the second user terminal to input the user's secondary password into the communication connection system through the second connection path;

The communication connection system transmits the second password inputted from the second user terminal to the user authentication and service providing means through the second connection path.

The user authentication and service providing means check whether the secondary password of the user transmitted through the second user terminal and the second access path and the telephone connection system matches the secondary password of the user stored through the first user terminal and the first access path. Judging,

As a result of this determination, if they match, the user currently connected to the system through the first access path is finally authenticated as a user having a right, and as a result, the user can confirm the service corresponding to the processing out of the predetermined range in the system. By performing the steps provided to allow the user who has been finally authenticated to access the resource object or to process the update of the information, and the secondary password returned through the second user terminal to the system. If it does not match the temporarily stored secondary password, the processing is performed according to a predetermined rule or the user's existing transaction on the system is rolled back.

However, when the user authentication system using the conventional second connection path as described above is used to pick up the user's mobile phone, the user can easily enter the secondary password when making a call through the mobile phone, as well as performing the authentication procedure. There were disadvantages such as leaking passwords while performing procedures in the institution, which caused users to inadvertently cause serious damage.

The present invention for solving the above disadvantages is to use the password of the voicemail of the mobile phone as a second password through a second connection path (for example, a telephone communication network) different from the first path that the user connects to the system It is an object of the present invention to provide a user authentication system using a second access path that ensures superior reliability and stability by performing a user authentication.

A user authentication system using the second connection path of the present invention for achieving the above object comprises a first user interface means for enabling a desired communication of the user's computer terminal through the first connection path;

Second user interface means for enabling communication for authentication of a user's cellular phone terminal through a second connection path;

A service providing server for processing a request from a user through the first connection path within a preset range and having a procedure for authentication if processing outside the preset range is required, and providing a service accordingly;

An authentication authority that connects a telephone to a user's mobile terminal through a second connection path at the request of the service providing server, requests user authentication information, and performs a user authentication procedure by responding therefrom;

(In addition to the method of connecting a phone, the second connection path may use SMS, WAP, and ME. SMS is short message transmission and WAP and ME are wireless Internet transmission.)

A certification authority that requests and authenticates user authentication information and performs a user authentication procedure accordingly;

A wired / wireless communication service company that receives a password (for example, information such as a voicemail password) that a user inputs through a mobile phone terminal by a certification procedure of the certification authority, performs a verification process for authentication, and delivers only the result to the certification authority. Wow,

Comprised of resource objects that provide the desired information to legitimate users by accessing the service providing server received from the certification authority,

Performing a first user authentication by inputting an ID and a primary password of the user through the computer terminal and the first access path when the user accesses the service providing server through the first access path by operating the computer terminal;

If the user is a normal user, allowing the service providing server to receive the service provided for the purpose of membership management;

If the user who received the general service wants a special service, the step of determining whether the second user authentication is required in the service providing server;

If the secondary user authentication is required, the service providing server requesting the computer terminal to input the secondary password through the first access path and the first user interface means;

At the same time, the service providing server provides information including the user's mobile phone number while requesting the certification authority to perform the user's authentication;

The second access path 15 and the second user interface while transmitting a dialing signal (or a signal for communication of WAP, ME, SMS) from the certification authority receiving the user's information to the wired / wireless communication service company Connecting a telephone to the user's cellular phone terminal 14 through the means 13 so that a call path is formed;

Requesting the user to input the voicemail password, which is the secondary password, from the certification authority 17 when a normal call path is formed;

When the user inputs the voicemail password, performing a second user authentication in the wire / wireless communication service company 18 to compare the voicemail password of the user stored in the communication database 21;

The wired / wireless communication service company 18 notifies the certification authority 17 of the comparison result, and the certification authority 18 which has received the comparison result can receive the service of the allowable range not previously set in the service providing server 16. To notify whether or not

The service providing server 16, which has received the authentication result from the certification authority 17, may allow the legitimate user to access the resource object 19 requesting access or may be provided with desired information. It is to provide enhanced security effect and reliability, and to enable users to securely conduct credit transactions in the use of e-commerce services using a communication network, and to provide more effects for promoting related industrial development. .

In particular, the voicemail password has the characteristic of strictly protecting it in terms of personal privacy protection, which has a feature that cannot be used except for the personal phone. However, the voicemail password can be conveniently authenticated without leaking the voicemail password to the outside. To be done.

1 is a block diagram showing a user authentication system using a second connection path according to an embodiment of the present invention,

2 is a flow chart showing a preferred user authentication process of the user authentication system using the second access path shown in FIG.

Explanation of symbols on the main parts of the drawings

10: first user interface means 11: computer terminal

13: second user interface means 14: mobile phone terminal

16: service providing server 17: certification authority

18: wired and wireless communication service company 19: resource object

20: database for authentication 21: communication database

Hereinafter, the present invention will be described in detail with reference to Examples.

1 is a view showing a preferred embodiment in the case where the second authentication method using the second connection path (specifically, the telephone communication network) is organically combined with the existing primary authentication method using the first connection path of the present invention. ,

First user interface means (10) for enabling desired communication of the user's computer terminal (11) via the first connection path (12),

Second user interface means 13 for enabling communication of the user's cellular phone terminal 14 for authentication via the second connection path 15;

A service providing server that processes the request from the user through the first connection path 12 within a preset range and has a procedure of authentication if processing outside the preset range is required, and then provides a service accordingly. 16) and,

The service providing server 16 calls the user's cellular phone terminal 14 through the second connection path 15 to request user authentication information and performs a user authentication procedure by responding therefrom. With the certification authority (17)

The authentication procedure of the certification authority 17 receives a password (for example, information such as a voicemail password) inputted by the user through the mobile terminal 14, and performs a verification procedure for authentication. 17) a wired / wireless telecommunications service company 18 to deliver,

The authentication result is composed of resource objects 19 that require legitimate user access or provide desired information by access of the service providing server 16 received from the certification authority 17.

Herein, the resource object 19 corresponds to all objects requiring user authentication procedures such as general data files, DB tables, bank accounts, special information providing services, directory services, and the like.

Looking at the above configuration in detail, if the user who wants to retrieve or output information to receive the service of the service providing server 16 via the first user interface means 10 to which the computer terminal 11 is connected, the first connection It is connected to the service providing server 16 via the path (12).

In addition, the service providing server 16 receiving the request from the user through the first access path 12 provides a service desired by the user within a preset range, and when a process or a service out of the preset range is requested. The user computer terminal 11 is required to have a procedure of authentication.

At the same time, the service providing server 16 requests the certification authority 17 to receive the authentication procedure for the user, and the certification authority 17 requests the mobile phone terminal of the user through the second connection path 15 in response to the request. Call 14 or output a signal for communication of WAP, ME, and SMS to request user authentication information (e.g., voicemail password).

The wired / wireless communication service company 18 receiving the password (for example, voicemail password) input by the user through the mobile terminal 14 by the authentication procedure of the certification authority 17 confirms whether the password information is correct. Only the result is transmitted to the certification authority (17).

The voicemail password is not passed here.

The service providing server 16 received the authentication result from the certification authority 17 allows the legitimate user to access the resource object 19 requesting access or to be provided with the desired information.

The authentication database (DB) 20 of the service providing server 16 stores and manages user IDs and first passwords, and the like, and the computer terminal 11 and the first access path 12. By allowing the user to access the service providing server 16 to use the service within a predetermined range.

The communication database (DB) 21 of the wired / wireless communication service company 18 stores and manages personal information excluding a user's voicemail box and a second password such as a voicemail box and a voicemailbox password. If processing outside the preset range is required, it is used to finally authenticate whether the user has a right.

A preferred method of performing final user authentication using the second connection path in the user authentication system using the second connection path of the present invention configured as described above will be described with reference to FIG. 2.

Referring to FIG. 2, when a user manipulates the computer terminal 11 to access the service providing server 16 through the first access path 12 (step 31), the service providing server 16 sets a preset allowable range. Perform authentication and service operations within the process (step 32).

That is, the service providing server 16 inputs the user ID and the primary password through the computer terminal 11 and the first access path 12 (step 33), and inputs the ID and primary password of the user. Is compared with the user ID and primary password of the corresponding user stored in the authentication database 20 to perform the first user authentication (step 34).

Such primary user authentication is preferably used for user authentication to a predetermined service where security is not highly required.

If the user is a normal user as a result of performing the first user authentication (step 35), the service providing server 16 accesses the homepage on the network for the purpose of membership management and browses basic service details or personal credit. This allows the user to view the known information rather than the important information related to or related to the paid service (step 36).

If the user who has been provided general services by the first authentication wants to provide the information that he / she wants or charges for a special service, or wants to purchase the goods at a cost (step 37), the service providing server ( In step 16), it is determined whether secondary user authentication is required (step 38).

In this case, the service providing server 16 determines that final user authentication is not necessary unless the user's request through the first access path 12 is outside the preset allowable range in the system, and continues the operation within the preset allowable range. If the user's request corresponds to an access process or update process of important information outside the range set in the system, it is determined that final user authentication is required.

In step 38, if the secondary user authentication is required (step 39), the service providing server 16 connects the computer terminal 11 to the computer terminal 11 via the first connection path 12 and the first user interface means 10. Requires entry of a secondary password (step 40).

At the same time, the service providing server 16 provides the information including the mobile phone number of the user while requesting the certification authority 17 to perform authentication of the user through the input of the secondary password (step 41). Transfer the telephone number for the formation of the call path from the certification authority 17 receiving the user's information to the wired / wireless communication service company 18 (step 42), and the second connection path 15 and the second user interface means 13 Call) while sending a dialing signal to the user's cellular phone terminal 14) or output a signal for communication of WAP, ME, and SMS to form a call path (step 43).

If the user has normally established a call path (step 44), the certification authority 17 requests the user to input the voicemail password which is the secondary password (step 45), and the user inputs the voicemail password (step 45). 46) In the wire / wireless communication service company 18 receiving the voicemail password input by the user, a second user authentication is performed comparing with the voicemail password of the corresponding user stored in the communication database 21 (step 47).

As a result of the comparison, only the voicemail password inputted by the user and the voicemail password stored in the communication database 21 are identical or different, and the wired / wireless communication service company 18 notifies the certification authority 17 (step 48). The received certification authority 18 notifies the service providing server 16 whether or not it is possible to receive a service of a predetermined allowance range (step 49).

The service providing server 16, which has received the authentication result from the certification authority 17, allows a legitimate user to access the resource object 19 requesting access or to receive desired information (step 50). .

On the other hand, in the certification authority 17 for the second authentication to make a call to the user's mobile terminal 14 via the wired or wireless communication service 18 or to output a signal for communication of WAP, ME, SMS If you do, you may have to pay the call charge directly from the certification authority (17), so it is possible to make the call at the expense of the receiver when dialing the user.

That is, if the telephone line is connected to the wired / wireless communication service company 18 or the communication of WAP, ME, and SMS is made, the user presses the * and 88 or 89 voicemail access number and then the SEND. It is possible to make a user-directed call path in such a manner as to press a key.

According to the user authentication system using the second connection path as described above, after the authentication is performed through the wire / wireless communication service company in the certification authority, only the result is notified. It is not known to the provider server and there is no fear of leaking to hackers or others.

Therefore, the user authentication system using the second connection path of the present invention processes the user's request through the first connection path within a predetermined range, and if the processing out of the predetermined range is required, the telephone communication network and the communication device are implemented. The user authentication is performed using the second connection path.

In addition, when the existing authentication method and the authentication method according to the present invention are organically combined, authentication through the existing first access path is a primary authentication that allows simple access to the device in order to handle user requests within a predetermined range. And, it is preferable that the authentication through the second connection path according to the present invention is applied as the final user authentication to allow access or update of important information outside the predetermined range.

The user authentication system according to the present invention provides improved security effects and reliability, and enables users to securely conduct credit transactions in the use of e-commerce services using a communication network, and further provides an effect of promoting related industrial development. There is an advantage.

Claims (1)

First user interface means (10) for enabling desired communication of the user's computer terminal (11) via the first connection path (12), Second user interface means 13 for enabling communication of the user's cellular phone terminal 14 for authentication via the second connection path 15; A service providing server that processes the request from the user through the first connection path 12 within a preset range and has a procedure of authentication if processing outside the preset range is required, and then provides a service accordingly. 16) and, At the request of the service providing server 16, the mobile phone terminal 14 of the user is called through the second access path 15 or the user authentication information is requested from the WAP, ME, and SMS. The certification authority 17 which performs the authentication procedure of the user by the state which becomes By the authentication procedure of the certification authority 17, the user receives the information such as the voicemail password inputted by the user through the mobile phone terminal 14, and performs the procedure of confirming the authentication and delivers only the result to the certification authority 17. With wired / wireless telecommunications service companies 18, By using the second connection path, characterized in that the authentication result is composed of resource objects 19 for providing the desired information to the legitimate user by the connection of the service providing server 16 received from the certification authority (17) User Authentication System.