KR20040083272A - Method and System for Authentication of User on Web and/or Wireless Network by Using Mobile Terminal Loaded a Challenge/Response Based Mobile One-Time Password Module - Google Patents

Abstract

PURPOSE: A user authentication method and system on a Web and/or a wireless network using a mobile terminal having a challenge/response-based one-time wireless password module are provided to guarantee the stability of user authentication and reduce a cost. CONSTITUTION: A user is connected to an Internet banking server(S300). The user inputs an ID and a password for authentication(S302). The Internet banking server executes a one-time password input screen(S304). An MOTP(Mobile One-Time Password) service server searches a specific MOTP module of the user(S306). The MOTP service server generates a challenge value and transmits it to user terminal unit or a user computer(S308). The user terminal unit generates a one-time password(S310). the one-time password is transferred to the MOTP service server(S312). The MOTP service server determines whether the user authentication is successful(S314). If the user authentication is successful, the MOTP service server transmits the corresponding result to the Internet banking server and the Internet banking server allows a user to use an e-banking service(S320).

Description

Method and system for authentication and user on web and / or wireless network using mobile terminal equipped with challenge / response based wireless one-time password module Loaded a Challenge / Response Based Mobile One-Time Password Module}

The present invention utilizes a mobile one-time password (MOTP) module based on a challenge / response (MOTP) module on a web and / or wireless network. A method and system for authenticating a user is provided. More specifically, each mobile communication terminal capable of voice and data communication transmits and mounts its own MOTP module through a wireless Internet network, and is based on a challenge / response method for a wired / wireless communication device of a user connected for user authentication. The present invention relates to a system and method for transmitting a challenge message and authenticating a user by receiving a one-time password generated using a challenge message received by a MOTP module mounted in a user terminal as a response message.

Recently, electronic financial services such as home trading, phone banking, and personal computer banking have eased the temporal and spatial constraints between financial firms and customers to provide financial services. Due to the convenience, the number of users who use the service is rapidly increasing.

However, these electronic financial services are very likely to cause not only personal economic loss but also social disruption if user authentication and information security are not securely performed. In other words, due to the development of various electronic and communication technologies, devices such as computers that can access specific information that requires security through various communication paths are widely used, and the security of information according to the existing encryption technology is dismantled. Technology is also readily available to professionals as well as non-experts. Therefore, high-performance and high-performance security technology has been continuously developed to protect information by preventing illegal activities such as access, reading, copying, theft, and destruction of certain information by unauthorized persons.

As information security becomes more important, the system developed and used in connection with user authentication of electronic financial services, which is one of the mainstream of security systems, generally establishes an authentication server for user authentication. And operate. Representative methods for a user to access the authentication server is a method using a telephone based on an Auto Response System (ARS), a method using a public communication network, and a method using a computer to connect through the Internet.

When the connection with the authentication server is made through such a communication system, an authentication process for verifying the authenticity of the user is performed. The authentication password (password, unique number, etc.) that the user remembers is authenticated for the financial service. The method of authenticating the authenticity of a user by directly inputting it when necessary is typically used.

However, in this method, the authentication password stored by the user has a high risk of being exposed by others, and since a fixed authentication password is used every time, a fingerprint or authentication password is detected on a data input means such as a keypad or keyboard. There is a possibility that it can be easily leaked to others due to an illegal method such as recording a scene for inputting a video input device.

As an alternative to solve this problem, there is a method of authenticating a user by using a random number card or a random number plastic, which is created and distributed in advance, which is commonly referred to as a 'random number'. The user authentication method using such a random number checks a user by inputting and reading a specific authentication password on a random number table including a plurality of authentication passwords, so that the confidentiality is relatively higher than that of the conventional method. There is a limitation that the system generates random numbers within the range of. In other words, when the random number is copied and leaked or the employee in charge of the financial company uses the wrong method, there is a disadvantage that the system operation is not stable because there is no countermeasure.

The one-time password system is a technology that has been developed and used to secure security by preventing the leakage of user information that may occur in user authentication in the electronic financial service.

The one-time password system is a security solution that changes the password for user authentication whenever a user connects to the computer network and requests authentication from the server. The current time-synchronous method and the challenge / response method are used. It is developed and used. The one-time password system has the advantage that even if a password is leaked from the network, the same password can no longer be used because the number of times the password can be used is limited to one. Due to these advantages, the one-time password system is widely used in various electronic banking services including virtual banking services and e-commerce, and has been spotlighted as a new concept of security solution by large information system operators or service providers.

On the other hand, in order to use a one-time password system, the user generally needs to be provided with a separate one-time password generator issued by a company using a one-time password system that is about the size of a credit card and a little thicker. Therefore, in order to authenticate a user using a one-time password method, the company has to pay a production cost, a selling cost, an issuing cost, and the like in addition to the general system construction cost. Due to such a high cost problem, many financial companies have not decided to use a one-time password system.

In addition, the separate one-time password generator is not large in size, so there is a high risk of loss, and if the one-time password generator is lost while a password (PIN: Personal Identification Number) is used for the one-time password generator, There is a possibility that a problem of authenticating as an authenticator occurs.

In addition, each financial company or Internet banking service provider is issued a different one-time password generator, and the user authentication is possible only by using its one-time password generator. Therefore, in order for a user to use a one-time password system, each company must have a unique one-time password generator, which is cumbersome, and as the number of one-time password generators that a user must possess increases, the risk of loss increases. . In addition, since the operation method of the unique one-time password generator for each company is different, there is a disadvantage in that the user has to spend a lot of time, effort, and cost to know the operation method of each one-time password generator.

In order to solve the above problems, the present invention transmits and mounts a terminal-specific MOTP module through a wireless Internet network for each mobile communication terminal capable of voice and data communication, and challenges a wired / wireless communication device of a user connected for user authentication. The purpose of the present invention is to provide a method and system for transmitting a challenge message based on a response method and receiving a one-time password generated by using a challenge message received by a MOTP module installed in a user terminal as a response message to authenticate a user. It is done.

1 is a block diagram schematically showing a MOTP service system for mounting a user and authenticating a MOTP module to a mobile communication terminal according to an embodiment of the present invention;

2 is a flowchart illustrating a process of receiving and installing a MOTP module to a user terminal according to an embodiment of the present invention;

3 is a flowchart illustrating a process of authenticating a user in a MOTP service system using a user terminal installed with a MOTP module according to an embodiment of the present invention.

<Explanation of symbols for the main parts of the drawings>

100: MOTP service system 110: user terminal

120: user computer 130: the Internet

140: branch computer 150: wireless access network

152: base station transmitter 154: base station controller

160: mobile switching center 170: gateway

180: SMSC 182: Internet Banking Server

190: MOTP service server 192: user database

To this end, the present invention is a system for authenticating a user using an electronic banking service using a one-time password technology, and receives and mounts a unique MOTP module through a wireless Internet network, and the mounted unique MOTP module and challenge / response technology. User terminal for generating a one-time password using; A user computer for applying for issuance of the unique MOTP module through a wired internet network, and receiving a one-time password from the user terminal and transmitting the one-time password through an internet network; Perform a user authentication operation related to the electronic financial service, generate the unique MOTP module for each user, and transmit the generated MOTP module to the user terminal through the wireless Internet network, and the one-time password from the user terminal and / or the user computer MOTP service server for receiving the authentication of the user; And a web using a mobile communication terminal equipped with a wireless one-time password module based on a challenge / response, characterized in that it comprises a user database linked to the MOTP service server for storing each unique MOTP module for each user. Or a user authentication system on a wireless network.

According to another object of the present invention, a MOTP service server for generating a unique MOTP module for each user terminal equipped with a unique MOTP module, a user computer with a web browser, and a user, and using a challenge / response technology. And a user database storing the unique MOTP module for each user, connected through a wired / wireless internet network to authenticate the user to provide an electronic banking service, the method comprising: (a) the user computer via the wired / wireless internet network; Accessing a banking server; (b) the Internet banking server requesting user authentication from the MOTP service server when the login is successfully performed, and providing a one-time password input screen to the user computer; (c) searching and reading the native MOTP module using the user database; (d) generating a challenge value using the read unique MOTP module, and transmitting the generated challenge value to the user terminal unit and / or the user computer; (e) generating, by the user terminal unit, a one time password corresponding to the challenge value to the user computer; And (f) receiving and authenticating the one-time password from the user computer, and transmitting the authentication result to the internet banking server. A user authentication method on a web and / or wireless network using a communication terminal is provided.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. First of all, in adding reference numerals to the components of each drawing, it should be noted that the same reference numerals are used as much as possible even if displayed on different drawings. In addition, in describing the present invention, when it is determined that the detailed description of the related well-known configuration or function may obscure the gist of the present invention, the detailed description thereof will be omitted.

1 is a block diagram schematically illustrating a MOTP service system 100 for mounting a MOTP module and authenticating a user in a mobile communication terminal of a user according to an exemplary embodiment of the present invention.

MOTP service system 100 according to a preferred embodiment of the present invention is a user terminal 110, a user computer 120, a wired and wireless Internet network 130, a branch computer 140, a wireless access network (RAN: Radio Access Network) 150, Mobile Switching Center (MSC) 160, Gateway 170, Short Message Service Center (SMSC) (180), Internet banking Server 182, MOTP service server 190, and user database 192.

The user terminal 110 is a wireless communication terminal for receiving and mounting a MOTP module from the MOTP service server 190 through a wireless Internet network. The cellular phone 112, the PDA (Personal Digital Assistant) 114, and the PCS ( Personal Communication Service phones, Hand-Held PCs, Global System for Mobile (GSM) phones, Wideband CDMA (W-CDMA) phones, CDMA-2000 phones, Mobile Broadband System (MBS) phones, and the like. Can be. Here, MBS phone refers to a mobile phone to be used in the fourth generation system currently being discussed. The user terminal 110 performs a voice call and data communication during normal operation, and performs a user authentication function according to the technical idea of the present invention when the mode is switched to the MOTP authentication mode under the control of the user.

In this case, when the key value for switching to the MOTP authentication mode is input to the user terminal 110, the user terminal 110 inputs a personal identification number to the liquid crystal display (LCD) screen. Require. When a personal identification number is input through a keypad of the user terminal 110, the microprocessor of the user terminal 110 matches the personal identification number stored in the EEPROM (Electrically Erasable and Programmable Read Only Memory). If it is determined to match, it switches to the MOTP authentication mode.

The MOTP module mounted in the user terminal unit 110 functions to generate a one-time password in a challenge / response manner by receiving a challenge value transmitted to the user terminal through the wireless Internet network or transmitted to the user computer 120. .

The user computer 120 performs a login procedure to use the electronic banking service, and executes a MOTP input screen transmitted from the Internet banking server 182 after user login. In addition, the user computer 120 receives a challenge value from the MOTP service server 190 while the MOTP input screen is executed and displays the challenge value on the MOTP input screen, and displays the one-time password input from the user terminal 110 in the MOTP service server. It transmits to 190. To this end, the user's computer 120 is provided with a predetermined web browser such as Internet Explorer or Netscape, which can view web pages constructed from HTML (HyperText Markup Language) documents.

The branch computer 140 is a computer that can use an electronic banking service including an application for issuing an MOTP module and an internet banking service according to the present invention. Since the branch computer 140 is not a necessary component for the implementation of the present invention, it may be omitted, but it may be added for efficient customer management in the MOTP service provision process.

The wireless access network 150 serves to guarantee the mobility of the user terminal 110, and performs handoff and wireless support management functions. The radio access network 150 includes a base station transmitter 152 and a base station controller 154 and supports both synchronous and asynchronous. Here, in the case of synchronous, the base station transmitter 152 will be a base transceiver station (BTS), the base station controller 154 will be a base station controller (BSC), and in the asynchronous case, the base station transmitter 152 is a radio transceiver subsystem RTS. The base station controller 154 may be a radio network controller (RNC). Of course, the wireless access network 150 according to the embodiment of the present invention is not limited thereto, but is not limited to a CDMA network as well as a GSM network and future implementations. The concept includes the access network of the 4G mobile communication system.

The mobile switching center 160 generally manages the radio access network 150 and performs basic and additional service processing, incoming and outgoing call processing of subscribers, location registration and handoff procedures, and interworking with other networks. .

The gateway 170 switches the circuit line and the data line by cell unit together for the processing of the IWF (Inter Working Function) conversion function currently used in the mobile communication system and packet data directly connected in the cell unit. .

The SMSC 180 receives the call-back URL message transmitted from the MOTP service server 190 and transmits the received message to the user terminal 110 through the mobile communication network. Here, the callback URL message includes the URL information of the MOTP service server 190. The user terminal 110 receiving the callback URL message accesses the MOTP service server 190 using the callback URL message to access the MOTP module. Download it.

In general, when the SMSC 180 receives the acknowledgment signal of the callback URL message of the user terminal 110 through the mobile communication network, the transmission state of the stored callback URL message is set to 'SENT', and then, Delete it after that.

The internet banking server 182 is a server that operates a website for providing various electronic financial services, such as internet banking and home trading, to a user computer 120 connected thereto. When the Internet banking server 182 receives a user authentication request from the logged-in user computer 120, the Internet banking server 182 transfers the user's information to the MOTP service server 190, and receives the user's authentication result from the MOTP service server 190. It is determined whether the user can use the electronic financial service.

The MOTP service server 190 receives user authentication request information using a one-time password from the Internet banking server 182 and processes user authentication according to an embodiment of the present invention, and then transfers the authentication information back to the Internet banking server 182. The mobile terminal generates and stores a unique MOTP module for each user, and transmits the unique MOTP module to the user terminal 110 through the wireless Internet. That is, the user uses the MOTP module issuing webpage provided by accessing the Internet banking server 182 through the Internet 130 using the user computer 120 or visits a sales office to apply for MOTP module issuance.

On the other hand, in the MOTP module issuance application step, the user inputs the MOTP application information in order to receive his / her own MOTP module. The MOTP application information includes the user's ID (Identification), MIN (Mobile Identification Number), and digital certificate information. This includes. Here, ID refers to the ID registered when the user joins the MOTP service server 190 as a member, and the electronic certificate information is Korea Information Authentication Co., Ltd. (http://www.signgate.com), Korea Securities Computerization ( Co., Ltd. (http://www.signkorea.com), KFTC (http://www.yessign.or.kr), Korea Electronic Certification Co., Ltd. (http://gca.crosscert.com) Digital certificate information issued by a certification authority.

In addition, when a user authentication request is generated from the Internet banking server 182, the MOTP service server 190 searches for a unique MOTP module of the corresponding user in the user database 192 by using the user's login information, and retrieves the searched MOTP module. The challenge value generated using the data is transmitted to the user terminal 110 or the user computer 120. In this case, when the challenge value is transmitted to the user computer 120, the challenge value received by the user computer 120 is transmitted to the user terminal 110. As a method of transferring the challenge value, an infrared communication (IrDA) or a cable communication is performed. Etc. can be used. Of course, the user may directly input the challenge value received by the user computer 120 to the user terminal 110.

On the other hand, the user terminal 110 generates an infrared password or data to generate a one-time password corresponding to the challenge value received through the wireless Internet or transmitted through the user computer 120 and the challenge value received using the MOTP module mounted Transmission to the user computer 120 through a cable or the like. Of course, the user may directly enter the one-time password generated by the user terminal 110 into the user computer 120.

The MOTP service server 190 receives the response message transmitted from the user computer 120 and uses the authentication password temporarily stored in the user database 192 to use the one-time password and the authentication password included in the response message. Compare and perform user authentication. For this user authentication, the MOTP service server 190 includes an authentication module.

That is, the MOTP service server 190 transmits the challenge value to the user terminal 110 or the user computer 120, and then reuses the MOTP module used to generate the challenge value for authentication corresponding to the challenge value. The password is generated and temporarily stored in the user database 192.

Meanwhile, as described above, the MOTP service server 190 is provided with a short message creating module for transmitting a callback URL message to the user terminal unit 110, so that the callback URL message prepared by the short message preparing module is sent to the SMSC 180. send.

The MOTP service server 190 having the above-described function is a service server added to and connected to an internet banking server 182 operated by a bank, a securities company, a card company, an e-commerce company, etc., which provides various electronic financial services using a one-time password system. to be. In addition, the MOTP service server 190 processes and responds to a one-time password authentication request for authenticating a user who uses the electronic financial service through the Internet in an internet banking server. The MOTP service server 190 provides a platform for interworking with another server, a database maintenance, maintenance and management function using a DBMS (DataBase Management System).

The user database 192 stores basic information (ID, password, electronic certificate information, MIN, etc.) of a user who has registered as a member in the MOTP service server 190 according to an embodiment of the present invention, and a unique MOTP module for each user. . In addition, the user database 192 temporarily stores an authentication password generated by using a unique MOTP module and challenge value for each user in order to authenticate the user in the MOTP service server 190. The password for authentication temporarily stored in the user database 192 is deleted from the user database 192 regardless of whether authentication is successful each time an authentication operation of the user is attempted.

2 is a flowchart illustrating a process of receiving and installing a MOTP module to the user terminal 110 according to an exemplary embodiment of the present invention.

When a user who wants to use the MOTP service according to an embodiment of the present invention connects to the Internet banking server 182 through the Internet 130 and applies for the MOTP module, the Internet banking server 182 connects to the MOTP service server 190. Application for registration for issuing a MOTP module (S200). Of course, it is possible to apply for issuance of the MOTP module by visiting the sales office or distributor of the company providing the electronic banking service, filling in the application information of the MOTP module.

When the user inputs the MOTP module application information on the MOTP module application screen provided in step S200, the input MOTP module application information is transmitted from the Internet banking server 182 to the MOTP service server 190 (S202). Similarly, application information of the MOTP module created by visiting a sales office or an agency may be transmitted to the MOTP service server 190 by the sales office computer 140.

The MOTP service server 190 creates a callback URL message using a short message creation module so that the MOTP module can be installed in the user terminal 110 of the user by using the MIN of the received MOTP module application information of the user ( S204).

The MOTP service server 190 transmits the created callback URL message to the user terminal 110 through the SMSC 180 and the mobile communication network (S206).

When a button for accessing a URL, for example, a 'confirmation' button, is pressed to the user terminal unit 110 that has received a callback URL message through a mobile communication network and a key value is input, the user terminal unit 110 provides a MOTP service through a wireless Internet network. The server 190 is connected (S208).

The MOTP service server 190 recognizing the connection of the user terminal 110 receives the application of the MOTP module received in step S202 using the MIN information of the connected user terminal 110 and stored in the user database 192. The unique MOTP module is generated using the ID, MIN, and digital certificate information among the information (S210). Here, the application information used to generate the unique MOTP module is not limited to this, and may be extended as much. In addition, the unique MOTP module generated by the MOTP service server 190 is stored in the storage area of the user of the user database 192.

The MOTP service server 190 transmits the unique MOTP module generated in step S210 to the user terminal 110 through the wireless Internet network (S212).

The unique MOTP module transmitted by the MOTP service server 190 is received, stored and automatically installed by the user terminal 110 (S214).

3 is a flowchart illustrating a process of authenticating a user in the MOTP service system 100 using the user terminal 110 in which the MOTP module is installed.

In FIG. 3, it is assumed that the user terminal 110 has already switched to the MOTP authentication mode.

According to an embodiment of the present invention, the user accesses the Internet banking server 182 to use the Internet banking service (S300).

The user inputs an ID and password on the screen for member authentication provided from the Internet banking server 182 to perform member authentication (S302). Of course, it is also possible to authenticate the member using an electronic certificate rather than a member authentication method using an ID and password.

After the member authentication is normally performed, the internet banking server 182 transmits a MOTP user authentication request for a financial transaction to the MOPT service server 190, and executes a one-time password input screen on the user computer 120 (S304).

The MOTP service server 190 searches for a unique MOTP module of the corresponding user in the user database 192 based on the login information of the user included in the MOTP user authentication request information (S306).

The MOTP service server 190 generates a challenge value using the searched unique MOTP module and transmits the generated challenge value to the user terminal 110 and / or the user computer 120 through the wired / wireless internet network (S308). . Here, the transmission of the challenge value to the user terminal 110 may be transmitted using a short message, and the challenge value to the user computer 120 may be transmitted to the one-time password input screen transmitted in step S304. Here, the MOTP service server 190 that transmits the challenge value generates a one-time password corresponding to the challenge value by using the retrieved unique MOTP module, and temporarily stores the generated one-time password in the user database 192.

The challenge value transmitted to the user computer 120 is input to the user terminal 110 through a method such as infrared communication, data cable communication, or direct user input, and the user terminal 110 is included in a short message or the user computer. The challenge value received from 120 is generated using a MOTP module equipped with a corresponding one-time password (S310).

The one-time password generated by the user terminal 110 is input to the one-time password input screen of the user computer 120 through a method such as infrared communication, data cable communication, or direct user input, and as a response message, the MOTP service server 190 Is transmitted (S312).

The MOTP service server 190 determines whether the user authentication is successful by using whether the two passwords match using the one-time password received from the user computer 120 and the authentication password temporarily stored in the user database 192. (S314).

If the user authentication is not successful in step S314, the MOTP service server 190 compares the current number of authentication attempts with a preset number of possible authentications (S316).

The MOTP service server 190 determines whether the current number of authentication attempts exceeds a preset number of authentication possible in step S316 (S318). If it is determined that the number of times does not exceed, the MOTP service server 190 proceeds to step S308 to perform the MOTP authentication again. Otherwise, if it is determined that the current number of authentication attempts exceeds a predetermined number of authentication possible times, the authentication failure is regarded as a user authentication failure, and the authentication failure result is transmitted to the Internet banking server 182, and the authentication operation is terminated.

On the other hand, if the user authentication is successfully performed in step S314, the MOTP service server 190 transmits the authentication success result to the Internet banking server 182, the Internet banking server 182 so that the user can use the electronic financial service Authorization and related web pages are provided (S320).

The above description is merely illustrative of the present invention, and those skilled in the art to which the present invention pertains may make various modifications without departing from the essential characteristics of the present invention. Accordingly, the embodiments disclosed herein are not intended to limit the present invention but to describe the present invention, and the spirit and scope of the present invention are not limited by these embodiments. It is intended that the scope of the invention be interpreted by the following claims, and that all descriptions within the scope equivalent thereto shall be construed as being included in the scope of the present invention.

As described above, when the MOTP module is mounted on the mobile terminal according to the present invention, as well as ensuring the stability of user authentication in the user authentication system using a one-time password, it is not necessary to produce and issue a separate one-time password generator to build a one-time password system. The cost savings are enormous, and an inexpensive MOTP module can be quickly deployed to many users instead of an expensive one-time password generator.

In addition, users do not have multiple one-time password generators issued by each service provider that provides one-time password service, and only one mobile communication terminal equipped with a MOTP module shared by multiple service providers. Therefore, the hassle and risk of losing a large number of one-time password generators can be greatly reduced.

Claims (2)

A system that authenticates users who use electronic banking services by using one-time password (OTP) technology. A user terminal unit configured to receive and mount a unique MOTP (Mobile OTP) module through a wireless Internet network and generate a one-time password using the mounted unique MOTP module and challenge / response technology; A user computer for applying for issuance of the unique MOTP module through a wired internet network, and receiving a one-time password from the user terminal and transmitting the one-time password through an internet network; Perform a user authentication operation related to the electronic financial service, generate the unique MOTP module for each user, and transmit the generated MOTP module to the user terminal through the wireless Internet network, and the one-time password from the user terminal and / or the user computer MOTP service server for receiving the authentication of the user; And User database linked with the MOTP service server for storing the unique MOTP module for each user User authentication system on the web and / or wireless network using a mobile communication terminal equipped with a wireless one-time password module based on the challenge / response characterized in that it comprises a. A user terminal unit on which a unique MOTP module is mounted, a user computer on which a web browser is installed, a MOTP service server for generating the unique MOTP module for each user, and authenticating a user using a challenge / response technology, and the unique MOTP module for each user. A method of authenticating the user to provide an electronic banking service is connected through a wired or wireless Internet network for storing a user database. (a) the user computer accessing an internet banking server through the wired / wireless internet network; (b) the Internet banking server requesting user authentication from the MOTP service server when the login is successfully performed, and providing a one-time password input screen to the user computer; (c) searching and reading the native MOTP module using the user database; (d) generating a challenge value using the read unique MOTP module, and transmitting the generated challenge value to the user terminal unit and / or the user computer; (e) generating, by the user terminal unit, a one time password corresponding to the challenge value to the user computer; And (f) receiving and authenticating the one-time password from the user computer, and transmitting an authentication result to the internet banking server. User authentication method on the web and / or wireless network using a mobile communication terminal equipped with a wireless one-time password module based on the challenge / response characterized in that it comprises a.