KR20050030880A - The method of safe certification service - Google Patents

Abstract

A safe certification method for protecting an ID and a password is provided to excellently secure login information in any computer regardless of installation of a security program, offer excellent security to a door lock, effectively prevent pishing, and extend a band of the password in a small keypad like a mobile phone. The certification is performed by inputting the ID and the password(S100). Automatically downloaded to the computer of a connector after connecting to a web page, a Java applet for a connection location tracking function reports a current connection location of the connector to a server and the server stores information(S200). If the connection location is tracked, the connector selects one image by outputting a screen mixed with a predetermined image and other images, or clicks the second password made by a character string with a mouse(S410). If the connector tries another connection in a previously connected state, the location of the connector is compared with the location of the present login location. If both locations are different, the connection location of a person trying the connection is reported(S500).

Description

{The Method of safe certification service}

The present invention relates to authentication of a user, and is a technology capable of preventing the leakage of keyboard input information to steal a personal ID and password, or the leakage of a password by a button input door lock device.

At present, personal computer security programs have already been commercialized, and functions to monitor illegal infringement or installation of hacking programs for hacking are provided.

In addition, many Internet sites allow users to check secure access options when logging in, and use an international standard 128bits SSL (Secure Sokets Layer) used for internet banking and card payments to prevent hackers from intercepting user IDs and passwords. It provides a service to encrypt.

Personal computer security programs work only on the computer on which it is installed, so if you open your email on another computer, you are hacked again.

In addition, the conventional secure access service is helpless for the keyboard input information hacking program installed directly in the computer.

In addition, the door lock device for entering and exiting the current button has the disadvantage that the password is easily exposed to the accompanying person.

Therefore, to provide a secure connection to any computer, and to provide an authentication method that can enable a secure door lock.

The present invention consists of four main steps. Each step will be explained.

1 is a main flow diagram of the present invention.

1. Authentication step by text input (S100)

This step is the most common technique for authentication by entering the ID and password by the keyboard, so a detailed description thereof will be omitted.

2. Connection location tracking step (S200)

When the visitor passes the authentication step by text input, the user is directed to a web page for the authentication step by inputting coordinates. At this time, the Java applet that performs the location tracking function is automatically downloaded to the visitor's computer and the server's current connection location is displayed. Report on, and the server records this information.

The technique for tracking the location of a connection with a Java applet is mentioned in Korean Patent Application No. 10-2001-0027537.

3. Authentication step by inputting coordinates (S400)

When the access point of the visitor is tracked, the visitor outputs a predetermined image randomly mixed with other images on the screen so that the correct image is clicked correctly. In this case, the predetermined image may be one or plural. Only if the correct image is clicked correctly is the authentication successful.

Alternatively, the second password in a character string may be clicked with a mouse.

At this time, by limiting the number of possible attempts appropriately (S410) to prevent a person who tries to hack to try to hack force in the state that their connection position is exposed (S420).

2 is an example of clicking an image.

4. Access history report step (S330, S500)

If the user attempts another connection while already connected, the location of the accessor acquired in the access location tracking step is compared with the current login status (S310). Immediately report to the user the connection location of the person currently attempting access (S330). The user can report the connection position so that the hacker can be arrested.

If it is not a redundant connection, the acquired location information of the visitor is always reported to the user at the next login (S500). In particular, if there is a record that failed to click on the image, a higher level alarm is prepared for hacking.

3 is an example of reporting a past access record when logging in.

Among the steps described above, the step of inputting the coordinates of the image is intended to prevent anyone from easily stealing another's ID by extracting the keyboard input information since the conventional login method relies only on the keyboard. That is, even if the keyboard input information is taken out, if the user cannot correctly click the predetermined image, the login fails.

In addition, the connection location tracking step, to attempt to click on the image is to expose their own connection location so that if you do not know a predetermined image at all to try not to try.

In addition, the authentication step by keyboard input is intended to prevent hacking by only remembering the image because only the mouse click itself is slow because authentication by the mouse click is slow. . That is, in general, keyboard input is made by pressing several keys in an instant, so it is difficult to recognize them easily. That is, it has a double security system by inputting with a keyboard and a mouse, respectively.

Hereinafter, various embodiments of the authentication method by inputting coordinates will be described.

4A and 4B illustrate still another embodiment of an authentication method based on coordinate input.

This method uses a key coordinate and a key image, and is authenticated when the user sets a predetermined key image to a predetermined key coordinate.

For example, assume that the key coordinates of the user are (4, 2) and the key image is the heart pattern (1). (4, 2, heart pattern) is recorded in the user's personal information DB as secondary authentication information. The server randomly shuffles all the patterns and transmits the image table as shown in FIG. 4A to the user's terminal. At this time, record (2, 3) which is the position of the key image (1) of the randomly mixed image table. The user carefully looks where the heart pattern (1), which is his key image displayed on the screen, and manipulates the direction key to be located at his key coordinates (4, 2). In FIG. 4A, since the heart pattern 1 is at (2, 3), pressing the right direction key twice and the down direction key once, the entire images are shifted in the direction of the direction keys, respectively, and the heart pattern (1) at (2, 3) is shown. ) Is positioned at (4, 2) as shown in FIG. 4B. this?? If you press the enter key, the authentication is successful. According to the operation of the direction key, the server continuously shifts (2, 3), and compares the coordinates just before the enter key is input with the key coordinates, and if it is the same, the server passes the authentication. In this way, a total of 25 images are shifted together, so it is very difficult to know which images are being aligned to which coordinates even if others are looking behind. In addition, even if the direction key operation information is leaked, the next time the key image is transferred to another location, the same operation is not authenticated. In this case, the shifted rule is a method of shifting an image positioned at the end position in a moving direction, such as 1-2-3-4-5-1, to the first position in the direction.

In addition, this method may newly designate the key coordinate as the second key image each time.

5 is an embodiment in which numbers are displayed for each coordinate instead of the coordinate notation.

In this embodiment, when the heart pattern 1 is the first key image and the second key image is the clover pattern 4, the 14th position 3 where the clover pattern, which is the second key image, was first This is the key coordinate. In other words, authentication is performed by replacing the first key image with the second key image.

In this method, key coordinates are also changed every time, so it is easier to memorize by attaching a number (3) than a coordinate such as (4, 3). After receiving the image table as shown in FIG. 5, the user finds the heart pattern 1 as his first key image, finds the clover pattern 4 as the second key image, and memorizes the number 14, the heart. Manipulate the arrow keys so that the pattern (1) is in position 14. At this time, memorizing the digits of the clover pattern is because the clover pattern moves together when the heart pattern is moved, because it can forget the first place (3). Therefore, it is necessary to think that the second key image is not aligned with the second key image, but the position (3) designated by the second key image. In order to memorize these key images, I use the names of the images, either I love clover (move the heart to the clover) or memorize phrases such as carrots (move the carrot to the fender). It is easy to remember when you use it.

To do this, the server records the coordinates of each key image when creating a new table before sending the image table, and calculates the coordinate movement according to the user's key operation.

Here, you can think more interesting and beneficial functions, booby trap key (5) and Shingo key (6).

Both the booby trap key and the report key are predetermined by the user. In this embodiment, the user sets the carrot 5 as the booby trap key and the butterfly 6 as the report key. The booby trap key is a key that indicates the position that must not pass when moving the key image. That is, in the order of digits 12-13-14 in FIG. 5, since the 13th digit of the carrot was the booby trap key 5, at this time, an alarm sounds in the PC speaker and authentication fails. In other words, avoiding carrots, the route of 12-11-15-14 or the route of 12-7-8-9-14 should be used.

In addition, if the booby trap key is caught during the authentication process, the booby trap key can send an alarm message to the user through SMS or e-mail so that appropriate action can be taken. For example, an alarm message may include a URL to receive a report, and when a report is received, a dispatch guard may be dispatched to the scene to catch a stealer.

When the report key 6 is used as an authentication device in a door lock device or a bank cash dispenser, it is necessary to report a criminal so as not to notice the criminal when he / she enters the company or the house or withdraws the cash due to the threat of the criminal. As it allows, if the second key image is a deceiving key or butterfly (6), or directly manipulated, the authentication is successful once, reassuring the offender, but the police or security company will automatically receive the report. That is, the report key may be referred to as a function of adding a report function to the function of the second key image.

The booby trap key and report key maximize the prevention effect by increasing the risk of an unauthorized user attempting authentication to disguise others.

In addition, the method of numbering each digit shown in this method may be applied to the method of FIG. That is, in the method of FIG. 4, it is only necessary to memorize the heart pattern at the number 19 to memorize the heart pattern at the position (4, 2).

6A and 6B illustrate another embodiment of an authentication method using coordinate input.

This method is a case of pairing key images. In the example, 21 (7) and 11 (8).

After finding 21 in the left image table and 11 in the right image table in FIG. 6A, drag the right image table with the mouse to align the two key images so that they overlap each other, and if there are (21, 11) among the overlapped image pairs, The certification passes. Even in this case, the arrangement of the image table is changed randomly each time, so even if the mouse operation information is known, authentication cannot be passed next time. In addition, multiple image pairs are overlapped at one time so that other people can't see which image pair is the key image pair even if they are seen from behind. In this method, when creating image tables on the server, if two image tables match key image pairs, too few image pairs overlap so that others cannot easily recognize them. Discard the image table and recreate it.

4, 5, and 6 described above is a method of making the key image safe even if others are watching. The first method to achieve the purpose is to match the key image with the key image. Only the user knows the key coordinates (or the second key image arranged in the second image table), and secondly, when manipulating the position of the key image, all other images are operated in the same direction and distance at the same time. By not letting others know what image to manipulate even if they are watching, the image table is presented differently each time, so even if you know the operation value, you cannot authenticate with the same operation value next time.

You can also use the arrow keys to achieve the same effect without moving all the images at all. In this case, the user moves the pointer in the head on the key image and moves the pointer in the head together with the direction key to the key coordinate. In other words, when the images move, they move together, and when they do not move, they move together so that the other person who sees from the side does not know which image is manipulated.

7 shows an embodiment of a non-responsive screen with respect to a direction key manipulation.

In the embodiment of Fig. 7, if the passing rule starts from the key image,

The high key image, the transit coordinate image, and the final coordinate image are the beer, the soccer ball, and the television, respectively.

If you say, the memorized sentence may be "to watch a soccer game while drinking beer," and in the example shown in Figure 7, a soccer ball down one cell in beer, television in the soccer ball two spaces up and one up Because it is a column, the total operation process is "one down key, one enter key, two right keys and one up key, enter".

The following is a description of an embodiment of a personalized set for phishing.

The description of the personalization set will be described assuming the case of FIG.

The method as shown in Figure 7 has the advantage of implementing a personalized set for phishing. In other words,

To ensure that sets that need to pass through are registered differently for each individual,

By making a fake set, it is impossible to know the key image and passing points of others.

All.

8 is an example of a setting screen for making a personalized set.

As you can see in Figure 8, you can see yourself in much more images than the 16

The key image and the passing coordinate image of the evenly, as shown in Figure 7 including the selected image

When you create a personalized set, you create a fake set that contains an image of that person 3

It becomes difficult to include all the dogs.

Choose 3 out of 36, as shown in Figure 8, the remaining 13 randomly selected to personalize

Assuming a set is created, choosing 16 out of 36 images

The probability of including all three specific images is only 7.8%. That is, pass a fake set

The probability of stealing the person's key is 7.8%. If 100 already

If you choose to choose from, the probability is even smaller, falling to 0.3%.

In addition, the personalized set uploads user-created images to support unique sets

It is obvious that it can also be implemented.

It also steals your personalization set in advance and then uses the same fake personalization set to phish

To prevent attacks, try to view personalization sets but not pass them.

Also sending an alarm message to an individual is more effective. Personalized set of alarm messages

Contains an advisory stating that changing the keys might be a good idea

You will.

Next, we have an image capture function to sneak out the personalization set just described.

A fake site for phishing to install personalized sets obtained by secretly installing KingTools on someone else's computer

It is a method to prevent stealing keys by applying to. Cap with capture prevention technology

In the case of some hacking tools that can prevent them,

Way.

10 is an example of a user profile table for an authentication service according to the present invention.

The scanning computer information 14 is recorded here for each user.

11 is an example of an interface for computer registration for injection in accordance with the present invention.

When the personalization set according to the present invention is executed online, it is possible that a particular set in the user's computer is used.

Recognition information 14, for example, it is recognized as a MAC address of the LAN card, or using a cookie,

A computer that can recognize your computer and is not recorded in your user profile.

If it is recognized as the data, the alarm message is sent to the contact point 15 designated by the user, as shown in FIG.

Provides an interface for registering computers for injection so that users can take action as needed.

Induce to help.

The alarm message indicates that there was an authentication attempt on a computer that is not registered by the user.

To prepare for hacking of personal information.

In addition, the interface for registering the injection computer is a computer that is currently in use by the user.

It provides an interface to register a computer as an injection computer.

A registered computer is recognized as a user's injection computer and is not a registered computer.

It is treated differently from the site.

The difference between a user's injection computer and an unfamiliar computer is that

Key is set differently. For example, used in injection computers

Set the key 12 and the key 13 used in a strange computer completely differently,

The computer allows all keys to pass through and the injection computer passes only some of the keys through.

Can be. That is, even if the phishing computer is subjected to phishing, only the computer key 12 for the injection is kept.

The attacker who has to enter the key (13) for an unfamiliar computer is theft.

It is difficult.

In addition, the method for confirming the differential key for each computer used described above, the present invention

It is not only effective for authentication by coordinate input by.

Authentication by suffices is enough to prevent theft from unfamiliar computers. That is, the password

Is 8 digits, check all 8 digits on an unfamiliar computer and 4 digits on an injection computer.

If you apply it only to prevent leaking passwords,

It can be.

Another method is to identify the different keys for each computer you use. Another way to do this is to omit the password in text on the scanning computer. This method is different from the widely used password remembering function. If you save the password on a computer, the stored information may be exposed to hackers, but this method does not receive a password at all. In other words, if the ID entered in the login box is input from the computer for injection of the corresponding ID, even if the password is not entered, the process passes through the login process, and then immediately proceeds to the authentication step by the coordinate input according to the present invention. will be. When a login box appears on the screen, a program created by ActiveX, etc., reads certain unique information of the user's computer and can be prepared to check before entering the ID.

This method eliminates the inconvenience that the existing password storage function has been invaded by privacy because there is an authentication procedure by inputting the coordinates without confirming the password, and also increases the steps of the authentication procedure due to the authentication process by inputting the coordinates. It also eliminates the need to enter a password on your computer at all times, so it is completely protected against keylogger programs and phishing attacks.

When the present invention described above is applied to a secure access service, it is apparent that there is a sufficient hacking prevention effect even if the connection location tracking step is omitted, and the security effect is sufficient even without going through a double authentication step. have.

The following is applied to the devices such as mobile phones, door locks, safes, etc.

This is a description of how you can make it work.

Cell phone and door lock safe are among many people like service and bank on the Internet

You don't need to know who you are at, so you don't have to check your ID / PW separately.

Therefore, there is less need to proceed with each of the first and second authentication steps described above. Also, this

Some devices have a keyboard that is not a full keyboard, such as a computer keyboard, but a compact keyboard.

On these keyboards, numbers are easy to enter but inconvenient to enter characters.

many. That's why passwords on these devices are usually numeric only. Then

Naturally, the bandwidth of the password is too narrow. Moreover, the numbers don't mean anything

Looking for a meaningful number to memorize

The number is written, which has the disadvantage of being easy to guess.

9 is a built-in embodiment applied to the mobile phone.

As shown in Fig. 9, the text password is first input, and the coordinates are immediately performed without checking it.

When the coordinate input is completed by presenting the image table for authentication, enter the text password and coordinates.

If you check all at once and decide whether to pass, even if you use only 4 digit password

If the number of cases is 10,000, the rule of two-point passing in the 16 image table

210 numbers are multiplied rather than simply added

Will be. This can take an hour to figure out a numeric password

Even if you have seven hours, it means you can find them all month long.

To do this, without text and coordinate input checking in between,

Then program it to treat it as passed only if both match.

Just do it.

The built-in type described above is also very useful in the case of door locks, simply the band of passwords.

Not only is it wider, but it can also be used as an ID for access personnel.

Is there. That is, in the existing number key, all members use only one key.

Uh, it's a hassle to inform all members of the new password.

In many cases, it is used without changing it.

If you register, each member can manage their own key separately,

The office door is wider because the band is wide enough for the members to share.

Can be used safely in the lock. Furthermore, you can manage access records for each member.

There is also an advantage.

In addition, when applied to door locks with advanced technologies such as electronic chips and biometrics,

You can't drop the level down to the safe level of the number key that you provide as a secondary key.

As can be seen from the above, the present invention has excellent security effect of the login information on any computer regardless of whether or not the security program is installed, and excellent security as the door lock device, and excellent effect of preventing the authentication attempt by others. For phishing

Excellent security and widen password range even in small keypads such as mobile phones

Is effective, and in the case of an emergency, it can be reported safely.

1 is a main flow diagram of the present invention.

2 is an example of clicking an image.

3 is an example of reporting a past access record when logging in.

4A and 4B illustrate still another embodiment of an authentication method based on coordinate input.

5 is an embodiment in which numbers are displayed for each coordinate instead of the coordinate notation.

6A and 6B illustrate another embodiment of an authentication method using coordinate input.

7 is an embodiment of a non-responsive screen with respect to a direction key manipulation.

8 is an example of a setting screen for making a personalized set.

9 is a built-in embodiment applied to the mobile phone.

10 is an example of a user profile table for an authentication service according to the present invention.

11 is an example of an interface for computer registration for injection in accordance with the present invention.

Claims (23)

In the method of processing member login in online service, An authentication step by text input; Connection location tracking step; An authentication step by inputting coordinates; Access log report step; Secure access service method comprising a. The method of claim 1, The access location tracking step is performed between the two authentication steps. The method of claim 1, The access history report step, If the user attempts another connection while the user is already connected, the accessor's location acquired in the connection location tracking step is compared with the currently logged in connection location. Report the connection location of the person currently trying to connect to the screen, If it is not a redundant access, secure access service method characterized in that the location information of the acquired accessor is always reported to the user at the next login. The method of claim 1, The access history report step, If the authentication step fails by inputting the coordinates, the message means specified by the user Security access service method characterized in that the alarm message is sent immediately. In the method of processing member login in online service, An authentication step by text input; An authentication step by inputting coordinates; Secure access service method comprising a. The method according to claim 1, wherein The authentication step by inputting the coordinates, Transmitting an image table created by randomly mixing a key image with a plurality of other images to a user's screen; and Operating all images simultaneously with the same value according to an operation value of a user's keyboard or mouse; and Confirming the position manipulation of the key image; And if the coordinates of the location operation are determined and the key coordinates predetermined by the user coincide with each other, pass the authentication, and if not, process the pass as authentication. The method of claim 6, The key coordinates, Secure access service method characterized in that the seat is designated using the second key image. The method of claim 7, wherein If the first key image via the position specified by the booby-trap key image by the user's operation, the authentication failure is processed, and further comprising the step of transmitting an appropriate alarm message to the user of the user of the user's PC or ID Secure access service method. The method of claim 7, wherein When the user locates the first key image in the designated position of the report key image and confirms the operation, the user passes the authentication, and the security access service method further comprises the step of automatically reporting through the security system. . In the authentication method of the user, Transmitting an image table created by randomly mixing a key image with a plurality of other images to a user's screen; and Operating all images simultaneously with the same value according to an operation value of a user's keyboard or mouse; and Confirming the position manipulation of the key image; And an authentication processing step of passing the authentication if the coordinates of which the position operation is determined and the key coordinates predetermined by the user match, and failing to pass the authentication if they do not match. The method of claim 10, The key coordinates, Safety authentication method characterized in that the seat is designated using the second key image. The method of claim 11, If the first key image via the position specified by the booby-trap key image by the user's operation, the authentication failure is processed, and further comprising the step of transmitting an appropriate alarm message to the user of the user of the user's PC or ID Safety certification method. The method of claim 11, When the user locates the first key image in the designated position of the report key image and confirms the operation, the user passes the authentication, and the safety certification further includes the step of automatically being reported through the security system. Way. The method according to claim 1, wherein Individuals whose image details of the image table provided are registered differently for each user Safety certification method characterized in that it further comprises a registration image table. The method of claim 14, Registering the personalized image table, In a much larger group of images than the number of images required for a personalized image table Key image and transit coordinate image or destination coordinate image are selected by user Step; Pick up as many images as you need to complete the image table, Randomly extracting a server from the remaining images except for the images; and The image selected by the user and the image selected by the server Registering a personalized image table; Safety authentication method characterized in that consisting of. The method according to claim 10, wherein Inputting a text password; In the authentication processing step, whether the text password and key coordinates match is text ratio. Authentication only after both password and key coordinate input are completed Treated as passing through and failing to pass if none match Processing as; Safety authentication method characterized in that. The method according to claims 1 to 9 and 14 to 15, The user has different key coordinates for an injection computer A key coordinate registration step of providing an interface and registering the input information; A terminal information acquisition step of acquiring recognition information of the user's computer; and For injection as user computer identification information obtained in the terminal information acquisition step Terminal recognition step of judging the computer and the stranger computer; And, If it is determined that the computer is unfamiliar in the terminal recognition step, register the computer information. Provide an injection computer registration interface that can be registered with an injection computer. Scanning computer registration step of registering the recorded information; And, If it is determined that the computer is unfamiliar in the terminal recognition step, regardless of the authentication result Further comprising: a strange computer alarm step of notifying the user of the alarm message, In the authentication step by inputting the coordinates, the coordinates of which the position operation is confirmed and the user Check whether the predetermined key coordinates match, but in the terminal recognition step to the injection computer If judged, check the key coordinates for the injection computer. Safety authentication method characterized by checking the key coordinates for the computer. The method of claim 17, Allow at least two key coordinates, but check all key coordinates on unfamiliar computers. In the injection computer, only a part of the safety certification Way. In the method of authenticating a user, A user enters a password for an injectable computer and a password for an unfamiliar computer. Providing an interface to correctly determine and storing the input information; and A terminal information acquisition step of acquiring recognition information of the user's computer; and For injection as user computer identification information obtained in the terminal information acquisition step Terminal recognition step of judging the computer and the stranger computer; And, If it is determined that the computer is unfamiliar in the terminal recognition step, register the computer information. Note that provides a computer registration interface for injection that can be registered with a computer for injection. Use computer registration step; The injection computer if it is determined that the injection computer is in the terminal recognition step; Password for the foreign computer, if it is determined that the stranger computer password Authentication processing step of confirming; safety authentication method comprising the. The method of claim 19, Provide an interface for users to register their contacts for notification of alarm messages. Storing the input information; and If it is determined that the computer is unfamiliar in the terminal recognition step, regardless of the authentication result Unfamiliar computer alarm step of notifying the alarm message to the contact; further comprises Safety certification method. In the method of authenticating a user online, A user computer registration process of recording computer information in a user profile in association with a user's ID as a computer for scanning the user; and Computer information acquisition process for the authentication server to obtain the computer information of the user; And, Login information input process for receiving an ID and password from the user's computer; And, If the ID received in the login information input process matches the terminal registered in the user profile, the login process passes through the login even if the password is not input. And a user verification process for providing a user verification procedure to the user who has passed the login process. The method of claim 21, The identity verification process is a safety login method characterized in that the authentication process by the coordinate input. The method of claim 22, IP tracking process to obtain the access IP address of the user; And, And an alarm process for notifying the user of the ID of the alarm message if the identity fails to pass in the identity verification process.