KR20070084801A - Creating and authenticating one time password using smartcard and the smartcard therefor - Google Patents

Abstract

A method for generating and authenticating an OTP with a smart card, and the smart card thereof are provided to reduce a scale and a construction cost of a system for generating/authenticating the OTP by implementing a function related to generation of the OTP in the smart card as a program. A security service terminal of a user requests a security service by connecting and logging in to a host server through the wired/wireless network(S301). The security service terminal receives an input request message including information required for the security service from the host server(S303). A terminal transmits the first OTP generation request and personal ID information received from the user to the smart card(S311). The smart card generates the first OTP with an OTP generation algorithm and transmits the first OTP to the terminal after authenticating the personal ID information(S317). The security service terminal receives the first OTP from the user and transmits the first OTP to the host server(S321). The host server authenticates the first OTP.

Description

One-time password generation and authentication method using smart card and smart card for it {CREATING AND AUTHENTICATING ONE TIME PASSWORD USING SMARTCARD AND THE SMARTCARD THEREFOR}

1 is a block diagram showing a system for one-time password generation and authentication using a smart card according to a first embodiment of the present invention.

2 is a schematic structural diagram illustrating an OTP application according to the present invention.

3 is a flowchart illustrating a first method of generating and authenticating a one-time password according to the present invention;

4 is a flow chart illustrating a second method of one-time password generation and authentication according to the present invention;

<Description of Symbols for Main Parts of Drawings>

SC: Smart Card T: Terminal for Security Service

100: terminal M: connection module

200: host server 210: member DB

HSM: Hardware Security Module

The present invention relates to a one-time password generation and authentication method using a smart card and a smart card therefor.

As a user identification and authentication method in various content servers through a wired / wireless information communication network (Internet network), an ID / password method is mainly used. In this case, in order to prevent ID / password theft, the ID / password input on the corresponding terminal is displayed in the form of '********' rather than the actual input information. However, the security processing method has a fatal problem that in case of a terminal where a hacking program (eg, 'phishing') is installed by a fraudulent user, an ID / password input by the user may be transmitted to the fraudulent user in real time.

That is, since a predetermined password (large number of random numbers) can be repeatedly used, there is a risk that it will be used for an illegal purpose by an unauthorized user who has obtained an ID / password through hacking. Therefore, if you need to maintain a high level of security, there is a need to apply a one-time ID / password that can not be used repeatedly.

In recent years, various services that require strict security, such as electronic banking and electronic payment, have been made. Accordingly, users can set a rather complicated password or obtain a certificate from a bank or an accredited certification authority to use these services. This service can be used only after passing through the identification process several times through a card including a predetermined password (large number of random numbers). Of course, such a series of identity verification process provides a positive effect to the user in terms of personal information verification, but the process was rather complicated and there was an inconvenience in using the service.

Recently, a one-time password system using a time synchronization method, a CHALLENGE / RESPONSE method, or a host random number input method has been widely adopted as a security solution that frequently changes a password when a user requests authentication. Specifically, the one-time password system has the advantage that even if the password is inadvertently leaked, the number of times the password can be used is limited to only one time and cannot be reused by malicious others. Because of these unique advantages, they have been in the spotlight from electronic banking, electronic payment, and various content providers.

In relation to the one-time password system described above, a number of applications and registrations other than the Republic of Korea Patent Publication No. 10-2004-0000078 (name of the invention: one-time password system and method) (hereinafter referred to as 'prior patent') to be.

More specifically, the preceding patent is a base station for wireless section communication with a mobile communication terminal, a base station controller for controlling the base station, a packet data service node and a data core network connected to the base station controller to provide a packet data service Is connected to the data core network of the mobile communication system configured to include, the mobile communication terminal by issuing a one-time password for authentication at the CP (Contents Provider) server accessible through the data core network to the mobile communication terminal An OTP server comprising: an OTP server, the OTP server comprising: a random number generator for generating a time-synchronized random number generated by setting time as an initial value every predetermined time; An OTP generation unit for generating an OTP by using the time-synchronized random number generated by the random number generator and personal identification information when a request for issuance of an OTP is requested from a mobile communication terminal; And an OTP transmitter for transmitting the generated OTP and random number generation time information to the mobile communication terminal. It is configured to include, characterized in that the mobile communication terminal to use the CP server using the OTP received from the OTP server.

However, in the prior patent as described above, the OTP server for generating a one-time password must be provided separately, there is a problem that the system is enlarged and the cost required to build the system increases.

On the other hand, an electronic calculator-type portable terminal in which a one-time password generation function is implemented has been released, but it is also cumbersome because it must be individually carried, and it is also relatively expensive and inconvenient to use.

The present invention has been made to solve the above problems, by implementing a function related to the one-time password generation on the smart card, reducing the size of the system for the one-time password generation and authentication, it is necessary to build the system It is a characteristic purpose to provide a one-time password generation and authentication method using a smart card that can reduce the cost, and a smart card for this.

The first method for generating and authenticating a one-time password using a smart card according to the present invention,

(a) requesting a security service after a user's security service terminal accesses and logs in to a host server through a wired or wireless network; (b) receiving, by the security service terminal, an input request message including predetermined request information for the security service from a host server; (c) receiving, by the terminal, the first OTP generation request and the personal identification information from the user and transmitting the received OTP to the smart card; (d) generating, by the smart card, the first OTP using a preset one-time password generation algorithm after authenticity authentication of the personal identification information and transmitting the generated first OTP to the terminal; (e) receiving, by the security service terminal, request information including the first OTP, basic information, and other information from the user and transmitting the request information to the host server; (f) a host server generating a second OTP using response information corresponding to the request information, and comparing and determining whether the host server is the same as the first OTP; (g) If it is determined that the first OTP and the second OTP are the same, the host server authorizes the security service terminal to receive the security service procedure, and then transmits a predetermined result screen or message to the security service terminal. If not, the host server transmits a predetermined failure screen or message to the security service terminal; It consists of.

On the other hand, the one-time password generation and authentication second method using a smart card according to the present invention,

(a) requesting a security service after a user's security service terminal accesses and logs in to a host server through a wired or wireless network; (b) receiving, by the security service terminal, an input request message including predetermined request information for the security service from a host server; (c) receiving, by the terminal, the first OTP generation request, the personal identification information, and a security value based on a preset relation table from the user and transmitting the received OTP to the smart card; (d) generating, by the smart card, the first OTP using a one-time password generation algorithm and transmitting the first OTP to the terminal with the initial value of the security value according to the relationship table after validating the personal identification information; (e) receiving, by the security service terminal, request information including the first OTP, basic information, and other information from the user and transmitting the request information to the host server; (f) a host server generating a second OTP using response information corresponding to the request information, and comparing and determining whether the host server is the same as the first OTP; (g) If it is determined that the first OTP and the second OTP are the same, the host server authorizes the security service terminal to receive the security service procedure, and then transmits a predetermined result screen or message to the security service terminal. If not, the host server transmits a predetermined failure screen or message to the security service terminal; It consists of.

On the other hand, the present invention is a member DB that stores the member information of a terminal user having a smart card for generating a one-time password, a terminal for security services (T), and the smart card for generating a one-time password; (210), when the security service terminal connected through the wired or wireless network (N) requests a security service, and transmits the request information generated based on the member information to the terminal, while the security service The host server 200 performs authentication on the one-time password transmitted from the terminal.

In the smart card (SC) connected to the terminal 100 of the system to generate a one-time password, receiving the response information corresponding to the request information from the user to generate a one-time password by using this as an initial value An OTP application or an OTP application for generating a one-time password using a preset one-time password generation algorithm may be included.

Referring to FIG. 1, a system for generating and authenticating a one-time password using a smart card according to a first embodiment of the present invention (hereinafter, referred to as a “first system”) may include a smart card (SC), The terminal 100, the host server 200, and a security service terminal T are configured to be included.

The smart card SC is a contact type, contact-less type or hybrid type smart card, and is used to generate a one-time password (hereinafter referred to as 'OTP') that is executed internally. Related application (hereinafter, referred to as 'OTP application').

More specifically, as shown in FIG. 2, the OTP application basically includes application information including an OTP generation algorithm 10 for generating the first OTP and personal identification information 20 for access authentication of the OTP application. It is included. In other words, the OTP generation algorithm 10 may be set differently for each OTP application, and is an algorithm for generating a first OTP to be described below. Here, the OPT generation algorithm may be an algorithm in which a predetermined secret key encryption method including a hashing algorithm is implemented, and the encryption method may be variously set including DES, T-DES, and ARIA. . The personal identification information 20 may be set to biometric information such as PIN information (Personal Identification Number) or fingerprint information.

In addition, the OTP generation algorithm may generate a one-time password by using a predetermined security value input from the user as an initial value, and, upon request of the user, an original preset password without setting the predetermined security value as an initial value. It is also possible to generate a one-time password by itself using only the time password generation algorithm.

The security value may be information related to the request information in a tabular form, or a specific value (response information, a predetermined number of digits / characters) that can be associated with a user. For example, it may be a card-shaped table (hereinafter referred to as a "relation table") consisting of a plurality of indices INDEX and response information corresponding to the indexes. Such a relationship table is issued to the user with the smart card (SC), it is preferable to be included in the data state in the following member information.

On the other hand, the terminal 100 can be assumed to be a terminal, including a normal user computer and PDA equipped with a connection module (M) to accommodate the smart card (SC) detachably and to read and write data of the smart card. It performs a function of transmitting the personal identification information 20 input or received from the user or the security service terminal (T) to the smart card (SC). In addition, when authentication for the personal identification information 20 is normally performed in the smart card (SC) provided at one side, the user receives the first OTP generated by the smart card for one-time password generation from the smart card (SC) Alternatively, a user (security service terminal) who displays (transmits) a series of input screens or messages related to the one-time password generation by the one-time password generation smart card, such as displaying or transmitting to a security service terminal, confirms this. It performs a function to input (send) a one-time password to the security service terminal (T).

In addition, the terminal 100 is a wired / wireless communication port capable of connecting a wired / wireless network (short-range wireless LAN (Bluetooth) or IrFM, RF, GSM, CDMA, etc.) for transmitting and receiving information with the terminal (T) for security services. It can be further provided.

On the other hand, the security service terminal (T) can be assumed as a communication terminal, such as a normal user computer and PDA that can be connected to the wired / wireless network (Network, N), the host server described below in accordance with an aspect of the present invention When requesting the security service to the 200, an input screen or message (request information, etc.) related to the security service transmitted from the host server 200 is displayed (transmitted) to the user or the terminal 100, and the smart card (SC) Receives (receives) the first OTP and the unique information 30 generated by the one-time password generation algorithm from the user or the terminal 100 and transmits the basic information and / or other information to the host server 200 below. It performs the function.

In other words, the basic information is the user's account information, other information is payment information related to the amount, and the request information is randomized information generated by the host server 200 based on the following member information, the user Information that can be estimated. For example, the information may be variously set such as an account number, a social security number, a credit card number, or a phone number.

The request information may be information related to the response information in a tabular format. For example, it may be a card-shaped table (hereinafter referred to as "relation table") consisting of a plurality of indexes INDEX as the request information and numbers / letters having a predetermined number of digits as response information corresponding to the index. Such a relationship table is issued to the user with the smart card (SC), it is preferable to be included in the data state in the following member information.

In addition, the host server 200 is a server of a financial institution, for example, a bank, which the user wants to access through a wired or wireless network (N), issues a smart card (SC) to the user and checks the balance from an account opened in the bank, Provides services requiring security such as payment or transfer (hereinafter referred to as 'security service'). In this case, as in the general Internet banking service, it is preferable that a user registration or login (Log IN) procedure is performed between the user and the bank, and the information for logging in and the application information of the issued smart card (SC) are members. The information is collected and stored in the member DB 210.

After receiving the first OTP from the security service terminal T, after finding the request information or response information from the member information previously stored in the member DB 210 and generating the second OTP with the initial value, The first OTP is compared with the second OTP to determine the validity of the first OTP, and if this is valid, the security service terminal T is authorized to receive the security service procedure.

Meanwhile, the host server 200 according to an aspect of the present invention may further include a hardware security module (HSM) dedicated to a series of OPT validity determination procedures as described above.

Hereinafter, the one-time password generation and authentication method through the first system and the second system of the present invention having the above-described characteristic configurations and functions will be described in detail with reference to FIGS. 3 and 4.

First, referring to FIG. 3, after the user's security service terminal T accesses and logs in to the host server 200 through the wired / wireless network N (S301), the host server 200 requests a security service. In operation S303, an input request message including predetermined request information for a security service is received. Here, before the step S301, a series of member registration procedures including a smart card (SC) is issued between the user and the host server 200. The input request message of the step S303 includes the host server as described above. Request information transmitted from 200 is included.

Subsequently, the terminal 100 receives the first OTP generation request S305 and the personal identification information 20 (eg, a PIN) from the user (S307 and S309), and transmits them to the smart card SC (S311). As described above, authentication for the personal identification information 20 is made through the smart card SC operating according to the OTP application (S313), and if the legitimacy for the personal identification information 20 is authenticated, the smart card (SC). After generating the first OTP by using a preset one-time password generation algorithm (S315) and transmits to the terminal 100 (S317). Subsequently, the terminal 100 receiving the first OTP displays the first OTP to the user.

Thereafter, the security service terminal T receives the request information including the first OTP, basic information, and other information displayed on the terminal 100 from the user (S319) and transmits it to the host server 200 (S321). The host server 200 receives the received response information corresponding to the request information of step S303 from the member DB 210 to generate a second OTP (S323), and generates the generated second OTP and the first. It is determined whether or not the OTP is the same (S325, S327). Here, the second OTP is generated through the same algorithm as the OTP generation algorithm used in the smart card (SC).

In the present embodiment, the OTP generation algorithm may be set differently for each smart card (SC), but the request information of step S303 and the response information of step S323 are the member information provided by the host server 200 in the member DB 210. Based on the same OTP generation algorithm can be set.

Subsequently, as a result of the determination in step S327, if the first OTP and the second OTP are the same, the host server 200 authorizes the security service terminal T to be provided with the security service procedure (S329), and accordingly, the predetermined OTP. The result screen or message is transmitted to the security service terminal T (S331). On the other hand, as a result of the determination in step S327, if not the host server 200 transmits a predetermined failure screen or message to the security service terminal (T) (S333).

On the other hand, as another embodiment of the first system of the present invention having the above-described characteristic configuration and function,

After the user's security service terminal T accesses and logs in to the host server 200 through the wired / wireless network N (S301), when a security service is requested, a predetermined request for security service from the host server 200 is requested. An input request message including the information is received (S303). Here, before the step S301, a series of member registration procedures including a smart card (SC) is issued between the user and the host server 200, and the input request message of the step S303 includes the host server (as described above). Request information transmitted from 200) is included.

Subsequently, the terminal 100 receives the first OTP generation request S305 and the personal identification information 20 (eg, a PIN) from the security service terminal T connected to the wired / wireless network (S307 and S309). Transmitting to the smart card (SC) (S311), through the smart card (SC) operating according to the OTP application as described above is authenticated for the personal identification information 20 (S313), the personal identification information ( If the legitimacy of 20) is verified, the smart card SC generates the first OTP using a preset one-time password generation algorithm (S315) and transmits the generated first OTP to the terminal 100 (S317).

Then, the security service terminal (T) receives the first OTP from the terminal 100 connected to the wired / wireless network (S319) to the host server 200 to request information including basic information, other information, and the like. The host server 200 receives the response information corresponding to the request information of the step S303 from the member DB 210 and generates a second OTP (S323). It is determined whether the 2 OTP and the first OTP are the same (S325, S327). Here, the second OTP is generated through the same algorithm as the OTP generation algorithm used in the smart card (SC).

In the present embodiment, the wired / wireless network applied when transmitting and receiving information between the security service terminal (T) and the terminal 100 is not only a wired network, but also a short-range wireless LAN (Bluetooth), or a wireless network such as IrFM, RF, GSM, CDMA, or the like. Applicable as

The OTP generation algorithm may be set differently for each smart card (SC), but the request information in step S303 and the response information in step S323 are based on the member information provided by the host server 200 in the member DB 210. The same OTP generation algorithm can be set.

Subsequently, if the determination result of step S327 is the same as the first OTP and the second OTP, the host server 200 authorizes the security service terminal T to be provided with the security service procedure (S329), and accordingly a predetermined result. The screen or message is transmitted to the security service terminal (T) (S331). On the other hand, as a result of the determination in step S327, if not the host server 200 transmits a predetermined failure screen or message to the security service terminal (T) (S333).

Meanwhile, referring to FIG. 4, after the user's security service terminal T accesses and logs in to the host server 200 through the wired / wireless network N (S401), the host server 200 requests a security service. In operation S403, an input request message including predetermined request information for a security service is received. Here, before the step S401, a series of registration procedures including a smart card (SC) is issued between the user and the host server 200, and the input request message of the step S403 includes the host server (as described above). Request information transmitted from 200) is included.

Subsequently, the terminal 100 receives a first OTP generation request (S405), personal identification information 20 (eg, a PIN), and a security value based on a preset relation table from the user (S407, S409), and receives a smart card (SC). In step (S411), as described above, the authentication for the personal identification information 20 is made through the smart card (SC) operating according to the OTP application (S413), for the personal identification information 20 If the legitimacy is verified, the smart card SC generates the first OTP using the one-time password generation algorithm using the security value based on the relation table as an initial value (S415) and transmits it to the terminal 100 (S417).

Here, the security value may be information associated with the request information in a tabular form, or a specific value that may be associated with a user. For example, it may be a card-shaped table (hereinafter referred to as a "relation table") consisting of a plurality of indices INDEX and response information corresponding to the indexes. Such a relationship table is issued to the user with the smart card (SC), it is preferable to be included in the data state in the following member information.

Then, the security service terminal (T) receives the request information including the first OTP, basic information, and other information displayed on the terminal 100 from the user (S419) and transmits to the host server 200 (S421). The host server 200 receives the response information corresponding to the request information of step S403 from the member DB 210 to generate a second OTP (S423), and generates the generated second OTP and the first. It is determined whether or not the OTP is the same (S425, S427). Here, the second OTP is generated through the same algorithm as the OTP generation algorithm used in the smart card (SC).

In the present embodiment, the OTP generation algorithm may be set differently for each smart card (SC), but the request information of step S403 and the response information of step S423 include the member information provided by the host server 200 in the member DB 210. Based on the same OTP generation algorithm can be set.

Subsequently, as a result of the determination in step S427, if the first OTP and the second OTP are the same, the host server 200 authorizes the security service terminal T to be provided with the security service procedure (S429), and accordingly a predetermined result. The screen or message is transmitted to the security service terminal (T) (S431). On the other hand, as a result of the determination in step S427, if not the host server 200 transmits a predetermined failure screen or message to the security service terminal (T) (S433).

As described above and described with reference to a preferred embodiment for illustrating the technical idea of the present invention, the present invention is not limited to the configuration and operation as shown and described as described above, it is a deviation from the scope of the technical idea It will be understood by those skilled in the art that many modifications and variations can be made to the invention without departing from the scope of the invention. Accordingly, all such suitable changes and modifications and equivalents should be considered to be within the scope of the present invention.

According to the present invention discussed through the first and second embodiments, the function related to the one-time password generation is implemented in the smart card as a program, and thus the one-time password generation and the authentication process for the security service are conventionally performed. Compared to the above, the size and size of the system are reduced.

In addition, the smart card according to the characteristic aspect of the present invention can be easily connected or adopted to a mobile communication terminal or a computer, it is not necessary to separately provide an expensive portable terminal.

Claims (14)

A smart card (SC) having a one-time password (OTP) generation function implemented in a program format, a terminal for a user connected to the smart card 100, a terminal for a security service connected to a host server 200 via a wired or wireless network (T) ), Having a member DB 210 for storing the user's member information and providing a predetermined security service to the security service terminal T through a wired / wireless network N, and generated by a smart card SC. In the one-time password generation and authentication method of a system consisting of a host server 200 for performing authentication on the old one-time password, (a) requesting a security service after the user's security service terminal T accesses and logs in to the host server 200 through a wired or wireless network; (b) receiving, by the security service terminal T, an input request message including predetermined request information for the security service from the host server 200; (c) the terminal 100 receiving a first OTP generation request and personal identification information from a user and transmitting the received information to a smart card (SC); (d) generating, by the smart card SC, a first OTP using a preset one-time password generation algorithm after validating authentication of personal identification information and transmitting the generated first OTP to the terminal 100; (e) receiving the first OTP from the user by the security service terminal (T) and transmitting it to the host server 200; (f) the host server 200 performing authentication on the one-time password; One time password generation and authentication method using a smart card, characterized in that the security service is provided to the security service terminal (T). The method of claim 1, Step (c) to step (e), (c) the terminal 100 receiving the first OTP generation request and the personal identification information from the security service terminal T and transmitting the received smart card to the smart card SC; (d) generating, by the smart card SC, a first OTP using a preset one-time password generation algorithm after validating authentication of personal identification information and transmitting the generated first OTP to the terminal 100; (e) receiving, by the security service terminal T, the first OTP from the terminal 100 and transmitting it to the host server 200; One-time password generation and authentication method using a smart card, characterized in that replaced by. The method of claim 1, Step (c) to step (d), (c) the terminal 100 receiving a first OTP generation request, a personal identification information, and a security value based on a predetermined relationship table from a user and transmitting the received OTP to a smart card (SC); (d) the smart card SC generates a first OTP using a one-time password generation algorithm and transmits the first OTP to the terminal 100 by using the security value according to the relation table as an initial value after the validity of the personal identification information is authenticated. ; One-time password generation and authentication method using a smart card, characterized in that replaced by. The method of claim 1, Step (c) to step (e), (c) the terminal 100 receiving a first OTP generation request, personal identification information, and a security value based on a predetermined relationship table from the security service terminal T and transmitting the received security value to the smart card SC; (d) the smart card SC generates a first OTP using a one-time password generation algorithm and transmits the first OTP to the terminal 100 by using the security value according to the relation table as an initial value after the validity of the personal identification information is authenticated. ; (e) receiving, by the security service terminal T, the first OTP from the terminal 100 and transmitting it to the host server 200; One-time password generation and authentication method using a smart card, characterized in that replaced by. The method according to claim 3 to 4, The relationship table, One-time password using a smart card, characterized in that a card-shaped table consisting of a number of indexes as the request information and numbers / letters having a predetermined number of digits as response information corresponding to the index, and included in the information in the member information. Creation and authentication method. The method according to claim 3 to 4, The security value is, A method for generating and authenticating a one-time password using a smart card, wherein the response information can be derived from a relation table, or a response number reminiscent of a user is a number of digits or letters. The method of claim 1, The authentication of step (f) is One-time password using the smart card, characterized in that the host server 200 compares the one-time password generated by the member information as an initial value with the one-time password transmitted from the security service terminal (T). Creation and authentication method. The method of claim 1, The personal identification information, One-time password generation and authentication method using a smart card, characterized in that the PIN information or biometric information. The method of claim 1, The request information, One-time password generation and authentication method using a smart card, characterized in that the user information generated by the host server based on the member information can be estimated. The method of claim 1, The step (e) is The one-time password generation and authentication method using a smart card, wherein the security service terminal (T) receives basic information and other information from a user and transmits the basic information and other information to the host server 200 together with the one-time password. And a member DB 210 in which the user information of the user is stored, and when the security service terminal T connected through the wired / wireless network N requests a security service, request information generated based on the member information. It is connected to the terminal 100 of the system consisting of a host server 200 which transmits to the security service terminal T, and performs authentication on the one-time password transmitted from the security service terminal T. In the smart card (SC) which performs time password generation, And an OTP application for generating a one-time password corresponding to the request information. The method of claim 11, The OTP application, Smart card for one-time password generation, characterized in that it comprises the application information consisting of OTP generation algorithm (10), personal identification information (20) for access authentication of the OTP application. The method of claim 12, The personal identification information 20, Smart card for one-time password generation, characterized in that the PIN information or biometric information. The method of claim 12, The OTP generation algorithm 10, Smart card for generating a one-time password, characterized in that the one-time password is generated by using a predetermined security value input from the user as an initial value or the one-time password is generated by a preset one-time password generation algorithm.

Images