KR20080013234A - Method of certification using portable memory device - Google Patents

Abstract

An authentication method using a portable storage device is provided to perform automatic connection to a sever and an authentication process by using a portable storage device, thereby enhancing security and user convenience. An authentication method using a portable storage device includes a step of connecting the portable storage unit to an interface of a user computer(S100), a step in which the portable storage unit automatically connects the user computer to a server on a network and attempts log in(S200,S300), and a step of moving a user to a predetermined position on the server based on user information stored in the portable storage unit when log-in authentication is successfully performed(S400,S500). The portable storage unit includes a client module having automatic execution and authentication functions and a memory storing the user information.

Description

Authentication method using portable storage device {Method of certification using portable memory device}

1 schematically shows the configuration of a system for implementing an authentication method using a portable storage device according to the present invention.

2 schematically illustrates a configuration of a portable storage device for implementing an authentication method using the portable storage device according to the present invention.

3 is a general flowchart of an authentication method using a portable storage device according to the present invention.

4 is a flowchart illustrating an attempt to log in using another ID and a corresponding password when a login fails in the authentication method using the portable storage device according to the present invention.

5, 7A, 7B, and 8 to 11 are flowcharts of each configuration of an authentication method using a portable storage device according to the present invention.

6A and 6B illustrate an embodiment in which a security device is mounted on the portable storage device according to the present invention.

<Description of the symbols for the main parts of the drawings>

100: server, 200: internet, 300: user computer, 400: portable storage device,

410: client module, 420: microcontroller, 430: memory,

440: fingerprint reader, 450: keypad

S100 ~ S700: each component code of the flowchart for the authentication method using a portable storage device

The present invention relates to an authentication method using a portable storage device, and more particularly, to an automatic access and authentication method incorporating an automatic access and authentication process to a server using information stored in a portable storage device and enhancing security and convenience. It is about.

In general, the Internet is an open network configured to be freely connected by applying a common protocol called TCP / IP (Transmission Control Protocol / Internet Protocol) to the other computer that anyone wants to access anywhere in the world. Through the development of compression technology, as well as the delivery of multimedia information, it is possible to use a variety of services such as e-mail, file transfer, and the World Wide Web (WWW).

Due to the development of information technology, the Internet has been deeply involved not only in business but also in personal life. Now, high-speed communication network is established in each individual home, and the Internet has become an important part of personal life.

While the development of such Internet technology enriches life, side effects such as personal property damage and invasion of personal privacy caused by the leakage of personal information are problematic.

In response to this, various security technologies have been developed, and as a technology for dismantling the security of information according to existing technologies has been developed by non-experts other than those skilled in the art, specific information can be accessed, viewed, destroyed, duplicated, More advanced security technologies are required to block and protect thefts.

Currently, various authentication methods and devices using USB storage devices have appeared, but even in the case of such methods or devices, if the security of the server is breached by hackers attacking the server, personal information is leaked as it is. It also has a security blind spot where personal information can be leaked, and even if a USB storage device is lost, it can cause greater security damage.

In general, in order to access and work on a specific site, the user must enter the address of the site, access it, and enter his ID and password to log in to be authenticated by the server of the site. In order to do this, you have to go to a page or other linked site in the site, and go through a multi-step process, such as resetting the environment that is appropriate for you. For example, in a portal site or a site serving several kinds of games, a user mainly uses a specific page or a specific game, in which case the user takes several steps to move to a page or game that he or she mainly uses. There is a lot of inefficiency because you have to go through it and set up the environment that suits you every time.

In order to solve the above problems, the present invention proceeds to the automatic connection and authentication process to the server using a portable storage medium, reduce the possibility of leaking the user's ID and password by hacking the user computer, access to the desired server page In order to provide a method for improving efficiency and convenience, the server connection, ID and password input, authentication process, and the process of moving to the corresponding page are performed directly through the portable storage device.

In addition, even if a problem occurs in the server, without affecting the user information, to provide a way to maintain security regardless of the leakage and encryption key or authentication device.

In order to achieve the above object, the present invention comprises the steps of: connecting the portable storage device to the interface (Interface) of the user computer; Automatically connecting the user computer to a server on a network and attempting to log in at the portable storage device; And if the login authentication is successful, moving the user to a predetermined location on the server based on the user information stored in the portable storage device, wherein the portable storage device is a client having an automatic execution and authentication function. A module and a memory for storing user information including a user's ID and password are authentication methods using a portable storage device.

Preferably, the location and environment to be moved on the server when the server is connected to the user is set, the set matters are stored in the memory, and the location on the server based on the set matters when the server is connected later. Location and environment on the server used by the user or counted by the user to calculate the most frequent location and environment, and the location and environment to be moved on the server when the calculated location and environment are connected to the server. And store the set items in the memory and move them to a location on the server based on the set items when the server is connected to the server.

More preferably, based on the information on the user stored in the memory, the user can continue to continue the work that was in progress when the previous connection.

Further, prior to the operation, the server may execute the fortune program based on the user information stored in the memory of the portable storage device, and provide the user with information calculated from the fortune program.

In another aspect, the present invention, the user computer recognizes the moment when the portable storage device is separated from the computer of the user, the user computer transmits the end signal to the server, the server is the end signal The method may further include logging out the user and deleting the user's information left on the server when the is received.

Preferably, the portable storage device is connected to a USB interface of the user computer.

In addition, the memory stores a plurality of user IDs and corresponding passwords, and when logging in to the server fails, log in again with the next user ID and the corresponding password sequentially among the plurality of user IDs stored in the memory. Attempting to further comprise a step.

Further, when a new user subscribes, the client module moves to a new subscription related page on the server after accessing the server, and inputs his or her personal information from the new user on the page. Receiving input to; When the subscription of the new user is completed based on the input personal information, the portable storage device stores the personal information of the new user in a memory mounted in the portable storage device and is associated with the new user on the server. Transmitting a deletion signal for personal information; And deleting, by the server, personal information related to a new user on the server when the delete signal is received.

In addition, the portable storage device periodically receives the personal information about the user from the server and stores the personal information in the memory, and the server transmits the personal information about the user and then stores the personal information about the user stored on the server. The method may further include deleting information.

Preferably, generating / exchanging a one-time encryption key by using a security key already held by the portable storage device and the server; Encrypting and transmitting a communication content between the user computer and the server by using the one-time encryption key; And decrypting, by the user computer and the server, the encrypted communication information using the one-time encryption key.

More preferably, when the portable storage device is connected to the user computer, the security device installed in the portable storage device may be activated to confirm the user. The security device may be operated to confirm the user's confirmation. The method may include receiving a fingerprint from the user through a fingerprint reader installed in the portable storage device, verifying the fingerprint stored in the memory against the received fingerprint, or by using the keypad installed in the portable storage device. The user may receive a number from the user and verify the security device password stored in the memory with the received number.

In addition, when the user computer is connected to the server by the portable storage device, the portable storage device transmits the unique number (S / N) of the portable storage device to the server, and the server transmits the unique number. (S / N) and verifying the unique number (S / N) registered in the server, and when the portable storage device is used for the first time, the portable storage device is unique to the portable storage device The method may further include registering a number S / N to the server.

Hereinafter, an authentication method using a portable storage device according to the present invention will be described in detail with reference to the accompanying drawings.

1 schematically shows the configuration of a system for implementing an authentication method using a portable storage device according to the present invention.

The system for implementing the present invention is composed of a server 100, the Internet network 200, a user computer 300 and a portable storage device (400).

The server 100 provides a web service for a user to perform a task and performs authentication for access authorization to the web service, and the user is an internet network formed between the server 100 and the user computer 300. The communication content is transmitted through the 200. The user computer 300 executes various programs and the like so that the user can perform a task, and accesses the server 100 through the Internet network 200 based on the information stored in the portable storage device 400 to perform the task. In addition, the portable storage device 400 automatically connects to the server 100 and stores an automatic connection, an authentication function, and other user information for allowing the user to be authorized by the server 100. .

Although FIG. 1 illustrates a portable storage device according to the present invention as a USB memory device, this is only one embodiment and may be various slot-type cards or other devices that can be connected to an interface of a user computer. .

Looking at the portable storage device 400 in more detail with reference to Figure 2, the portable storage device 400 is roughly composed of a client module 410, a microcontroller 420 and a memory 430. When the portable storage device 400 is connected to the user computer 300, the client module 410 directly connects the user computer 300 to the preset server 100 without requiring a separate input of the user and the server 100. It includes an automatic execution and authentication function to perform the authentication operation of the user, and includes a UI Tool (User Interface Tool) to easily enter and store the user's ID and password. In addition, the microcontroller 420 controls each component of the portable storage device 300, the memory 430 stores the user's information and outputs the information when necessary.

Then, the authentication method using the portable storage device according to the present invention through the system will be described in detail.

3 is a general flowchart of an authentication method using a portable storage device according to the present invention.

When the user connects the mobile storage device 400 owned by the user to the user computer 300 (S100), the user computer 300 by the automatic execution function of the client module 410 in the mobile storage device 400 ) Is directly connected to the preset server 100 (S200).

When connected to the server 100 attempts to log in to the server 100 by the authentication function of the client module 410 with the user ID and password stored on the memory 430 of the portable storage device 400 (S300). The server 100 performs authentication (S400) by verifying the user's ID and password. When the server 100 is authenticated normally, the server 100 moves to a page or a linked site on the server based on the information stored in the memory 430 of the portable storage device 400, and the page or the site The user can perform the operation (S600).

Further, here, FIG. 4 shows a flowchart of attempting to log in using another ID stored in the memory 430 and a password corresponding thereto in case of a login failure.

The memory 430 stores a plurality of user IDs and passwords corresponding to the plurality of user IDs, and attempts to log in with one ID stored in the memory 430 and a password corresponding thereto (S300) to authenticate the server. If the S400 fails, the next attempt among the plurality of user IDs stored in the memory 430 is attempted to log in again with the next ID and the corresponding password (S420). If the server authentication process (S430) is successful, the next step is continuously proceeded, but if the server authentication process (S430) fails, the next ID and the corresponding password among the plurality of user IDs stored in the memory are sequentially logged in again. The process of attempting (S420) is repeatedly performed. When another ID and password stored in the memory no longer exist after such an iterative process, a disconnection message (S450) is generated as shown in FIG. do.

In this way, the server is automatically connected and authenticated using a portable storage medium, thereby reducing the possibility of leaking the user's ID and password by hacking, and entering the server access, ID and password, The authentication process and the process of moving to the corresponding page can be performed directly through the portable storage device without the user having to perform the process directly, thereby increasing efficiency and convenience.

As mentioned above, in the present invention, the user moves to the location on the server based on the information stored in the memory 430 of the portable storage device 400 (S500). You can do this in more detail.

Upon connecting to the server 100, the user presets a desired position and environmental state on the server 100 and stores the setting in the memory 430 of the portable storage device 400, or the user 100 Count the position and environmental state used in the phase and calculate the position and environmental state with the highest frequency. When the user accesses the server 100, the calculated position and environment state are set to a location and environment to be moved on the server, and the settings are stored in the memory 430 of the portable storage device 400. .

After the user connects the portable storage device 400 to the user computer 300, the client module 410 of the portable storage device 400 is stored in the memory 430 after the automatic connection and authentication process. Loading the item to the server 100, the server 100 to provide a service of the location and environment state on the server 100 to the user based on the settings.

 Furthermore, when the environment is set by moving to the location on the server 100, the portable storage device 400 loads the work contents at the time of the previous connection of the user stored in the memory 430 and transmits the contents to the server 100. do. The server 100 may use the received data to service the user so that the user can continuously continue the work that was performed at the time of the previous connection.

In addition, before the user proceeds with the work, the server 100 receives the personal information such as the date of birth of the user stored in the memory 430 from the portable storage device 400 to execute the fortune program, and the fortune program By providing the user with information such as the biorhythm, the fortune of the day calculated from the user contributes to increase the efficiency of the user performing the work.

The present invention will be described to understand that does not store the information on the individual on the server in order to prevent the leakage of personal information.

When the user's ID or password is not stored in the portable storage device 400, or when the user wants to change his or her ID or password, or when the user is not registered on the server 100, When connecting to the server using the portable storage device 400 (S200), as shown in Figure 5, it is determined whether the user ID and password is stored in the portable storage device (400) (S210). If the user ID and password are not stored in the portable storage device 400, it is determined whether the user is a new subscriber (S220). If the user is not a new subscriber, the user receives a new ID or password (S480) and enters a new ID. Alternatively, after storing the password (S490), a login is attempted with the stored user ID and password (S230).

If the user is a new subscriber, the client module 410 of the portable storage device 400 moves directly to a new subscription related page on the server 100 (S230). The server 100 receives new user personal information from the new user in an input field on a new subscription related page (S240) and performs a new subscription authorization (S250). When the new subscription procedure is completed, the portable storage device 400 receives the user personal information data input from the server 100 and stores the received user personal information data in the memory 430, and after the server 100 transmits the user personal information data. The user personal information data input on the server 100 is deleted (S260).

In addition, when the user attempts to log in with a normal user ID and password (S300) and receives authentication (S400) from the server, the user wants to change his or her ID and password (S470). After receiving a new ID or password from the user through the client module 410 equipped with a user interface tool (S480) and storing the new ID or password in the memory (S490), the newly stored user ID and password are stored. Return to the step of attempting to log in (S300).

In addition, the portable storage device 400 periodically receives the personal information of the user from the server 100 and stores it in the memory 430, and the server 100 transmits the personal information of the user to the server 100. Delete personal information about the user stored in the &lt; RTI ID = 0.0 &gt;

By using the portable storage device 400 as described above, new subscriptions and user IDs and passwords can be changed for convenience, and user input of personal information is recorded only in the portable storage device 400 and the server ( 100 is prevented from being stored on the server 100 to prevent the attack of the server 100 by a hacker or the leakage of personal information by a malicious server administrator.

Furthermore, in the present invention, the contents of the communication are encrypted and transmitted by using a single-use encryption key in order to increase the security, which will be described below.

The portable storage device 400 and the server 100 store the same security key, and the user side generates the user-side one-time encryption key using the security key stored in the portable storage device 400 and the server 100 generates the one-time encryption key. Send the user-side one-time encryption key. The server 100 generates a server-side one-time encryption key by using the security key already held and transmits the server-side one-time encryption key to the user side.

 Thereafter, when the user side encrypts the communication contents using the user side one time encryption key and transmits the communication contents to the server 100 side, the server 100 decrypts the user side encrypted communication contents using the user side one time encryption key, In addition, when the server 100 encrypts the communication content using the server-side one-time encryption key and transmits it to the user side, the user side decrypts the received communication content of the server 100 side by using the server-side one-time encryption key. do.

As such, since the communication contents are encrypted using the one-time encryption key, security problems that may occur when the encryption key is leaked are solved.

In addition, the present invention provides an authentication method that enhances the security of a variety of methods as well as authentication through a password input when connecting to the server, the contents will be described.

6A and 6B illustrate an embodiment in which a security device is mounted on a portable storage device according to the present invention, which enables the portable storage device itself to authenticate a user.

6A illustrates an embodiment in which a fingerprint reader is installed in a portable storage device according to the present invention. When the portable storage device 400 is connected to a user computer 300, the user may have a fingerprint reader installed in the portable storage device 400. The portable storage device 400 may be used only after verification through 440. First, the portable storage device 400 is connected to the user's computer 300 (S100), and as shown in FIG. 7A, a fingerprint input is received from the user through the fingerprint reader 440 (S110). When the user's fingerprint is input, it is determined whether the fingerprint stored in the memory 430 of the portable storage device 400 and the input fingerprint are the same (S120). Here, if the stored fingerprint and the input fingerprint data are the same, the server 200 may be automatically connected (S200) by the operation of the client module 410 of the portable storage device 400 to proceed to the subsequent steps. If the registered fingerprint data is not the same, a connection failure message is generated (S450).

In addition, Figure 6b is an embodiment in which the security keypad is installed in the portable storage device according to the present invention, when the portable storage device 400 is connected to the user computer 300, the user is a keypad installed in the portable storage device 400 The mobile storage device 400 may be used only after verification through 450. First, the portable storage device 400 is connected to the user's computer 300 (S100), and as shown in FIG. 7B, the security device password is input from the user through the keypad 450 (S130). When the security device password is input, it is determined whether the security device password stored in the memory 430 of the portable storage device 400 and the input number are the same (S120). Here, if the stored security device password and the input number are the same, the next step may be performed by automatically connecting to the server (S200) by the operation of the client module 410 of the portable storage device 400, but if the security device password If and the entered number is not the same will generate a connection unavailable message (S450).

Furthermore, as a security method of the portable storage device according to the present invention, a serial number (S / N) of the portable storage device assigned at the time of production of the portable storage device can be used. As shown in FIG. 8, after accessing the server using the portable storage device 400 (S200), it is determined whether the portable storage device is the first use (S270). The storage device 400 transmits a unique number (S / N) held by itself to the server 100, and the server 100 registers the unique number (S / N) (S280). If it is not the first time, the portable storage device 400 transmits its own unique number (S / N) to the server, the server 100 is stored with the unique number (S / N) registered in the server 100 and portable storage The identity of the unique number (S / N) of the device 400 is determined (S290). If the two numbers are the same, the portable storage device 400 is normally driven to proceed with the login attempt step (S300), but if the two numbers are not the same, a connection not generated message is generated (S450).

As described above, the present invention undergoes the first authentication process using the security device for the portable storage device itself and the unique number of the mobile storage device, and then passes through the second authentication process with a password for login. Loss of personal information can be solved even if a third party accesses the duplicated portable storage device.

Further, in order to prepare for the case in which the portable storage device 400 is separated from the user computer 300 without the user logging out, as shown in FIG. 10, it is determined whether the portable storage device 400 is separated ( S610) When the portable storage device 400 is separated from the user computer 300 without logging out of the user, the user computer 300 recognizes the moment when the portable storage device 400 is disconnected as the end signal of the user and the server ( The termination signal is transmitted to the server 100, and when the termination signal is received, the server 100 logs out the user and deletes the user information left on the server 100 (S620).

In addition, in order to further protect the user information, as shown in FIG. 11, when a certain time period elapses periodically (S630), the server 100 transmits the user information to the user computer 300 and on the server 100. The user information remaining in the memory device is deleted (S650), and the portable storage device 400 stores the transmitted user information in the memory 430 (S640).

As such, when the user moves to a place by separating only the portable storage device without logging out, the third party may be prevented from using the user information in advance, and information about the user is periodically deleted on the server and the portable storage device is deleted. Because it is stored in, security is enhanced.

The authentication method using a portable storage device according to the present invention can be modified and applied in various forms within the scope of the technical idea of the present invention and is not limited to the above embodiments. In addition, the embodiments and drawings are merely for the purpose of describing the contents of the invention in detail, and are not intended to limit the scope of the technical idea of the invention, the present invention described above is common knowledge in the technical field to which the present invention belongs As those skilled in the art can have various substitutions, modifications, and changes without departing from the spirit and scope of the present invention, it is not limited to the embodiments and the accompanying drawings. Judgment should be made including scope and equivalence.

According to the present invention as described above, since the automatic connection and authentication process proceeds to the server using a portable storage medium, the server connection, in order to reduce the possibility of user ID and password leakage by hacking, and to access the page of the desired server, ID and password input, authentication process, and go to the page, such as the user does not need to go directly through the portable storage device can be improved efficiency and convenience.

In addition, since the information about the user is stored in the portable storage device instead of being stored on the server, even if a problem occurs in the server, the user information is not affected, so the stability and security are enhanced.

Furthermore, since the one-time encryption key is used to encrypt the communication content, the security problem that may occur when the encryption key is leaked is solved. When the user loses the portable storage device by providing a security device for the portable storage device itself, Alternatively, even when a third party attempts to access the server by using the duplicated portable storage device, personal information leakage problem does not occur.

When the user connects to the server, the user can directly perform the operation in the desired location or environment on the server without having to directly move or configure the location on the desired server. It is possible to continue the work that was progressing at the time of connection continuously, and it is excellent in terms of efficiency and convenience.

Claims (16)

Connecting the portable storage device to an interface of a user computer; Automatically connecting the user computer to a server on a network and attempting to log in at the portable storage device; And If the login authentication is successful, including the step of moving the user to a predetermined location on the server based on the user information stored in the portable storage device, The portable storage device includes a client module having an automatic execution and authentication function, and a memory storing user information including an ID and a password of the user. The method of claim 1, Receiving a location and environment to be moved on the server from the user when the server is connected, and stores the set items in the memory to move to a location on the server based on the set items when connecting to the server afterwards Authentication method using a portable storage device, characterized in that. The method of claim 1, Counting the location and environment on the server used by the user to calculate the most frequent location and environment, and setting the calculated location and environment as a location and environment to be moved on the server when connecting to the server, and And storing the set items in the memory and moving them to a location on the server based on the set items when the server is connected to the server. The method of claim 1, Based on the information about the user stored in the memory, the authentication method using a portable storage device, characterized in that the user can continuously continue the work that was in progress at the time of the previous connection continuously. The method of claim 4, wherein Prior to the operation, the server executes a fortune program based on the user information stored in the memory of the portable storage device, and provides the user with information calculated from the fortune program to the user Authentication method using. The method of claim 1, When the portable storage device is disconnected from the user's computer, the user's computer recognizes the end signal, the user computer sends the end signal to the server, and the server receives the end signal when the end signal is received. And logging out and deleting the user's information left on the server. The method of claim 1, Authentication method using a portable storage device, characterized in that for connecting the portable storage device to the USB interface of the user computer. The method of claim 1, The memory stores a plurality of user IDs and corresponding passwords, If it fails to log in to the server, the authentication method using a mobile storage device further comprises the step of attempting to log in again with a next user ID and a password corresponding to the plurality of user IDs stored in the memory sequentially . The method of claim 1, When a new user joins the server, the client module moves to a new subscription related page on the server and receives his / her personal information from the new user in a corresponding input field on the page. system; When the subscription of the new user is completed based on the input personal information, the portable storage device stores the personal information of the new user in a memory mounted in the portable storage device and is associated with the new user on the server. Transmitting a deletion signal for personal information; And The server further comprises the step of deleting the personal information associated with the new user on the server when the deletion signal is received. The method of claim 1, Periodically, the portable storage device receives the personal information of the user from the server and stores the personal information in the memory, and the server transmits the personal information of the user and then stores the personal information of the user stored on the server. Authentication method using a portable storage device, characterized in that it further comprises the step of deleting. The method of claim 1, Generating / exchanging a one-time encryption key by using a security key already held by the portable storage device and a server; Encrypting and transmitting a communication content between the user computer and the server by using the one-time encryption key; And And decrypting, by the user computer and the server, the encrypted and received communication content using the one-time encryption key. The method of claim 1, And when the portable storage device is connected to the user computer, the security device installed in the portable storage device is operated to confirm the user.  The method of claim 12, The checking of the user by operating the security device may include receiving a fingerprint from the user through a fingerprint reader installed in the portable storage device, and verifying the fingerprint stored in the memory against the received fingerprint. Authentication method using a portable storage device. The method of claim 12, The act of confirming the user by operating the security device may include receiving a number from the user through a keypad installed in the portable storage device and verifying the security device password stored in the memory with the received number. Authentication method using a portable storage device characterized by. The method of claim 1, When the user computer is connected to the server by the portable storage device, the portable storage device transmits the unique number (S / N) of the portable storage device to the server, and the server transmits the transmitted unique number ( S / N) and verifying the unique number (S / N) registered in the server. The method of claim 15, When the portable storage device is used for the first time, the portable storage device further comprises the step of registering by registering the unique number (S / N) of the portable storage device to the server. Way.

Images