KR20080090211A - Authentication method and apparatus for strengthening security of internet service admission - Google Patents

Abstract

A method and a system for authenticating a user to strengthen security for Internet service subscription are provided to block phishing or pharming basically with minimum personal information by providing a temperature ID/password to a user connected through an ARS(Automatic Response Service) and making the user logged in through the temporary ID/password register an individualized image. An ARS server(400) is connected to phones(200a,200b) of a user requesting registration on the network by using an ARS. An electronic banking server(300) provides temporary authentication information to the user phone when user information received from the user connected through the ARS is identical with the user information registered to a customer ledger database(310) for storing/managing the registered user information. The electronic banking server registers new registration information and a normal ID/password received from the user when the user is logged in by using the temporary authentication information provided to the user, and displays a registered individualized image when the user is logged in by using the normal ID/password.

Description

Authentication method and apparatus for strengthening security of internet service admission}

1 is a block diagram showing an online membership system according to an embodiment of the present invention.

2 is a signal flow diagram illustrating the operation of an online membership system according to an embodiment of the present invention.

3 is a flow chart illustrating an online member registration method according to an embodiment of the present invention.

* Description of the symbols for the main parts of the drawings *

100: internet terminal 200: telephone

300: electronic banking server 310: customer ledger DB

400: ARS Server

The present invention relates to a self-authentication method and system for enhancing security when subscribing to an Internet service, and in particular, to implementing a self-authentication method and system for reinforcing security when subscribing to an Internet service to perform strong personal authentication using minimal personal information online. It is in a ship.

In general, an electronic financial transaction is a transaction in which an financial institution or an electronic financial company provides financial products and services through an electronic device, and the user uses an automated method without facing or communicating directly with the employees of the financial institution or the electronic financial company. It is called.

In addition, the category of electronic financial transactions includes providing Internet-based financial transaction services.

An electronic device refers to a device that transmits or processes information related to an electronic financial transaction by an electronic method, such as an automatic teller machine, an automatic teller machine, a payment terminal, or a computer, and an access medium for transmitting or processing an electronic financial transaction by an electronic method. Need.

An access medium refers to a means used to order transactions to use electronic financial transactions, or to secure the truth and accuracy of users and transactions, and includes digital signature generation information, certificates, user numbers, and passwords.

Phishing, on the other hand, refers to an act of extracting personal information by creating a fake homepage and sending a mail to an unspecified number of email users to access the fake homepage.

Phishing occurs by sending phishing e-mails and receiving financial information from a fake site by clicking on a link that is misleading to the e-mail contents. As actions are completed, the damages and spillover effects in electronic financial transactions can undermine the basis of electronic financial transaction services.

And pharming is a phishing scam that can be used to steal users' legally owned domains or trick their domain name systems (DNS) into misleading users.

In the case of existing phishing attacks, e-mails are sent from websites such as financial institutions to derive links to extract individual authentication numbers, credit card numbers, and account information. There is a difference in that it takes over the domain itself operated in the middle, and users are known to use the site without any doubt and expose personal ID, password and account information. In particular, electronic financial transaction accidents can occur when such access media are exposed by social engineering attacks.

Accordingly, in order to prevent the problem of access media being exposed by such phishing or pharming, when a user wants to provide electronic financial transaction service online, the user directly visits a financial institution and applies for offline service. After the ID and password for the financial transaction service are given, the user ID and password are entered online so that the user basic information and customer authentication information can be simultaneously input or registered.

However, this method still includes the problem that theoretically cannot prevent phishing or parsing.

On the other hand, social security numbers, which are currently used as a means of verification of real name when signing up for an Internet site where face-to-face verification is inconvenient, are leaked online and become a factor of identity theft, and are used for purposes other than the original purpose such as affiliate marketing. It is causing a primary privacy violation.

Therefore, i-PIN (Internet Personal Identification Number) has been developed as an alternative means of the social security number that causes such secondary personal information infringement.

However, the authentication process for identity verification is also performed in the issuing process of the i-pin, and the accredited certificate, credit card information, mobile phone short message authentication and the like in the non-face-to-face authentication method are used. There is a problem of requiring the same main information request page.

Accordingly, the present invention is to solve the above problems, the authentication method for strengthening the security when joining the Internet service to perform strong personal authentication to fundamentally block phishing or parsing using minimal personal information online And providing a system.

According to an embodiment of the present invention for achieving the object of the present invention as described above, the authentication method for strengthening security when joining an Internet service is ARS connected to a user who is requested to join an online member and receives information of the corresponding user. Doing; If it is determined that the received user information is pre-registered reasonable user information, providing temporary authentication information to the user side; Receiving new user registration information, a formal ID, and a password of the user from the user side when the Internet is online logged in through the temporary authentication information from the user side; If the user is logged into the Internet online through the official ID and password from the user side, providing the electronic financial transaction-related information to the user side.

Preferably, the authentication method for enhancing security when joining the Internet service, prior to the step of ARS-connected to receive the user's information, receiving an agreement on the new subscription terms online from the user who is requested to join the online; It further comprises the step of guiding the information according to the Internet online subscription and personalized image registration to the user side.

The receiving and confirming of the user information may include inputting at least one or more user information among an account number, an account password, a card number, a card password, and a social security number if the user who is connected to ARS is an individual user. In the case of a user, receiving at least one or more user information among a business number, an affiliated store number, and a card number, and checking whether the received user information matches the registered user information.

The providing of the temporary authentication information may include providing a temporary ID and a temporary password which are one-time available authentication information.

Preferably, the user authentication method for enhanced security when subscribing to the Internet service further includes the step of registering a personalized image from the user side when the Internet is online logged in via the temporary authentication information from the user side.

The registering of the personalized image from the user side may include registering the personalized image which is combined with at least one or more of an image classified as a category, a nickname, and a background color including the image and the nickname.

Preferably, the user authentication method for enhancing security when subscribing to the Internet service may further include displaying the registered personalized image when the Internet is online logged in through a user ID and password from the user side.

Preferably, the user authentication method for enhancing security when subscribing to the Internet service further includes providing basic information of the user to the user when the temporary authentication information is logged into the Internet online from the user side.

On the other hand, the online membership system for security enhancement according to another embodiment of the present invention for achieving the object of the present invention as described above, ARS server that is ARS connected to the telephone of the user is requested to join the online; When it is confirmed that the user information input from the ARS-connected user is pre-registered legitimate user information, the temporary authentication information is provided to the user's telephone, and the user is logged in on the Internet online using the provided temporary authentication information. The electronic banking server may include an electronic banking server configured to receive new registration information, a formal ID, and a password from the user, and display the registered personalized image upon login through the formal ID and password.

The electronic banking server includes a customer ledger DB for storing and managing pre-registered user information. When the user information input from the ARS-connected user matches the user information previously stored in the customer ledger DB, Characterized in that it is the user information.

The electronic banking server provides temporary authentication information of the temporary ID and password to the user, and enables the temporary ID and password to be used once.

The electronic banking server receives a personalized image from the user side when the Internet is online logged in using the provisional authentication information provided from the user side, registers the user, and logs in through the official ID and password from the user side. And displaying the registered personalized image.

The electronic banking server may provide other images in addition to the registered personalized image in displaying the registered personalized image to the registered user.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, in describing in detail the operating principle of the preferred embodiment of the present invention, if it is determined that the detailed description of the related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

In addition, the same reference numerals are used for parts having similar functions and functions throughout the drawings.

In addition, the present invention described below describes an authentication method and system for enhancing security when subscribing to an Internet service, and describes an online member subscription method in an electronic financial transaction as an embodiment.

1 is a block diagram showing an online membership system according to an embodiment of the present invention.

As shown in FIG. 1, the online subscription system may include an electronic banking server 300 and an ARS server 400 including an internet terminal 100, a telephone 200, and a customer ledger DB 310. have.

In the online subscription system having such a configuration, the Internet terminal 100 is a terminal for allowing a user who wants to conduct an electronic financial transaction to be connected to the electronic banking server 300 through the Internet, and the telephone 200 is connected to a telephone network. A user terminal connected to the ARS server 400.

The electronic banking server 300 allows a user who is requested for an electronic financial transaction to be first accessed through ARS to be provided with temporary authentication information, that is, a temporary ID and password, and is logged into the Internet online only once with the provided temporary authentication information. Registration, new registration information input and formal authentication information, that is, the official ID and password to be registered.

Here, the personalized image may be, for example, a combination of an image, a nickname, a background color including an image and a nickname, classified into categories. Accordingly, the images classified into categories can be extended as long as the user's selection range is maximized and an associative memory method can be stored for a long time without using the electronic financial transaction service for a long time. In addition, an image added with a nickname provides an unlimited number of images to the user, and an image added with a background color simplifies visual identification of the image.

 Thus, when the e-banking server 300 is formally logged in from the registered user with the official ID and password, the electronic banking server 300 provides information related to the electronic banking transaction together with the registered personalized image of the user.

Next, the operation of the online membership system having such a configuration will be described in detail with reference to the drawings.

2 is a signal flow diagram illustrating an operation of an online membership system according to an embodiment of the present invention.

Referring to FIG. 2, in the online membership system, the electronic banking server 300 may receive a request for online membership from the Internet terminal 100 of a user who wants to perform an electronic financial transaction (S101). It is provided to the user side (S102) and the user consent is made to this (S103).

The electronic banking server 300 guides the user according to the Internet online subscription and personalized image registration to the user's Internet terminal 100 when the user agrees to the new subscription terms (S104) and requests the user's ARS connection. (S105).

Accordingly, when the user ARS connection to the ARS server 400 is confirmed in response to the ARS connection request (S106, S107), the electronic banking server 300 requests user information from the user phone 200 (S108, S109). The user information is input (S110 and S111) and the user ledger DB 310 is checked to determine whether the corresponding user information is reasonable user information (S112).

The electronic banking server 300 transmits temporary authentication information, that is, temporary ID and temporary password, to the corresponding user when the inputted user information is determined to be proper user information through the ARS server 400. Provided to (200) (S113, S114).

As such, when the electronic banking server 300 providing the temporary authentication information to the user side is logged in using the temporary authentication information from the user's Internet terminal 100 (S115), the basic information of the user is provided to the logged-in user. Provided to check this (S116), and allows the user to register a personalized image (S117).

Then, the electronic banking server 300 receives the user new subscription information from the user's Internet terminal 100 (S118), receives a formal ID and password to register (S119).

Next, when the user login through the formal ID and password is performed (S120), the electronic banking server 300 provides the electronic financial transaction related information with the user registered personalized image (S121).

Here, in providing the user-registered personalized image, the electronic banking server 300 adds other images in addition to the user-registered personalized image to prevent identification of the personalized image by a person who maliciously accesses or acquires the corresponding page. Can produce a concealing effect.

3 is a flowchart illustrating an online member registration method according to an embodiment of the present invention.

As shown in FIG. 3, when the online member registration system receives an online membership request from a user who wants to perform an electronic financial transaction (S201), first, a new subscription condition is provided to the user so that user consent can be made. After (S202), it guides the user according to the Internet online subscription and personalized image registration (S203).

In addition, the online member subscription system requests an ARS connection to the user, and receives corresponding user information from a user who is connected to the ARS in response thereto and performs a process of confirming this (S204). Here, the online member registration system receives the user information of at least one or more of the account number, account password, card number, card password and social security number when the ARS-connected user is an individual user, and when the ARS-connected user is a corporate user, By receiving at least one user information among a business number, a merchant number, and a card number, it is possible to check whether the input user information matches the user information stored in the customer ledger DB 310.

When the online member subscription system checks a user who is connected to ARS according to the above process, the online member subscription system provides temporary authentication information, that is, a temporary ID and a temporary password, which are provided to the user through ARS (S205). Internet online login is performed using the information (S206).

Here, the temporary authentication information is a one-time authentication information provided for the user's Internet online subscription.

Next, the online subscription system provides basic information of the user to the user logged in to the Internet online (S207), and then allows the user to register a personalized image (S208).

For example, the personalized image may be generated from a combination of an image classified into categories, a nickname, a background color including the image and the nickname, and the like. Accordingly, the images classified into categories can be extended as long as the user's selection range is maximized, and an associative memory method can be used for a long time without using the electronic financial transaction service for a long time. In addition, an image added with a nickname provides an unlimited number of images to the user, and an image added with a background color simplifies visual identification of the image.

On the other hand, the online member registration system that registered the user image receives new registration information from the user (S209), receives a formal ID and password to register (S210).

Accordingly, when the user login through the official ID and password is performed (S211), the online user registration system that registers the official user ID and password provides the registered user with personalized images and electronic financial transaction related information. (S212).

The present invention described above is not limited to the above-described embodiments and the accompanying drawings, and it is common in the art that various substitutions, modifications, and changes can be made without departing from the technical spirit of the present invention. It will be apparent to those skilled in the art.

In particular, the present invention has described an online member subscription method in an electronic financial transaction as an embodiment in describing an authentication method and system for strengthening security when subscribing to a secure Internet service. The same applies to membership.

Self-identification method and system for enhanced security when joining the Internet service according to the present invention as described above, provides a temporary ID and password to a user connected through ARS, and personalized image to a user logged in through the temporary ID and password By registering, it is effective to provide a user with a secure online subscription environment that maximizes security by fundamentally blocking phishing or parsing using minimal personal information.

As an example, the authentication method and system for enhancing security when joining the Internet service according to the present invention as described above, the main information such as social security number, security card number, etc. required for issuance of the accredited certificate in the process of issuing the accredited certificate. Since it is not required by the banking server, it can act as a security enhancement method and system that maximizes phishing protection by making unnecessary request pages of important information that is the main cause of phishing.

In addition, the identity authentication method and system for enhancing security when joining the Internet service according to the present invention as described above, the Internet banking server the main information such as card number, card password required for membership registration in the card company's membership environment Since it is not required by, it can act as a security enhancement method and system that maximizes phishing protection by making unnecessary request pages of important information that is the main cause of phishing.

In addition, the authentication method and system for strengthening the security when joining the Internet service according to the present invention as described above, such as credit card information required for identity authentication in non-face-to-face authentication in the i-PIN issuing process Since it does not require important information, it can act as a security reinforcement method and system that maximizes phishing protection by making unnecessary request pages of important information that is the main cause of phishing.

Claims (13)

In the authentication method for enhanced security when joining the Internet service, ARS connected to the user side requested to join the online, receiving and confirming the information of the user; If it is determined that the received user information is pre-registered reasonable user information, providing temporary authentication information to the user side; Receiving new user registration information, a formal ID, and a password of the user from the user side when the Internet is online logged in through the temporary authentication information from the user side; And When the Internet online login through the canonical ID and password from the user side, the step of providing information related to the electronic financial transaction to the user side comprising the identity authentication method for enhanced security when joining the Internet service. The method of claim 1, Before the step of receiving the user's information is connected to the ARS, Receiving an agreement on a new subscription agreement online from a user who is requested to join an online membership; Wow Guiding the information according to the Internet on-line subscription and personalized image registration to the user side further comprises a method of authenticating the identity for enhanced security when subscribing to the Internet service. The method of claim 1, Receiving and confirming the user information, If the user who is connected to ARS is an individual user, input at least one or more user information among account number, account password, card number, card password, and social security number, and if the user who is connected to ARS is a corporate user, the business number, merchant number and card Receiving at least one user information of the number, and confirming whether or not the received user information matches the pre-registered user information, characterized in that the identity authentication method for enhanced security when joining the Internet service. The method of claim 1, Providing the temporary authentication information, Self-authentication method for enhanced security when subscribing to an Internet service, characterized by providing a temporary ID and a temporary password, which are one-time authentication information. The method of claim 1, And registering the personalized image from the user side when the Internet is online logged in via the temporary authentication information from the user side. The method of claim 5, Registering a personalized image from the user side, And a personalized image which is combined with at least one of an image, a nickname classified into categories, and a background color including an image and a nickname. The method of claim 5, And when the Internet is online logged in through the user ID and password from the user side, displaying the registered personalized image. The method of claim 1, When the temporary authentication information is logged into the Internet online from the user side, providing the basic information of the user to the user side characterized in that the identity authentication method for enhanced security when joining the Internet service. In the identity authentication system for enhanced security when joining the Internet service An ARS server ARS connected to the user's telephone requested for online membership; Wow When it is confirmed that the user information input from the ARS-connected user is pre-registered legitimate user information, the temporary authentication information is provided to the user's telephone, and the user is logged in on the Internet online using the provided temporary authentication information. In case of registration, the user receives new registration information, a formal ID and a password from the user side, and registers the security information. Identity authentication system. The method of claim 9, The electronic banking server, Including the customer ledger DB for storing and managing pre-registered user information, if the user information input from the ARS connected user matches the user information previously stored in the customer ledger DB to confirm that the user information is reasonable Identity authentication system for enhanced security when joining the Internet service, characterized in that. The method of claim 9, The electronic banking server, And provisioning temporary authentication information of the temporary ID and password to the user side, and enabling the temporary ID and password to be used once. The method of claim 9, The electronic banking server, When the user logs in via the Internet online using the provided temporary authentication information from the user side, the user receives a personalized image from the user side and registers. Identity authentication system for enhanced security when subscribing to an Internet service, characterized in that the display. The method of claim 12, The electronic banking server, In displaying the registered personalized image to the user who is formally logged in, the user authentication system for enhanced security when subscribing to an Internet service, comprising providing other images in addition to the registered personalized image.

Images