KR20080112674A - Apparatus, system, method and computer program recorded medium for authenticating internet service server and user by using portable storage with security function - Google Patents

Abstract

The present invention relates to an apparatus, a system, a method and a recording medium for authenticating a server and a user using a portable storage device having a security function.

The present invention provides a system for providing an Internet service, comprising a user authentication unit, a flash memory unit, and an external communication terminal inside a portable storage device having a security function. An electronic authentication device for managing / storing various access information and providing an authentication service for verifying no tampering and suitability of users and servers, and providing the authentication service; Wired and wireless communication network for providing a wired and wireless communication path; A user terminal connected to the electronic authentication device through an external communication terminal and providing the authentication service via the wired / wireless communication network; Issuing, registering, and authenticating the electronic authentication device to newly issue the electronic authentication device to the user; when the electronic authentication device is connected through the wired / wireless communication network, after authenticating the electronic authentication device, It provides an electronic authentication system comprising at least one Internet service providing server for providing an Internet service.

According to the present invention, by providing an electronic authentication service and system using a portable storage device with a security function, the user can safely carry personal information, anytime, anywhere safely using a mobile phone and various computer devices, membership, You can use various Internet services such as login, user authentication, service use, product purchase, and payment for goods and services safely and conveniently.

Description

Apparatus, System, Method and Computer Program Recorded Medium for Authenticating Internet Service Server and User by Using Portable Storage with Security Function}

1 is a view for explaining an electronic authentication device according to a preferred embodiment of the present invention;

2 is a view showing an embodiment of an electronic authentication system for providing an authentication service using the electronic authentication device of the present invention;

3 is a view for explaining the registration and issuance of an electronic authentication device for an electronic authentication service according to a preferred embodiment of the present invention;

4 is a view for explaining a process of providing an Internet service through an electronic authentication service in an Internet service providing server according to an embodiment of the present invention;

5 is a view for explaining the connection and disconnection between the electronic authentication device and the user terminal according to an embodiment of the present invention;

6 is a diagram illustrating a process of providing an Internet service service by an electronic authentication program according to an exemplary embodiment of the present invention.

<Description of Symbols for Main Parts of Drawings>

100: electronic authentication device 110: flash memory unit

120: program area 130: electronic certification program

150: data area 160: user authentication unit

180: communication unit 200: electronic authentication system

210: user terminal (computer device) 220: wired and wireless communication network

230: Internet service providing server 240: Internet service providing terminal

The present invention relates to an apparatus, a system, a method and a recording medium for authenticating a server and a user using a portable storage device having a security function. More specifically, the flash memory unit and the user authentication unit are configured inside the portable storage device, and the electronic authentication device having an external communication terminal is connected to a computer device having an external communication terminal such as a mobile phone or a USB device. An electronic authentication system, apparatus, and method of implementing the same, comprising accessing a plurality of Internet service providing servers by operating an electronic authentication program installed in the server, integrated management of user or corporate user information, and using a more secure and convenient Internet service. It is about.

As the Internet is activated, the use of electronic commerce, online games, and portal services using the Internet is increasing rapidly every year. These services adopt a variety of login methods to prove the legitimacy of the user, and typically, enter a name (ID, Identification) and password defined to identify the user, submit a certificate, and OTP (One). -Time Password, one-time password input method, etc. are used singly or in combination.

These methods are not only cumbersome to remember, carry and manage from a user's point of view, they also confuse users with different information required by each Internet service provider. In order to use, there is an inconvenience of managing and possessing a large number of personal information and security media.

In addition, as tangible and intangible money transactions, such as e-commerce and online games, increase, malicious hacking and electronic frauds are increasing. Malicious hacking or e-financial frauds take over personal information and certificates stored in the PC gradually from the creation and inducement of fraudulent sites pretending to be passive service providers. The methods and methods are becoming more sophisticated and sophisticated, such as forcing them to move to the site.

In order to solve this problem, conventionally, a portable magnetic device such as a USB memory device has been used to store and carry a file or an authorized certificate in which Internet service IDs and passwords have been input, but in such a case, a simple file form without special security measures is used. There is a chance that it is stored and lost or stolen or copied without your knowledge.

In addition, even if the user enters the correct URL, if a user is forced to go to a fraudulently created fraudulent site, there is an increasing number of cases of personal information leakage and financial damage due to the inability to distinguish a fraudulent site from a normal site. .

In order to solve the above problems, the present invention, the flash memory unit and the user authentication unit is configured in the portable storage device having a security function, the external communication terminal such as a mobile phone or USB to the electronic authentication device having an external communication terminal After connecting to a computer device that is connected to a computer device, and running a digital authentication program installed in the electronic authentication device to access a number of Internet service providing server, integrated management of personal or corporate user information and to perform a more secure and convenient Internet service An object of the present invention is to provide an electronic authentication system, an apparatus, and an implementation method thereof.

In order to achieve the above object, the present invention provides a system for providing an Internet service, comprising a flash memory unit, a user authentication unit and an external communication terminal inside a portable storage device having a security function, An electronic authentication device for managing / storing various user information of a user by running a program and providing the Internet service; Wired and wireless communication network for providing a wired and wireless communication path; A user terminal connected to the electronic authentication device through an external communication terminal provided and providing the Internet service via the wired / wireless communication network; Issuing, registering, and authenticating the electronic authentication device to newly issue the electronic authentication device to the user; when the electronic authentication device is connected through the wired / wireless communication network, after authenticating the electronic authentication device, It provides an electronic authentication system comprising one or more Internet service providing server for providing the Internet service.

In addition, according to another object of the present invention, in the device connected to the user terminal having an external communication terminal to provide an Internet service, the program area and screen data for storing the electronic authentication program for providing the Internet service, the Internet A flash memory unit including a data area for storing service data, computer device-specific data, and user setting data; Equipped with a Chip Operating System (COS), it has an encryption algorithm including a public key infrastructure (PKI) method and a secret key method, and a memory area for storing user's personal information and authentication information. A user authentication unit including; And an external communication terminal such as a USIM slot and a USB terminal for connection with the user terminal.

In addition, according to another object of the present invention, the user's user information, Certification Identification Number (CIN), Personal Identification Number (PIN), Server Identification Number (SIN) and electronic In an electronic authentication system including an electronic authentication device for storing an authentication program, a user terminal, and an Internet service providing server, in the method of providing an Internet service using the Internet service providing server, (a) the electronic authentication program provides the Internet service. Requesting the server authentication number from a server; (b) the Internet service providing server processing the server authentication number; (c) the Internet service providing server notifying a result of processing the server authentication number; (d) accessing the Internet service providing server if the server authentication is successful as a result of processing the server authentication number; (e) accessing the Internet service providing server, the Internet service providing server requesting the electronic authentication unique number from the electronic authentication program; (f) receiving, by the Internet service providing server, the Internet service request from the electronic authentication program when the electronic authentication unique number is registered; (g) the internet service providing server processing the internet service; And (h) informing the electronic authentication device of the processing result of the Internet service by the Internet service providing server.

In addition, according to another object of the present invention, the user's user information, Certification Identification Number (CIN), Personal Identification Number (PIN), Server Identification Number (SIN) and electronic In the electronic authentication device for storing the authentication program, a method for providing an Internet service through the interworking with the Internet service providing server connected to the user terminal, (a) When the electronic authentication device is connected to the user terminal, the user Identifying a terminal; (b) the electronic authentication device driving the electronic authentication program for the user terminal and authenticating the user through the personal identification number; (c) if the user authentication is successful in step (b), the driven electronic authentication program accessing the Internet service providing server according to the user's request; (d) the electronic authentication program interworking with the internet service providing server to perform authentication through the electronic authentication unique number, and requesting the internet service according to a request of the user; (e) the electronic authentication program interworking with the internet service providing server to process the internet service; And (f) receiving the processing result of the Internet service from the Internet service providing server by the electronic authentication program.

In addition, according to another object of the present invention, an electronic authentication program for providing an Internet service, (a) a function of integrating / storing / managing / searching / deleting / updating the user's personal information and authentication information; (b) requesting / processing the Internet service by accessing a plurality of Internet service providing servers using the user's personal information and authentication information; (c) a function of performing authentication by transmitting an electronic authentication unique number to the Internet service providing server; (d) a function of authenticating the user using a personal identification number; (e) a function of authenticating the server by using a server authentication number; and (f) a plurality of user terminals are connected to authenticate the plurality of user terminals and the plurality of Internet service providing servers, and interwork with the plurality of user terminals. It provides a recording medium recording a computer-readable program, characterized in that it comprises a function for providing the Internet service.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. First of all, in adding reference numerals to the components of each drawing, it should be noted that the same reference numerals are used as much as possible even if displayed on different drawings. In addition, in describing the present invention, when it is determined that the detailed description of the related well-known configuration or function may obscure the gist of the present invention, the detailed description thereof will be omitted.

1 is a view for explaining an electronic authentication device according to a preferred embodiment of the present invention.

Electronic authentication device 100 according to a preferred embodiment of the present invention comprises a flash memory unit 110, a user authentication unit 160 and a communication unit 180 in a portable storage device having a security function, and is composed of individuals or companies An electronic authentication program for storing / managing authentication information and security data for Internet services, the flash memory unit 110 in a portable storage device with security function, and a user authentication unit in a portable storage device with security function ( 160 is characterized in that to provide an electronic authentication service of the present invention by connecting to the communication terminal of the user terminal through the communication unit 180.

In this case, the user terminal includes various computer devices, and includes a personal computer (PC) and a personal digital assistant (PDA) capable of accessing an Internet service providing server through a wired / wireless communication network such as the Internet or an internal Internet service providing network. Assistant), Mobile Communication Terminal, Card Payment Terminal, Point Of Sale (POS), Set-Top Box, Counter Terminal and Cash Dispenser (CD), ATM ( ATM (Automatic Teller Machine), bill acceptor, etc., which refers to any computer device with an external communication port, input and output devices, and their own computing functions.

In addition, the electronic authentication device 100 of the present invention can be manufactured in the form of a USB memory stick, which is a general portable storage device, and can be easily and conveniently carried by anyone, and most portable devices having a USIM slot and a USB port are provided. It can be mounted on phones and computers and used via the USIM and USB interfaces.

Therefore, the communication unit 180 of the present invention is preferably implemented in the form of a USB terminal supporting a USIM slot and a USB interface, but is not limited thereto. Various wired / wireless communication methods capable of performing communication with a user terminal, eg For example, it can be implemented through various methods such as a method using a serial port and a parallel communication terminal of a computer, a method using a wireless communication such as Bluetooth, ZigBee.

The flash memory unit 110 in the portable storage device having the security function of the present invention includes a program area 120 and a data area 150, and the user terminal 210 is an auxiliary memory using a USIM and a USB interface. It is recognized as an external disk and has an electronic certification program.

CIN (Certificate Identification Number), which is a unique number of the electronic authentication device 100, and a Personal Identification Number (PIN) that the user enters, are the person who visits an Internet service provider or is online. It is possible to input only when initially registering or issuing the electronic authentication device 100 and is encrypted in the user authentication unit 160 in a portable storage device having a security function and securely stored in the internal memory 164 area.

Server Identification Number (SIN) embedded in the electronic authentication device 100 is a digital authentication unique number (CIN) and personal identification number ( After authentication of the user and the electronic authentication device with a PIN), it is transmitted online and encrypted by the user authentication unit 160 in the portable storage device having a security function and securely stored in the internal memory 164 area.

The electronic authentication unique number (CIN) stored in the electronic authentication device 100 is electronic through authentication / confirmation with the electronic authentication unique number (CIN) registered in the Internet service providing server 230 when the user performs the Internet service. It is used to authenticate the authentication device 100, the personal identification number (PIN) is used to confirm and authenticate whether the user is a legitimate user when the user accesses the electronic authentication device 100 to the user terminal 210. That is, the electronic authentication program 130 in the electronic authentication device 100 of the present invention operates only when the user inputs a correct personal identification number (PIN). In addition, the server identification number (SIN) is used to identify and authenticate the user through the personal identification number (PIN), and then to verify and authenticate the Internet service providing server 230.

Self-encrypted internal memory of the user authentication unit 160 in the portable storage device having a security function for the user information and various passwords to be used by the user to access each Internet service provider (or Internet service agency) server 230. If registered in the area 164, the electronic authentication program 130 uses this data to access the Internet service providing server 230 of each Internet service provision or to automatically or manually process the sequential Internet services.

The program area 120 of the flash memory unit 110 in the portable storage device having a security function stores the electronic authentication program 130 for providing the electronic authentication service of the present invention, and the electronic authentication program 130 is a basic module. 132, the electronic authentication management module 134, the smart card management module 136, the data processing module 138, the integrated server management module 140, and the Internet service processing module 142.

The electronic authentication program 130 of the present invention is connected to the Internet service providing server 230 of each Internet service provider (or an Internet service agency), and the data area of the flash memory unit 110 in the portable storage device having the security function ( Using the screen information of each Internet service provision and the Internet service processing procedure stored in 150), the same or similar Internet services of multiple Internet service provision servers can be processed through the same screen and input procedures according to the user's command. Make sure To this end, communication with each Internet service providing server 230 or a separate standardized Internet service providing server is not a conventional Hyper Text Transfer Protocol (HTTP) method but a message-oriented XML (eXtended Mark-up Language) or electronic authentication system. Use standard full text as defined in

In addition, the electronic authentication program 130 may control data of a flash memory unit 110 in a portable storage device having a security function on a control object for moving a screen, an icon, and a menu for a user interface of the user terminal 210. It is retrieved from the area 150 and used. Therefore, a screen or menu for automatically or manually recognizing that the user connects to the desired user terminal 210 to access the wired / wireless communication network 220 such as the Internet to process an Internet service or to query electronic authentication information. A control element for movement is selected and operated in the data area 150.

The basic module 132 is a program module that is initially driven in response to various user terminals (computer devices). That is, the computing environment is recognized so that the electronic authentication program 130 can be automatically executed according to the type of computer device to which the electronic authentication device 100 of the present invention is connected, or the electronic authentication device 100 of the present invention is applied to the counterpart computer device. It performs the function of recognizing and checks the Personal Identification Number (PIN) of the electronic authentication device 100 serves to activate the program of the next step.

The electronic certification management module 134 automatically checks the version of the electronic certification program 130 when the version (Version) of the electronic certification program 130 is changed through a wired or wireless communication network such as the Internet, and then changes the update. This module updates.

The smart card management module 136 is connected to the processor 162 of the user authentication unit 160 through the smart card interface, and various user information stored in the user authentication unit 160, that is, public certificate, user ID, password, This module can register, save, delete and search smart card information.

The data processing module 138 manages screen data, usage and result data, encryption data, various message data, log data for record management, etc., which are required when a user performs an Internet service through the electronic authentication service of the present invention. This module can be searched.

The integrated server management module 140 comprehensively manages and outputs user information and server information scattered on a plurality of Internet service providing servers, and provides various analysis such as statistical information such as frequency of use of each Internet service providing and service type. In addition, according to a rule predefined by the user, the aggregation of the Internet service providing server changes or the like, or performs a function such as a reminder.

Internet service processing module 142 is a computer device that the electronic authentication device 100 of the present invention supports a USB interface, that is, a personal computer, a personal portable information terminal, a mobile communication terminal, a card payment terminal, an electronic cash register, a set-top box It is connected to internet terminal, cash dispenser, ATM, utility bill acceptor, etc., and it is connected to internet service processing module of internet service providing server when user uses various internet services to process internet service requested by user.

The data area 150 of the flash memory unit 110 includes various screen data necessary for each Internet service when the electronic authentication apparatus 100 of the present invention is connected to various Internet service providing servers to provide various Internet services. ), Internet service data 154 for storing Internet service history, processing results and usage history logs, information for identifying various computer devices, and computer device-specific data 156 for storing input / output device information of each computer device, and It consists of user setting data 158 for storing personal environment setting information and various user-specified content and the like, and manages and stores a certain portion of the flash memory 110 in accordance with the storage data.

The remaining area (memory) in addition to the program area 120 and the data area 150 in the flash memory unit 110 of the present invention is a storage means for storing various data (document, image / music / video file, etc.) for the user's convenience. It can be used.

The user authentication unit 160 of the present invention includes a smart card chip, and the smart card chip includes an internal memory 164 composed of its own CPU processor 162, RAM, ROM, and EEPROM, an encryption assistant CPU, and an encryption processing module. 166, a data management module 168 for managing data in the internal memory 164, and a communication module 170 for supporting general USB interface communication are microchips having a single chip.

Therefore, the electronic authentication device 100 of the present invention can perform memory management and encryption on its own without relying on the CPU of the connected user terminal, thereby preventing access from the hacking program of the user terminal so that the security is very high. Therefore, it is used for storing various information necessary for Internet service.

The internal memory 164 of the user authentication unit 160 stores Internet service security related information such as an accredited certificate, user information, password, and various user information of an individual or a company, and also stores information of the smart card chip itself.

The user authentication unit 160 of the electronic authentication device 100 of the present invention is equipped with a chip operating system (COS) to hardware encryption algorithms such as public key infrastructure (PKI) and secret key system hardware. It is processed by the chip and includes a self-encrypting memory area for storage of certificates and the like. The user terminal 210 such as a computer device recognizes a smart card or a USB memory which is a kind of external computer device.

2 is a diagram showing an embodiment of an electronic authentication system for providing an Internet service using the electronic authentication device of the present invention.

As shown in Figure 2, the electronic authentication device 100 of the present invention is connected to the user terminal 210 in a variety of communication methods including a USB interface, the Internet service providing server 230 through a wired or wireless communication network 220 Access to provide the electronic authentication service of the present invention to the user, the user can safely use a variety of Internet services through the electronic authentication service.

Electronic authentication system 200 of the present invention includes a variety of user terminal 210, wired and wireless communication network 220, Internet service providing server 230, Internet service providing terminal 240 and the electronic authentication device 100 of the present invention. do.

A plurality of computer device support means 250 of the electronic authentication device 100 of the present invention is provided to the computer device-specific data 156 and the computer device in order to use the electronic authentication device 100 in a variety of user terminal 210 Using the screen data 152 with the correct screen and control elements, the electronic authentication program 130 automatically recognizes and processes them.

A plurality of Internet service providing server support means 260 is processed by using the existing web browser or the Internet access screen in the electronic authentication program 130 as it is without changing the existing Internet service providing server 230 and each Internet service It includes both the method of using the standard full text using the common service of the providing server 230 and the like, and the method of constructing and using a kind of integrated standard server that connects each Internet service providing server 230 and provides a standard web service form. do.

The user setting support means 270 supports the user to set the screen and menu configuration using the Internet service providing server 230 through the user environment setting S612, and information provided by the web server of the Internet service providing. The Internet service data on a separate storage device, or replicate the Well-Defined configuration data in a way that allows users to selectively subscribe to and configure the user (for example, in a spreadsheet or report format). And the like.

User terminal 210 is connected to the electronic authentication device 100 and the Internet service providing server 230 of the present invention to provide a variety of Internet services via the wired and wireless communication network 220, the Internet service providing server 230 Including personal computer, personal portable information terminal, mobile communication terminal, card payment terminal, electronic cash register, set-top box, teller terminal and cash dispenser, ATM, bill acceptor, etc. Includes all computer devices with functions.

In addition, the user terminal 210 may include a USB port 212 connected to the communication unit 180 of the electronic authentication device 100 of the present invention, an input device 214 including a keyboard and a mouse, an output device such as a monitor ( 216) and all computer devices including a self computing device 218 that performs overall management of the user terminal 210 and provides Internet services to the user through the electronic authentication program 130 of the electronic authentication device 100. Include.

The input device 214 includes a keyboard, a keypad, a touch screen, and the like, and the output device 216 includes a monitor, a liquid crystal, a touch screen, and the like.

The wired / wireless communication network 220 provides a wired / wireless communication path between the user terminal 210, the Internet service providing server 230, and the Internet service providing terminal 240, and the TCP / IP protocol and various services existing in the upper layer, that is, High speed data communication networks such as Wibro or High Speed Downlink Packet Access (HSDPA), as well as general Internet networks including global open computer network structures that provide HTTP, Telnet, FTP, DNS, SMTP, SNTP, NFS and NIS. It means a network that provides various wired and wireless communication methods.

The Internet service providing server 230 performs a function of issuing, registering, and authenticating the electronic authentication device 100 to newly issue the electronic authentication device 100 to the user, and the electronic authentication device 100 has a wired / wireless communication network 220. When accessing through), it is authenticated, and if the authentication is successful, it is a server that provides a variety of Internet services to various users by providing an electronic authentication service.

The Internet service providing terminal 240 is connected to the Internet service providing server 230 to the Internet service provider in order to register the user information for the new issue of the electronic authentication device 100, etc. of the electronic authentication device 100 Provides an interface for new issuance.

The above-described electronic authentication system 200 is conventionally connected to each of the Internet service providing server 230 of the Internet service providing that the user wants to use, and after the user authentication in a different way to break the way to use the Internet service By using the electronic authentication device 100 and the electronic authentication program 130, anytime, anywhere access to the desired computer device (user terminal), it is possible to integrate the Internet services through a standardized user interface.

In other words, the user possesses the electronic authentication device 100 of the present invention to enable the pocket service to carry the Internet service platform itself as well as user information such as personal IC, password, and certificate required for the Internet service. There is.

In the process to be described later, using the electronic authentication system 200 of FIG. 2, FIGS. 3 to 6, a method of registering and issuing an electronic authentication device 100 of the present invention, authentication, and providing an Internet service through an electronic authentication service is described. Explain.

First, the user visits each Internet service provider or authenticates himself or herself online to use the electronic authentication service of the present invention, and then applies for the electronic authentication service and receives the electronic authentication device 100.

As shown in FIG. 3, the person in charge of the Internet service provider confirms the user's identity using a public certificate, a security SMS, a social security number, a user's ID card, and supporting documents (S310), and electronic authentication on the Internet service providing terminal 240. The user who uses the electronic authentication service through the registration means 242 is registered with the Internet service providing server 230. The electronic certificate issuing person in charge of providing the Internet service enters the electronic certificate unique number (CIN) newly issued from the Internet service providing server 230 in the electronic authentication device (100) (S320), the user directly personal identification number (PIN) Enter (S330).

When the registration procedure of the electronic authentication device 100 through the input of the electronic authentication unique number (CIN) and the personal identification number (PIN) is completed, the electronic authentication device 100 of the present invention is issued to the user (S340).

Here, the electronic certificate registration means 242 stores an electronic certificate registration program and an application signed by the user. In addition, the electronic authentication device recorder 244 communicates with the Internet service providing server 230 of the Internet service providing terminal 240 or the Internet service provider (or an Internet service agency) to the electronic authentication device 100 to the digital authentication unique number. (CIN) is assigned and recorded in the internal memory 164 of the user authentication unit 160 area of the electronic authentication device 100. Digital authentication unique number (CIN) is a kind of key value (Key Value) is used when authenticating the electronic authentication device 100 in the future Internet service providing server 230.

That is, a method of returning a value calculated by the cryptographic processing module 166 as an answer value using a digital authentication unique number (CIN) with respect to a query value sent from the Internet service providing server 230. As such, the wired / wireless communication network 220 between the input / output device of the user terminal 210 or the computer device and the Internet service providing server 230 including a USB port and an input / output device such as a personal computer and all computer devices having a self-aware function is hacked. Even if it is, the CIN will not be leaked.

In addition, the personal identification number (PIN) stored in the user authentication unit 160 through the user's own input device connected to the electronic authentication device recorder 244 or the Internet service providing terminal 240 so that even the Internet service provider is not known. Enter it. If the electronic authentication device is issued online, after securing the security of the user terminal, it is encrypted so that even the person in charge of the Internet service provider can transmit it. In this case, the input personal identification number (PIN) is also a kind of key value, which is used as a means for authenticating a user when driving the electronic authentication apparatus 100 in various future user terminals 210. That is, in response to the query value sent from the user terminal 210, the value calculated by the encryption processing module 166 using the personal identification number (PIN) is returned as a response value, between input / output devices of the user terminal 210. Even if the internal packet is hacked, the PIN will not be leaked.

In addition, only the electronic authentication unique number (CIN) and user information are stored in the Internet service providing server 230, and the personal identification number (PIN) is not stored.

4 is a view for explaining a process of providing an Internet service through an electronic authentication service according to an embodiment of the present invention.

 The electronic authentication device 100 checks the connection of the electronic authentication device 100 from the electronic authentication registration means 242 or the user terminal 210 via the wired / wireless communication network 220 (S402), and the Internet service providing server 230 Request a server authentication number (SIN) to the (S403). After the electronic authentication device 100 receives the server authentication number (SIN) and the electronic authentication unique number (CIN) from the Internet service providing server 230 to authenticate the server, the Internet service providing server 230 is the electronic authentication device 100 By using the electronic authentication unique number (CIN) transmitted from the (S404) it is determined whether the electronic authentication device 100 is connected to the Internet service providing server 230 for the first time (S406).

When the electronic authentication device 100 accesses the Internet service providing server 230 for the first time, the Internet service providing server 230 is connected to the electronic authentication registration means 242 of the Internet service providing terminal 240. Request to register the unique number (CIN) (S408).

Here, the electronic authentication / user authentication means 232 of the Internet service providing server 230 reads the public certificate stored in the electronic authentication device 100 and compares it with the user information, or checks the password and security card number, etc. The electronic authentication apparatus 100 and the user are authenticated through the program.

In addition, the Internet service processing means 234 includes a case where all of the user ID, password, certificate, etc. are used or partially simplified according to an existing procedure.

When the electronic authentication device 100 has previously connected to the Internet service providing server 230 or when the electronic authentication device 100 has previously registered and performed registration, the Internet service providing server 230 receives an Internet service from the user through the electronic authentication device 100. Before receiving the request, the electronic authentication unique number (CIN) is compared with the data registered in the Internet service providing server 230 (S410). Here, if the data registered in the electronic authentication unique number (CIN) and the Internet service providing server 230 does not match, check the error conditions, such as loss, expiration of use period, damage to the electronic authentication device 100 (S412), error Take a countermeasure corresponding to the condition (S414).

Here, the digital authentication unique number (CIN) is not entered directly by the user, so the error caused by the user's wrong input is excluded.

The Internet service providing server 230 is connected to the user terminal 210 when the authentication of the electronic authentication device 100 is completed through an electronic authentication unique number (CIN), an electronic authentication program that is driven on the electronic authentication device 100. After receiving the request of the Internet service (130), and processing / providing the Internet service corresponding to the request (S418), the result is notified to the electronic authentication program (130) (S420). In this case, the request of the Internet service and the notification of the processing result may be provided in various ways, such as the existing method of being transmitted in the form of a web page including HTML or the standard professional method using XML.

5 is a view for explaining the connection and disconnection between the electronic authentication device and the user terminal according to an embodiment of the present invention.

When the communication unit 180 (USB terminal) of the electronic authentication device 100 is connected to the USB port 212 of the user terminal 210, the user terminal 210 is an electronic authentication device 100 through a device manager program, etc. Check the connection (S502).

At this time, the electronic authentication device 100 checks whether the electronic authentication program 130 to be executed is linked with the corresponding user terminal 210 (S504). Here, the process of confirming the electronic authentication program 130 is to determine whether the electronic authentication program 130 necessary for a computer device such as a PC or a PDA is embedded.

If the current electronic certification program 130 to be executed is not linked with the corresponding user terminal 210, the electronic region suitable for the corresponding computer device (user terminal 210) is searched for by searching the program area 120 of the electronic authentication apparatus 100. The authentication program 130 is loaded (S506). When the electronic authentication program 130 to be newly loaded or currently executed in step S506 is interlocked with the corresponding user terminal 210, the electronic authentication program 130 is driven (S508).

When the electronic authentication program 130 is driven, the user may receive an electronic authentication service and access various internet service providing servers 230 to provide various internet services.

While the electronic authentication program 130 is being driven, the electronic authentication device 100 is separated from the user terminal 210 to determine whether the connection is released (S510), and the user disconnects the electronic authentication device 100 from the USB port or communicates. When the connection state is released due to an error or the like, the electronic authentication device 100 ends the driving of the electronic authentication program 130 (S512).

Here, as the electronic authentication driving means 217 for driving the electronic authentication program 130, the program area 120 of the electronic authentication device 100 recognized as an external storage device according to the type and operating system of the user terminal 210. (C) includes all means such as directly executing the file or copying (or loading) the file to a specific area of the user terminal 210.

In addition, the user interface means 219 includes not only a monitor, a mouse and a keyboard of a personal computer, but also a touch screen, a keypad, buttons, a liquid crystal screen, a TV monitor, a remote controller, and the like provided by various user terminals 210.

6 is a view for explaining a process of providing an Internet service by the electronic authentication program according to an embodiment of the present invention.

When the electronic authentication program 130 is duplicated and driven in the program area 120 or the user terminal 210 of the electronic authentication apparatus 100, the electronic authentication program 130 checks whether the electronic terminal is connected to the user terminal 210, and the user terminal 210. It periodically checks whether the connection is maintained while connected (S602). This is to stop the operation of the electronic authentication program 130 at the moment of separating the electronic authentication device 100 from the USB port 212 of the user terminal 210. Accordingly, one electronic authentication program 130 may not be executed simultaneously on multiple computer devices, and may fundamentally block this.

The electronic authentication program 130 identifies the connected user terminal 210 (S604). By identifying the types of user terminals 210 including various types of computer devices, the user screen elements and control elements suitable for the connected computer devices are referred to by referring to the computer device-specific data 156 stored in the data area 150. The screen data 152 is used to construct a user screen and a user interface.

When the user terminal 210 is identified, the electronic authentication program 130 receives a personal identification number (PIN) from the user and confirms it (S606). Here, when the personal identification number (PIN) input from the user does not match the personal identification number (PIN) stored in the electronic authentication device 100, the operation of the electronic authentication program 130 is terminated. In addition, if the user fails to authenticate the personal identification number (PIN) more than a predetermined number of times by setting an error number or the like as a condition, the Internet service data 154 or the internal memory 164 in the electronic authentication device 100 is regarded as an hacking attempt. You can also add an automatic data deletion function that deletes all or some of the data from) to prevent third parties from attempting further hacking.

The electronic authentication program 130 determines whether the user performs the management setting by determining whether the user operates the electronic authentication device 100 for the first time or needs to change the user setting at the user's request (S608).

If management setting is necessary, electronic authentication management (S610), user environment setting (S612), and user data registration (S614) are selectively performed by the user's selection.

Here, the electronic certificate management (S610) automatically checks the version of the electronic certification program 130 when the version of the electronic certification program 130 is changed through the electronic certification management module 134 to update the change. to be.

User preferences (S612) is a function that allows the user to configure and set the main screen and menus, such as Internet services, basic menu configuration, user information receiving settings that are mainly used by the user, and user preferences (S612) If you do not do this, the default screen and menu are initially configured. The setting result is stored in the user setting data 158 through the data processing module 138.

User data registration (S614) provides a function to record the authentication data and login data for each Internet service providing service, etc. in the electronic authentication device (100). This function is connected to the smart card management module 136 and the user authentication unit 160, the encryption processing module 166, the data management module 168, the communication module 170, the internal memory 164 of the user authentication unit 160 In addition, the encryption processing module 166 of the user authentication unit 160 may register a one time password generator using a key value.

After the above process, the user setting program is driven based on the type of the user terminal 210 identified through step S602 and the user setting data 158 set through steps S610 to S614 (S616).

In operation S616, the user platform may be made of only the necessary menus according to the screen configuration of a specific Internet service designated by the user on the screen of the user terminal 210 to which the electronic authentication apparatus 100 is connected, the keyboard or the touch screen, and the like.

The electronic authentication program 130 runs the user setting program, and performs integrated server management for integrated management of user information and server information of users distributed in providing various Internet services (S618). This is to automatically or manually access each Internet service providing server 230 to obtain necessary information or to automatically or manually perform necessary Internet services according to a user's request.

After performing the integrated information management, and performs the set Internet service (S620). The Internet service can be performed immediately according to the rules of integrated server management or when a user needs it. The Internet service processing module 142 of the electronic authentication program 130 requests the Internet service providing server 230 to receive Internet service processing, and is notified of the processing result from the Internet service providing server 230. At this time, the Internet service processing request and the processing result notification can be implemented by the existing method transmitted in the form of a web page including HTML, or the standard professional method using XML. The processing result received by the simple standard text is referred to the screen data 152 and output to the user as a complete page. In addition, the Internet service includes a case where all user IDs, passwords, and certificates are used or partially simplified according to existing procedures. In this case, the necessary information may be automatically processed by using information previously registered in the internal memory 164 of the user authenticator 160.

When providing the Internet service to the user through the electronic authentication device 100 and the electronic authentication system 200 of the present invention as described above, it is possible to maximize the portability and ease of use while securing safety and security. In addition, it is possible to provide a user authentication with enhanced security in all processes from the Internet service providing server to the user's computer terminal.

In addition, the electronic authentication device 100 of the present invention, while securely storing information such as a public certificate and user information, Internet service password, etc. in the encrypted internal memory 164 of the user authentication unit 160, the flash memory unit 110 The electronic authentication program 130 and the data can be stored without restriction on the size, and the convenience of use can be improved at the same time.

In addition, it has a USB port for personal computers, personal portable information terminals, mobile communication terminals, card payment terminals, electronic cash registers, set-top boxes, teller machines and ATMs, ATMs, bill acceptors, and other automated teller machines. In order to provide an electronic authentication service by connecting the electronic authentication device 100 to various computer devices, the electronic authentication program 130 includes all executable files running in various operating systems and environments. In the interface, the authentication of the electronic authentication device 100 and the electronic authentication program 130 can be automatically executed to be easily applied. A personal computer and a personal information terminal supporting a USB interface recognize the electronic authentication device 100 through a USB port and automatically or manually operate the electronic authentication program 130 stored in the electronic authentication device 100. It can work. Mobile communication terminal, card payment terminal, electronic cash register, set-top box, teller terminal and cash dispenser, ATM, utility bill acceptor, etc. are automatically operated by the electronic authentication device 100 in its own operating program or electronic authentication in its own built-in program. And a module for reading the decryption and user information of the device 100.

In addition, the user can receive a variety of Internet services provided by using a single electronic authentication device 100, a plurality of only by using a public certificate and user information, passwords and one-time password stored in the electronic authentication device (100) It is very easy to access each of the Internet service providers and use the service.

In addition, in the present invention, a common Internet service can be processed by communicating with an Internet service providing server in a standard specialized format.

In addition, it is possible to provide a variety of applications using the electronic authentication program 130 and the data area 150 of the electronic authentication device 100, thereby integrating the user information of a number of Internet services used by individuals or companies In addition to the functions, it is possible to provide a function to support automatic usage processing such as advance notification and reservation according to various Internet service rules defined by the user.

In addition, when performing the Internet service, it can automatically save the confirmation to guarantee the results and provide various statistics, the user can not only check all the usage history on the computer device, but also the electronic authentication device in the card payment terminal It is possible to provide an application program such as selecting only a card having favorable payment terms or knowing a cumulative use amount until the use using only the information embedded in the 100.

The above description is merely illustrative of the technical idea of the present invention, and those skilled in the art to which the present invention pertains may make various modifications and changes without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention but to describe the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The protection scope of the present invention should be interpreted by the following claims, and all technical ideas within the equivalent scope should be interpreted as being included in the scope of the present invention.

As described above, according to the present invention, by providing a system for authenticating a server and a user by using a portable storage device having a security function, the user can safely carry personal authentication and user information, and anytime, anywhere By using the device, the Internet service can be used safely and conveniently.

In addition, by integrating and storing secure information such as fixed information and service usage information of individuals or companies distributed in each Internet service providing server into an electronic authentication device, it is safer and safer than using a simple medium to store or move. It is effective to increase portability.

In addition, while applying all the methods, such as certificates, security cards or one-time password generator used in the existing Internet services, only the electronic authentication unique number (CIN) and server authentication number (SIN), who can not be changed by third parties, By applying this known personal identification number (PIN), there is an advantage that it can perform safety, personal authentication and server authentication perfectly.

In addition, the electronic authentication program can be used to access the Internet service providing servers of various Internet service providers using a common screen and a method of use, and the individual or company distributed to each Internet service providing server provided by the electronic authentication program. It can provide the function to manage the authentication information integrally, and the analysis and planning function of the usage information.

Claims (22)

In the system for providing Internet service, It includes a flash memory unit in the portable storage device with security function, a user authentication unit in the portable storage device with security function, and an external communication terminal, and manages / stores various user information by operating the provided electronic authentication program. An electronic authentication device for verifying an Internet service providing server and providing the Internet service; Wired and wireless communication network for providing a wired and wireless communication path; A user terminal connected to the electronic authentication device through an external communication terminal provided and providing the Internet service via the wired / wireless communication network; Issuing, registering, and authenticating the electronic authentication device to newly issue the electronic authentication device to the user; when the electronic authentication device is connected through the wired / wireless communication network, after authenticating the electronic authentication device, At least one internet service providing server for providing the internet service; And Internet service providing terminal that provides an interface for the issuance and registration of the electronic authentication device in conjunction with the Internet service providing server Electronic authentication system comprising a. The method of claim 1, wherein the electronic authentication device, Electronic authentication system, characterized in that produced in the form of a USB memory stick attachable to the USIM memory and USIM slot. The method of claim 1, wherein the flash memory unit, A program area for storing the electronic authentication program; And Data area including screen data, internet service data, computer device-specific data and user setting data Electronic authentication system comprising a. The method according to claim 1 or 3, The electronic authentication program, when the electronic authentication device is connected to the user terminal, in conjunction with the Internet service providing server to authenticate the suitability and tampering of the Internet service providing server, using the user information and data stored in the data area Electronic authentication system, characterized in that to provide the Internet service. The method of claim 1, wherein the user information, Electronic authentication system comprising at least one of a public certificate, a user ID, password, user information and smart card information. The method of claim 1, wherein the user terminal, A personal computer (PC), a personal digital assistant (PDA), a mobile communication terminal, a mobile phone that can be connected to the Internet service providing server through the wired / wireless communication network. Card payment terminal, Point of Sale (POS), Set-Top Box, Set-Top Box, Cash Dispenser (CD), ATM (ATM) Automatic Teller Machine (ATM) and bill acceptor Electronic authentication system comprising a computer device having at least one or more of its own automatic computing function of the automated teller machine. The method of claim 1, wherein when the user terminal is a mobile phone, And separating the USIM portion of the electronic authentication device into the USIM slot of the mobile phone to provide the Internet service. The method of claim 1, wherein the electronic authentication system, The electronic authentication device by using a certification identification number (CIN), a personal identification number (PIN), a server identification number (SIN) stored in the electronic authentication device, the Electronic authentication system, characterized in that for authenticating a user and the Internet providing server. An apparatus for providing an Internet service connected to a user terminal having an external communication terminal such as a USB, comprising: a program area and screen data for storing an electronic authentication program for providing the Internet service, internet service data, and data for each computer device; A flash memory unit including a data area storing user setting data; A user authentication unit equipped with a chip operating system (COS) and a public key infrastructure (PKI) method and a secret key method encryption algorithm, and a memory area for storing user information of the user. ; And External communication terminal for connection with the user terminal Electronic authentication device comprising a. The method of claim 9, wherein the electronic authentication program, A function of recognizing a computing environment or recognizing the electronic authentication device to the user terminal so that the electronic authentication program can be executed according to the type of the user terminal to which the electronic authentication device is connected, and a personal identification number (PIN: Personal) A basic module for authenticating the user by checking an identification number and authenticating an internet service providing server by checking a server identification number (SIN); An electronic certification management module for checking a version of the electronic certification program and performing an update through a wired or wireless communication network; A smart card management module connected to a processor of the user authentication unit through a smart card interface to register, store, delete, and inquire the user information stored in the user authentication unit; A data processing module for managing / searching at least one of the screen data, the Internet service usage data, encryption data, various message data, and log data for record management required when providing the Internet service; Comprehensive management and output of the user information of the user interspersed with the provision of a plurality of Internet services, providing analysis of statistical information including the frequency of use of each Internet service provision, service type, according to the rules predefined by the user An integrated server management module that performs a function of performing / notifying a process to be executed; And An internet service processing module for processing the internet service requested by the user in association with an internet service processing module of an internet service providing server when the user uses the internet service Electronic authentication device comprising a. The method of claim 9, The screen data is information related to a screen required for each Internet service when providing the Internet service, the Internet service data is information related to an Internet service history, a processing result and a usage log, and data for each computer device identifies the user terminal. And information related to an input / output device of the user terminal and the user setting data are data relating to personal preference information and user specified content. The method of claim 9, wherein the user authentication unit, A built-in memory composed of one or more of its own CPU processor, RAM, ROM, and EEPROM, a cryptographic processing CPU, a cryptographic processing module, a data management module for managing the user information stored in the built-in memory, and a communication module supporting an external communication interface Electronic authentication device comprising a single chip. The method of claim 12, wherein the internal memory, Electronic authentication device, characterized in that for storing one or more of the user information of the Internet service security-related information and personal information, including a public certificate, a user ID, password, user information and one-time password. The method of claim 12, wherein the internal memory, It stores the Certification Identification Number (CIN), Personal Identification Number (PIN), and Server Identification Number (SIN). The electronic authentication unique number and personal identification number is generated only at the time of issuance of the electronic authentication device is an electronic authentication device, characterized in that stored in the internal memory of the user authentication unit. Electronic authentication device that stores the user's user information, certification identification number (CIN), personal identification number (PIN), server identification number (SIN), and electronic authentication program, user In an electronic authentication system including a terminal and an Internet service providing server, In the method of providing an Internet service using the Internet service providing server, (a) requesting the server identification number from the Internet service providing server when the electronic authentication program accesses the Internet service providing server; (b) informing the server identification number by the Internet providing server; (c) if the server identification number is authenticated, notifying the Internet service providing server of the processing result by the electronic authentication program; (d) the Internet service providing server requesting the digital authentication unique number from the electronic authentication program; (e) receiving, by the Internet service providing server, the Internet service request from the electronic authentication program when the electronic authentication unique number is registered; (f) the internet service providing server processing the internet service; And (g) the internet service providing server notifying the electronic authentication device of the processing result of the internet service; Internet service providing method comprising a. The method of claim 15, wherein the method is Before step (a) above, (a-1) identifying the user terminal when the electronic authentication device is connected to the user terminal; (a-2) the electronic authentication device driving the electronic authentication program for the user terminal and authenticating the user through the personal identification number; And (a-3) if the user authentication is successful in the step (a-2), the driven electronic authentication program accessing the internet service providing server according to the user's request Internet service providing method comprising a further. The method of claim 15, wherein the method is After step (c), (c1) checking, by the Internet service providing server, the electronic authentication unique number received from the electronic authentication program; And (c2) registering the electronic authentication unique number if the electronic authentication unique number is not registered in the Internet service providing server as a result of the checking in step (c1); Internet service providing method comprising a further. In an electronic authentication device that stores a user's user information, a Certification Identification Number (CIN), a Personal Identification Number (PIN), a Server Identification Number (SIN), and an electronic certification program, In the method connected to the user terminal to provide an Internet service through the interworking with the Internet service providing server, (a) identifying the user terminal when the electronic authentication device is connected to the user terminal; (b) the electronic authentication device driving the electronic authentication program for the user terminal and authenticating the user through the personal identification number; (c) if the user authentication is successful in step (b), the driven electronic authentication program accesses the Internet service providing server according to the user's request and performs server authentication through the server identification number. ; (d) the electronic authentication program performing a user authentication through the electronic authentication unique number by interworking with the internet service providing server after server authentication, and requesting the internet service according to the user's request; (e) the electronic authentication program interworking with the internet service providing server to process the internet service; And (f) the electronic certification program receiving a processing result of the Internet service from the Internet service providing server Internet service providing method comprising a. Electronic certification program that provides Internet services. (a) the ability to consolidate / save / manage / search / delete / update user information of users; (b) requesting / processing the Internet service by accessing a plurality of Internet service providing servers using the user information; (c) receiving a server authentication number from the Internet service providing server to perform authentication; (d) a function of performing authentication by transmitting an electronic authentication unique number to the Internet service providing server; (e) a function of authenticating the user using a personal identification number; And (f) a function of identifying the plurality of user terminals in connection with a plurality of user terminals and providing the Internet service in connection with the plurality of user terminals; And a recording medium having recorded thereon a computer readable program. The method of claim 19, wherein the user information, A recording medium recording a computer-readable program comprising at least one of a public certificate, a user ID, a password, user information, and smart card information. The method of claim 19, wherein the plurality of user terminals, A personal computer (PC), a personal digital assistant (PDA), a mobile communication terminal, a card payment terminal, and an electronic cash machine that can be connected to the Internet service providing server through the wired / wireless communication network. At least one of a point of sale (POS), a set-top box, a teller terminal and a cash dispenser (CD), an automatic teller machine (ATM) and a bill acceptor And a computer device having the above self computing function. A recording medium having recorded thereon a computer-readable program. The method of claim 19, wherein the electronic authentication program, A recording medium having recorded thereon a computer readable program, characterized in that for communicating with the plurality of user terminals via an external communication interface including a USIM and a USB.

Images