KR20090028067A - Apparatus and method for the account information security on online - Google Patents

Abstract

An online account information security method and an apparatus thereof for preventing memory hacking of account information are provided to perform normal account transfer without influence of hacking by encoding and transmitting real account information to a server. If an authentication server(200) recognizes the remittance of a user remotely accesses, corresponding value corresponding to account information is generated and transmitted to a user terminal. If the correspondence value and the encrypted remittance information corresponding to the account information are transmitted, remittance information is performed according to remittance information. A user terminal(100) receives encoded correspondence value from the authentication server. The correspondence value and the encrypted remittance information corresponding to the inputted transferred account information are transmitted to the certificate server.

Description

Apparatus and Method for The Account Information Security on Online}

The present invention relates to a method and a device for securing account information online, and in particular, it prevents the problem of remittance to the account of another person rather than the actual transfer account by hacking through encryption when transmitting account information for internet banking. The present invention relates to a method and apparatus for securing account information online to prevent account information from being captured through screen capture and memory hacking.

In order to proceed with Internet banking, the pre-verification process of the user and the user account is generally performed through the authentication process, and only when such authentication process is normally confirmed, the user transfers or transfers from his account to another account. And so on.

However, as a problem that occurs during the transfer process, there has been a problem of remittance to the account of another person instead of the actual transfer account due to hacking, which is a problem that occurs after the pre-authentication process of Internet banking. There is a problem that the authentication server is not easy to check.

That is, as the hacking technique of various methods is developed, the information is hacked in the process of inputting and transmitting the account information through the transfer as described above, such information is reprocessed and modified into other account information, and then the changed information is banked. As a result of the transmission to the server, a serious problem arises in that the transfer operation proceeds to a third party account that the user does not want.

This is useful for various hacking attacks, including sniffing such as eavesdropping on network traffic or spoofing as a counterfeit technique to perturb a network environment based on reliability. Internet banking service is recognized after the security number is input through PC-OTP, etc., but the transfer and remittance are not transferred to the normally entered account, but are transferred to a completely different account. There is no countermeasure against the problem, the difficulty of proof of responsibility due to the above-mentioned problem, and the fact that the fact that the hacked is not known as soon as possible can be turned into a serious social problem, which can cause a wave in the national economy.

An object of the present invention for solving the above problems, the online account for making the normal account transfer without the effect of hacking by encrypting the actual transfer account information that the user wants to transfer to the server when Internet banking An information security method and apparatus are provided.

Account information security method online in accordance with an aspect of the present invention for achieving the above object, when a transfer request is requested from the user terminal, a new correspondence corresponding to the unit values of the authentication server comprises the account information Generating a set of values; Encrypting the corresponding set of values for each unit value and transmitting the encrypted values to a user terminal; When the user terminal receives the transfer account information from the user, transmitting the encrypted corresponding value and remittance information to be performed to the authentication server; And decrypting, by the authentication server, the encrypted corresponding value into transfer account information, and performing a transfer operation to the transfer account information according to the transfer information, wherein the authentication server comprises a unit value constituting the account information. Generate and provide to the user terminal a randomly arranged account information input unit classified into at least two different image types so that the user terminal receives the transfer account information from the user by selecting a pointer on a screen. It is done by

Preferably, the authentication server providing the account information input unit to the user terminal, the account information input unit of a single image of the unit value is arranged randomly arranged in at least two different image types and the pointer Setting a selectable part; And providing the account information input unit including the set specific part information to the user terminal.

Preferably, when the user terminal receives the transfer account information using the account information input device provided from the authentication server from the user, the received transfer account information is displayed on the display screen, the alternative area from the authentication server of the account information input device The unit value corresponding to the region designated as is further characterized in that it further comprises the step of displaying by replacing with any code.

On the other hand, the account information security device online in accordance with another aspect of the present invention for achieving the above object, if a remittance operation of a remotely connected user is recognized, a new corresponding value corresponding to the unit values constituting the account information Authentication for generating a set and encrypting for each unit value and transmitting it to the user terminal, and if the encrypted correspondence value and the remittance information corresponding to the account information are transmitted, perform the remittance to the decrypted transfer account information according to the remittance information. server; And receiving the encrypted corresponding value set from the authentication server according to the user's request for remittance operation during internet banking, and when the transfer account information to perform the remittance operation is input from the user, it corresponds to the entered transfer account information. And a user terminal for transmitting the encrypted corresponding value and remittance information to be performed to the authentication server, wherein the authentication server randomly arranges the unit values constituting the account information into at least two different image types. It is characterized in that the generated account information input unit is provided to the user terminal, wherein the user terminal receives the transfer account information from the user by selecting a pointer on the screen.

Preferably, in providing the account information input unit to the user terminal, the authentication server forms an account information input unit in which the unit values classified into at least two different image types are randomly arranged in a single image and pointer selection is performed. It is possible to set a specific part as possible and provide an account information input device including the set specific part information to the user terminal.

Preferably, when the transfer account information to perform the remittance operation is input from the user using the account information input device, the user terminal displays the input transfer account information on the display screen, authentication of the account information input machine The unit value corresponding to the area designated as the replacement area from the server is displayed by an arbitrary code.

Account information security method and device online according to the present invention as described above to maximize the security of the account information by preventing screen capture, memory hacking and transmission hacking for transfer account information when Internet banking, It has the effect of improving the user's satisfaction, and since all the preparation necessary for encryption is provided from the server, the user terminal does not need a separate installation program, which not only increases convenience and security, but also randomly inputs the account information input unit. Since the arranged unit values are classified by images having a certain rule, there is an effect of easily finding the desired unit values.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, in describing in detail the operating principle of the preferred embodiment of the present invention, if it is determined that the detailed description of the related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

In addition, the same reference numerals are used for parts having similar functions and functions throughout the drawings.

1 is a diagram illustrating a system for maintaining security of account information online according to a preferred embodiment of the present invention.

As shown in FIG. 1, when the user terminal 100 accesses an online authentication server (or banking server) 200 and performs internet banking, it is necessary to perform a remittance operation for another person's account. The server 200 may receive the encrypted corresponding value set, and perform the transfer using the same.

In this case, the payment account information for the other person's account may be directly input by typing the keyboard, but as shown in FIG. 2, the account information input may be received by selecting a pointer from the account information input unit displayed on the screen. At this time, whether to use the account information input unit may be determined by the user.

Here, the account information input unit is changed and generated every time by the random key generator whenever a session signal is generated by the remittance operation of the user terminal 100.

In addition, the account information input unit is a unit value constituting the account information, in particular, a series of numbers of '0' ~ '9' are arranged randomly, in this case corresponding values corresponding to each number, for example, English letters to each number It is randomly matched and transmitted from the authentication server in advance with encryption.

That is, the present invention operates the random key generator of the authentication server 200 to randomly display a series of numbers '0' to '9' in the account information input unit.

As shown in FIG. 3, the image information is randomly combined with images of the numbers '0' to '9' in the account information input unit to form a single image. In this case, information about an area where a pointer is selectable is additionally set. By providing the user terminal.

At this time, the image of each number is classified into at least two or more different images, that is, a color or a pattern type. For example, the numbers of '1' to '4' are black letters on a white background and '0' as shown in FIG. And the numbers '5' to '9' have an image of white letters on a black background, the user can intuitively separate a relatively low number from a relatively high number even if the numbers are randomly arranged.

As another example, although not shown, each of the three categories, '1' to '3', '4' to '6', and '7' to '0', has different colors or patterns. In addition, it is possible to make various changes such that the background color gradually decreases from white to black as the number increases from '0' to '9'.

Furthermore, the account information input device of the present invention is not only randomly generated and arranged each number each time, but also as an arbitrary part of the account information input device, for example, the bottom two lines on the keypad, any vertical two lines, diagonal lines, etc. from the authentication server. Designated as an alternative area, when the numbers corresponding to the area are clicked by the user, '*' or any sign is displayed on the user's display screen, thereby preventing all account information from being displayed on the screen. Hacking by screen capture is prevented.

From this, the user terminal 100, when the transfer account information is input from the user using the account information input unit as described above, the account information is input in a corresponding value encrypted in advance in the input information to be transmitted, the encrypted value of the corresponding value The account information is transmitted to the authentication server 200 in a state.

Therefore, the user terminal 100 may safely transmit the transfer account information to the authentication server 200 without the influence of hacking such as MITM, so that the transfer of the transfer account information from the authentication server 200 can be performed.

For example, when the account information input device as shown in FIG. 2 is presented and the account information of '1234567890' is inputted, '1234 * 6 *** 0' is displayed as the payment account information on the screen, and the actual transmission is performed. Account information is encrypted information of the corresponding value corresponding to '1234567890' is transmitted.

On the other hand, the account information selected from the 'favorite account information' provided by the Internet banking service is also displayed with a random code for the number of the alternative area of the proposed account information input device. For example, it is displayed as 'Kookmin Bank 2 * 4-66-** 21 Hong Gil-dong' and 'Kookmin Bank ** 2- * 3-1221 Kim Gap-soon'.

From this, even if the transfer account information stored in the 'favorite account information', all account information is prevented from being displayed on the screen, so that hacking by memory hacking or screen capture can be prevented.

In addition, it is also preferable to prevent the account information from being hacked as the absolute coordinates on the screen at the time of pointer selection are leaked by changing the position of the account information input unit whenever the session signal is generated by the remittance operation of the user terminal.

It is also desirable to prevent hacking by estimating the account information at the pointer position by capturing the screen at the moment when the account information is displayed by providing a time interval at the time of pointer selection and when the account information is displayed.

In addition, even if the pointer is located in a specific area on the account information input device, it is desirable to minimize the possibility of account information leakage due to shoulder surfing by preventing the display of shapes, colors, etc. from changing.

4 is a flowchart illustrating an internet banking method of the user terminal 100 according to an exemplary embodiment of the present invention.

When a user terminal performing an Internet banking service by accessing a mobile or a website wants to input transfer account information by selecting a pointer on a screen, as shown in FIG. 4, the user terminal 100 performs a user's pre-authentication procedure. Is performed (S101), if authentication according to the authentication process is not completed, a separate restriction policy is set to terminate the use or provide an opportunity for re-authentication, and when authentication is completed, look up an account inquiry or transaction history. Normal Internet banking services that can use the service, such as to be performed (S102).

In addition, when the user terminal 100 performs the remittance operation in connection with the transfer or deposit or withdrawal upon completion of the authentication, when the user does not use the service through the account input through checking whether the account is input, other services Providing information to use and performing a method of using a conventional Internet banking service to continue the process of termination (S103).

Meanwhile, when the user terminal 100 intends to proceed with the remittance operation according to the completion of authentication, the authentication server 200 generates an account information input device in which numbers are randomly arranged by the random key generator of the authentication server 200 or the banking server. It is received from the display screen to display (S104).

Then, the user terminal 100 receives the transfer account information using the account information input device from the user (S105).

Accordingly, the user terminal 100 displays the transfer account information input from the user on the display screen (S106), so that the number corresponding to the alternative area of the account information input device is displayed as '*' or any code. do. That is, the entire account information is not displayed as numbers but is partially displayed.

The user terminal 100 extracts the transfer account information input from the user from the encrypted corresponding value set transmitted from the authentication server and stores the encrypted account information corresponding value in the memory as input information to be transmitted (S107).

When the user terminal 100 is required to perform a transfer (S108), the user terminal 100 transmits the encrypted account information corresponding value to the authentication server 200 so that the transfer to the corresponding account information is performed (S109). Here, the user terminal 100 transmits the remittance information for performing the remittance to the authentication server 200 together with the encrypted account information corresponding value.

Thereafter, the user terminal 100 receives the transfer result information from the authentication server 200 that has completed the transfer (S110), and may terminate the series of transfer services through internet banking.

5 is a flowchart illustrating a method of generating an account information input unit of the authentication server 200 according to an exemplary embodiment of the present invention.

As shown in Figure 5, the authentication server 200 when the progress of the transfer operation through the Internet banking from any of the connected user terminal 100 is recognized (S201), by driving a random key generator to include corresponding to each number Generate a character set value with the corresponding value and encrypt it, and then randomly arrange numerical images of '0' to '9' classified into at least two or more different images, color or pattern type, into an account information input unit. (S202) In this case, the specific area to be selected as the pointer in the account information input image is set, and the specific area is smaller than the image of each number so that the space between the numbers is wider than the image appears. It is desirable to minimize the possible errors in the selection.

The authentication server 200 selects and sets an alternative area to be displayed by '*' or any code on the user display screen from the account information input unit (S203).

The authentication server 200 transmits the account information input device including the setting information of the specific part to the user terminal 100 to proceed with the remittance operation (S204), and the corresponding encrypted account information value is the user terminal. It is checked whether or not it is transmitted from 100 (S205).

When the encrypted transfer account information corresponding value is transmitted from the user terminal 100, the authentication server 200 decrypts the corresponding value (S206), and then transfers the transfer with the encrypted transfer account information from the user terminal 100. In accordance with the information is sent to the decrypted account information (S207).

In addition, the authentication server 200 provides the transfer result information according to the transfer to the user terminal 100 (S208).

The present invention described above is not limited to the above-described embodiments and the accompanying drawings, and it is common in the art that various substitutions, modifications, and changes can be made without departing from the technical spirit of the present invention. It will be apparent to those skilled in the art.

1 is a view showing a system for maintaining the security of account information on the online according to an embodiment of the present invention,

2 is a diagram illustrating an account information input screen according to an embodiment of the present invention;

3 is a view showing a process of generating an account information input unit according to an embodiment of the present invention;

4 is a flowchart illustrating an internet banking method of a user terminal according to an exemplary embodiment of the present invention.

5 is a flowchart illustrating a method of generating an account information input unit of an authentication server according to an exemplary embodiment of the present invention.

Claims (6)

When a remittance operation is requested from the user terminal, Generating, by the authentication server, a new corresponding value set corresponding to the unit values constituting the account information; Encrypting the corresponding set of values for each unit value and transmitting the encrypted values to a user terminal; When the user terminal receives the transfer account information from the user, transmitting the encrypted corresponding value and remittance information to be performed to the authentication server; And Wherein the authentication server decrypts the encrypted corresponding value to the transfer account information, and performing the transfer operation to the transfer account information according to the transfer information, The authentication server generates an account information input unit that is randomly arranged with unit values constituting the account information being classified into at least two or more different image types, and provides the user information to the user terminal by selecting a pointer on the screen. Account information security method, characterized in that to receive the transfer account information from the user. The method of claim 1, The authentication server provides the account information input device to the user terminal, Forming an account information input unit of a single image in which the unit values classified into at least two different image types are randomly arranged, and setting a specific portion capable of selecting a pointer; And And providing the account information input unit including the set specific part information to the user terminal. The method of claim 2, When the user terminal receives the transfer account information using the account information input unit provided from the authentication server from the user, and displays the received transfer account information on the display screen, And displaying the unit value corresponding to the area designated as the replacement area from the authentication server in the account information input unit by replacing it with an arbitrary code. When the remittance operation of the remotely connected user is recognized, a new corresponding value set corresponding to the unit values constituting the account information is generated, encrypted for each unit value and transmitted to the user terminal, and the encrypted corresponding value corresponding to the account information and An authentication server for transmitting money to the decrypted transfer account information according to the money transfer information when money transfer information is transmitted; And When receiving the encrypted corresponding value set from the authentication server according to the user's request for remittance operation during internet banking, and the transfer account information to perform the remittance operation is input from the user, it corresponds to the input transfer account information. It includes a user terminal for transmitting the encrypted corresponding value and the transfer information to be performed to the authentication server, The authentication server generates an account information input unit which is randomly arranged while the unit values constituting the account information are classified into at least two or more different image types, and provides them to the user terminal. And the user terminal receives the transfer account information from the user by selecting a pointer on the screen. The method of claim 4, wherein The authentication server, In providing the account information input unit to the user terminal, the account information input unit is arranged randomly arranged in at least two different image types in a single image, and a specific portion capable of pointer selection is set, and the set The account information security device online, characterized by providing an account information input device including specific part information to the user terminal. The method of claim 5, The user terminal, When the transfer account information to perform the remittance operation is input from the user using the account information input device, the transferred transfer account information is displayed on the display screen, and corresponds to the area designated as an alternative area by the authentication server in the account information input device. And a unit code for displaying the unit value.

Images