KR20090039526A - Apparatus and method for the password security on online - Google Patents

Abstract

A password security method on online and an apparatus for inputting a password for the discrimination of a user and preventing the exposure of the password are provided to prevent the password by encoding the password. If the input performance of a password is requested from a user terminal(100), an authentication server(200) produces the new correspondence value set corresponding to unit values comprising password. An authentication server produces the matched value set corresponding to unit values comprising password. Business information for authenticating to the encrypted correspondence value and password is transmitted from the user terminal to the certificate server. The certificate server decodes the encrypted correspondence value. The authentication server performs the task according to the business information.

Description

Apparatus and Method for The Password Security on Online}

The present invention relates to a password security method and an apparatus thereof online, and in particular, in the process of performing online banking work or logging in to access a specific account through the Internet, a user inputs a password for identification. The present invention relates to a security method and apparatus for preventing exposure of a password in a process of transmitting online.

Such a password is typically presented with a password input field on the user's terminal screen as shown in FIG. 1 and when the user directly inputs his password with a keyboard, the password is transmitted to the server side and compared with the information stored on the server side. Authentication is determined, and in transmitting the input password, it is common to transmit the encrypted password according to a predetermined encryption code in order to prevent the password from being exposed by hacking. The password will be restored.

However, in the conventional password security method, the password is still unexpectedly easily exposed by shoulder surfing to find out the password by stealing the user's password input over the shoulder. Was done.

Therefore, in order to prevent this, as shown in the Republic of Korea Patent Application Publication No. 10-2004-56273 shown in FIG. Even a technique for providing a corresponding password is provided.

However, this technique may prevent password exposure by primary shoulder surfing itself, but it is too easy to find the original password from a known corresponding password if the algorithm of the password corresponding value is exposed by other means such as screen capture. As a result, it was not a complete password security measure.

Above all, in all methods of inputting a password using an existing keyboard, an unencrypted password is exposed through keyboard hacking while the password is transmitted from the keyboard to the user terminal. Since it is defenseless in a wireless type keyboard, a fatal problem is revealed for password input through the keyboard.

An object of the present invention for solving the above problems is a password security method that is specially encrypted so that the original password can not be found even when exposed to various hacking, in particular to enter the password with a mouse without the risk of hacking and To provide the device.

In the online password security method according to an aspect of the present invention for achieving the above object, a new corresponding value corresponding to the unit values constituting the password in the authentication server when the password input is requested from the user terminal; Generating a set; Encrypting the corresponding set of values for each unit value and transmitting the encrypted values to a user terminal; When the user terminal receives a password from the user, transmitting the work information to be performed by authenticating the encrypted corresponding value and the password to the authentication server; And the authentication server decrypting the encrypted corresponding value as a password and performing a task according to the business information, thereby encrypting the password twice so that only the corresponding value is exposed even if the password is exposed by hacking. It is characterized in that the exposure of the.

Preferably, the authentication server generates a coded password input unit so that unit values constituting the password are arranged and an encrypted corresponding value corresponds to the unit value, and provides the user with the pointer selected on the screen. When the password is input from the user, the encrypted corresponding value is transmitted to the authentication server.

Preferably, the authentication server providing the password input unit to the user terminal may include setting a specific part capable of selecting a pointer to a password input device of a single image in which the unit values are arranged and correspondingly encrypted to the specific part. Coding a value; And providing the password input coded with the encrypted corresponding value to the user terminal.

Preferably, the specific part set for each unit value is set smaller than the area allocated to each unit value in the password input unit.

Preferably, the user terminal is characterized in that the change is not applied to the pointer even if the pointer on the screen is located in the specific portion.

Preferably, when the password is input from a user using the password input device, the user terminal displays the password input information on a display screen, but at the time when the password input information is displayed on the display screen from the input time of the password. It is characterized by applying a variable time delay.

Preferably, generating the password input unit and providing the password input unit to the user terminal may include changing the location information displayed on the screen whenever the password input is requested from the user terminal. It is characterized in that the position is different.

Preferably, the user terminal further comprises the step of receiving a selection from the user whether or not to receive the password by the pointer selection on the screen.

Preferably, the method may further include informing the user to select to input a password by selecting a pointer on the screen when the USB keyboard is connected to the user terminal by analyzing the keyboard type connected to the user terminal.

On the other hand, the password security device online in accordance with another aspect of the present invention for achieving the above object, when a password input operation of the remotely connected user is recognized, a new corresponding value set corresponding to the unit values constituting the password Generates and encrypts each unit value and transmits the encrypted information to the user terminal, and if the encrypted information corresponding to the password and the work information to be authenticated by the password are transmitted, the encrypted corresponding value is decrypted into a password and the information is transmitted to the work information. Authentication server performing the work according to; And receiving the encrypted corresponding value set from the authentication server according to a request for performing a task according to a user's password input, and when the password is input from the user, performing a task to be performed with the encrypted corresponding value corresponding to the input password. It includes a user terminal for transmitting information to the authentication server.

Preferably, the authentication server generates and provides a coded password input unit to the user terminal so that unit values constituting the password are arranged and an encrypted corresponding value corresponds to the unit value, and the user terminal selects a pointer on a screen. By receiving the password from the user characterized in that.

Preferably, in providing the password input unit to the user terminal, the authentication server sets a specific part capable of pointer selection to a password input unit of a single image in which the unit values are arranged, and encrypts the specific part. Characterized by providing a corresponding value.

Preferably, the authentication server, characterized in that for setting the specific portion set for each unit value in the password input unit smaller than the area assigned to each unit value.

Preferably, the user terminal is characterized in that the change is not applied to the pointer even if the pointer on the screen is located in the specific portion.

Preferably, when the password is input from a user using the password input device, the user terminal displays the password input information on a display screen, but at the time when the password input information is displayed on the display screen from the input time of the password. It is characterized by applying a variable time delay.

Preferably, the authentication server is provided to the user terminal by changing and coding on-screen display position information of the password input unit so that the absolute position of the password input unit on the user screen is changed every time a password input is requested from the user terminal. It is characterized by.

Preferably, the user terminal,

The user may be selected whether or not to receive the password by selecting a pointer on the screen.

Preferably, the user terminal is characterized in that notifying the user to select to enter a password by selecting a pointer on the screen if the keyboard is connected to the USB type.

Password security method and device online according to the present invention as described above, despite the various hacking means such as screen capture, memory hacking, transmission hacking, keyboard hacking, etc. to maximize the security by preventing the exposure of the password, 2 Since the password is transmitted by encryption in the middle, it prevents the forgery of data by man-in-the-middle-attack and improves the user's satisfaction. Since the user terminal does not require a separate installation program, there is an effect of increasing security while maintaining convenience and stability of the system.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, in describing in detail the operating principle of the preferred embodiment of the present invention, if it is determined that the detailed description of the related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

In addition, the same reference numerals are used for parts having similar functions and functions throughout the drawings.

The present invention is applied to all the Internet operations to enter a password for the user's own identification, this embodiment is representatively described for the online banking business through the Internet, so the password is the case of login for Internet banking and others You will be asked to confirm the remittance of your account.

3 is a diagram illustrating a system for maintaining password security in online banking over the Internet according to a preferred embodiment of the present invention.

As shown in FIG. 3, the user terminal 100 that accesses the online authentication server (or banking server) 200 and performs internet banking may perform a remittance operation for an Internet banking login and another person's account. If you want to perform, you can receive the encrypted corresponding value set from the authentication server 200, can perform Internet banking using this, by double encryption to convert the password to the corresponding value and encrypt again, by hacking Even if a password is leaked, only the corresponding value is exposed, thus keeping the password secure.

At this time, the password input according to the present invention is input by the selection of the pointer according to the use of the mouse, not the typing of the keyboard, for this purpose, instead of the keyboard as shown in FIG. It is preferable to inform the guide of inviting the user to input the password using a mouse. Therefore, the user can be directly selected to input the password using the mouse, and the password input device is presented on the screen, thereby enabling the password input according to the present invention. .

On the other hand, if it is determined through the system log analysis that the keyboard connected to the user terminal is a USB-type keyboard, it is more preferable to select the password input using the mouse instead of the keyboard by additionally notifying the risk.

The password input unit is updated by the random key generator whenever a password input page for internet banking is requested from the user terminal 100, that is, whenever a password input page for login or a password input page for remittance confirmation is requested. It is changed and created.

The password inputter depends on the type of unit value constituting the password, that is, letters or numbers, or a combination of letters and numbers. For example, in the case of a password for login, letters and numbers are combined, so numbers and letters as shown in FIG. In the case of a password input device marked with all and a password linked to a bank account, only a number is displayed as shown in FIG. 5 since only a number is combined, and a corresponding value corresponding to each unit value, for example, an alphabetic character or a special code is displayed. It is randomly corresponding to the number and transmitted from the authentication server in advance with encryption.

This is done by additionally setting information on the area where the pointer can be selected in the password input device with a single image and providing the same to the user terminal. More specifically, the area where the pointer can be selected for each unit value area presented in the password input device is provided. The coded information is set and randomly corresponds to the corresponding area, and the corresponding encrypted value is coded.In this case, the coded information is transmitted to the user terminal while being integrated into a single image of the password inputter, so that even if the password inputter image information is exposed, the coded information and coding is performed. The algorithm is not exposed.

On the other hand, if a user's pointer is selected for the password inputter, the encrypted corresponding value coded in the selected area is extracted and transmitted to the authentication server, so that the authentication server decrypts it. Even if a transmission hack is attempted in the network, only the encrypted counterparts are exposed to keep the password secure.

For example, if the password unit value is '1234567890', the random key generator generates 'ABCDEFGHIJ' corresponding to each number as the corresponding value. By coding, when an arbitrary password is input by the user, a corresponding 20-byte cipher value is transmitted from the user terminal to the authentication server, and only the corresponding value is exposed even if the data transmitted by the hack is exposed.

At this time, it is more preferable to add the following means to prevent the password from being exposed by a method such as shoulder surfing, screen capture, memory hacking, etc. at the time of user's password input.

First, even if the pointer is located in the area where the unit value can be selected by a mouse click on the password input screen, it is preferable not to change the shape or color of the pointer. In a typical Internet environment, when the pointer is located in a region where a user can select by mouse click, the shape changes to a palm shape. In the present invention, the pointer can be selected by any element such as color or sound. By not revealing the realm, it is possible to detect the change of the pointer by shoulder surfing and to infer the password.

At this time, the area where the pointer can be selected is made smaller than the area assigned to each unit value on the password input device, thereby making the interval between areas more preferable to minimize the user input error due to the change of the pointer.

In addition, when a password is input by selecting a pointer according to a mouse click, the user's display screen indirectly indicates that the password has been input by '*' or an arbitrary code in the password input field. More preferably, the password input information is displayed on the display screen of the user later. This is to prevent the risk of the password being leaked from the pointer position at the moment when '*' is displayed by the hacking of the screen information when the password is displayed as soon as the password is input. Even if leaked to the outside, where the pointer is located at the time of '*' is displayed, it is irrelevant to the password to prevent the leakage of the password. In this case, it is more preferable that the delay time is not constant but is randomly changed.

Meanwhile, the password input unit is displayed at a specific position on the password input page for login or the password input page for remittance confirmation, which means that absolute coordinates are constant on the entire page. In this case, since there is a possibility that the password can be inferred from the absolute coordinate information on which the pointer is placed at the moment the password is input, in order to solve this problem, the absolute position of the password input unit is changed whenever a relevant page is requested. In this case, it is preferable that the absolute coordinate information of the pointer be changed even if the same password is clicked.

From this, the user terminal 100, when a password is input from the user using the password input device as described above, the password is input as a corresponding value encrypted in advance in the input information to be transmitted, the authentication server in the state of the encrypted corresponding value in this way Account information is sent to 200.

Therefore, the user terminal 100 transmits the password to the authentication server 200 without the risk of leakage, so that the authentication server 200 performs an online banking task.

7 is a flowchart illustrating a method of performing online banking by the user terminal 100 through the Internet according to an exemplary embodiment of the present invention.

A user terminal accessing a mobile or a website and performing an online banking service performs login authentication on the page illustrated in FIG. 4 (S101). By selecting (S102), the user selects a pointer on the screen to a provided password input device (S103). If the authentication fails by entering the password (S104), a separate restriction policy can be set to terminate the use or provide an opportunity for re-authentication.If the authentication is successful, a service such as account inquiry or transaction history can be used. Normal Internet banking service is performed (S106).

In addition, when the user terminal 100 proceeds with the remittance operation in connection with the transfer or withdrawal according to the successful authentication, the user terminal 100 is selected to receive a password with the user's mouse in the remittance page (S107) (S108) authentication server 200 The password input unit encoded with the corresponding value encrypted by the random key generator is provided from the authentication server 200 and displayed on the display screen (S109).

When the user terminal 100 receives a password from the user by using the password input unit, the user terminal 100 extracts an encrypted corresponding value and stores it in memory as input information to be transmitted (S110).

When the user terminal 100 is required to perform a transfer, the user terminal 100 transmits the encrypted password corresponding value to the authentication server 200 together with the information for performing the transfer to authenticate the corresponding password so that the transfer is performed (S112). ).

Thereafter, the user terminal 100 may receive the transfer result information from the authentication server 200 that has completed the transfer (S113), and may terminate the series of transfer services through internet banking.

8 is a flowchart illustrating a password inputter generation method of the authentication server 200 according to an exemplary embodiment of the present invention.

As shown in FIG. 8, when the authentication server 200 recognizes the progress of login or remittance operation through online banking from any connected user terminal 100 (S201), each number is driven by driving a random key generator including the random number generator. Alternatively, a character code or a special code is generated and encrypted as a corresponding value corresponding to a character, for example, and then coded by setting a specific area selectable with a pointer in a password input device consisting of one image (S202).

The authentication server 200 transmits the password input device including the setting information of the specific area to the user terminal 100 to perform the remittance operation (S203), and the encrypted password corresponding value is the user terminal 100. Check whether it is transmitted from the (S204).

When the encrypted password corresponding value is transmitted from the user terminal 100, the authentication server 200 decrypts the corresponding value (S205), and then the login information or the remittance information transmitted together with the encrypted password from the user terminal 100. Check whether the correct (S206), if correct, perform login authentication or transfer (S207).

In addition, the authentication server 200 provides the user terminal 100 with login or transfer result information according to the authentication (S208).

The present invention described above is not limited to the above-described embodiments and the accompanying drawings, and it is common in the art that various substitutions, modifications, and changes can be made without departing from the technical spirit of the present invention. It will be apparent to those skilled in the art.

1 is an exemplary diagram of a screen for password input in conventional online banking.

2 is an illustration of a corresponding password presented for conventional password security.

3 illustrates a system for maintaining password security in online banking over the Internet in accordance with one preferred embodiment of the present invention.

Figure 4 is an illustration of a password input screen for login in the case of online banking via the Internet in accordance with a preferred embodiment of the present invention.

Figure 5 is an illustration of a password input screen for the remittance work in the case of online banking via the Internet in accordance with a preferred embodiment of the present invention.

6 is an exemplary view showing that the position of the password input unit in the case of online banking through the Internet according to an embodiment of the present invention.

7 is a flowchart illustrating an internet banking method of a user terminal according to an exemplary embodiment of the present invention.

8 is a flowchart illustrating a method for generating a password input unit of an authentication server according to an exemplary embodiment of the present invention.

Claims (18)

When a password input is requested from a user terminal, Generating, by the authentication server, a new corresponding value set corresponding to the unit values constituting the password; Encrypting the corresponding set of values for each unit value and transmitting the encrypted values to a user terminal; When the user terminal receives a password from the user, transmitting the work information to be performed by authenticating the encrypted corresponding value and the password to the authentication server; And By the authentication server decrypting the encrypted corresponding value with a password, and performing a task according to the task information, The password security method online, characterized in that the password is prevented because only the corresponding value is exposed even if the password is exposed by hacking by encrypting the password twice. The method of claim 1, The authentication server generates a coded password input unit so that the unit values constituting the password are arranged and the encrypted corresponding value corresponds to the unit value, and provides the password input unit to the user terminal, whereby the user terminal is selected by the pointer selection on the screen. If the password is received from the password security method online, characterized in that for transmitting the encrypted corresponding value to the authentication server. The method of claim 2, The authentication server provides the password input unit to the user terminal, Setting a specific part capable of selecting a pointer in a password input unit of a single image in which the unit values are arranged and coding a corresponding value encrypted in the specific part; And And providing a password input coded with the encrypted corresponding value to the user terminal. The method of claim 3, The specific part set for each unit value is set smaller than the area allocated to each unit value in a password input method. The method of claim 4, wherein The user terminal, A password security method for on-line, characterized in that the change is not applied to the pointer even if the pointer on the screen is located in the specific part. The method of claim 2, The user terminal, When the password is input from the user using the password input device, the password input information is displayed on a display screen, and the variable time delay is applied from a time point at which the password is input to a time point at which the password input information is displayed on the display screen. Featured password security method online. The method of claim 2, Generating and providing the password input unit to the user terminal, And a password inputter changes location information displayed on a screen whenever a password input is requested from a user terminal so that the absolute position of the password inputter on the user screen is changed. The method of claim 2, The user terminal further comprises the step of receiving a selection from the user whether or not to receive the password by the pointer selection on the screen. The method of claim 8, And analyzing the keyboard type connected to the user terminal and informing the user to select to input a password by selecting a pointer on the screen when the USB type is connected to the USB terminal. When the password input of the remotely connected user is recognized, a new corresponding value set corresponding to the unit values constituting the password is generated, encrypted for each unit value, and transmitted to the user terminal, and the encrypted corresponding value and password corresponding to the password. An authentication server for decrypting an encrypted corresponding value with a password and performing a task according to the task information when the task information to be authenticated and performed is transmitted; And When the user receives the encrypted corresponding set of values from the authentication server according to a task execution request according to the user's password input, and a password is input from the user, the encrypted corresponding value corresponding to the input password and the task information to be performed By including a user terminal for transmitting to the authentication server, The password security device on-line, characterized in that the password is double-encrypted so that only the corresponding value is exposed even if the password is exposed by hacking. The method of claim 10, The authentication server generates and provides a coded password input unit so that unit values constituting the password are arranged and an encrypted corresponding value corresponds to the unit value, And the user terminal receives the password from a user by selecting a pointer on a screen. The method of claim 11, The authentication server, In providing the password input unit to the user terminal, And a specific part capable of selecting a pointer in a password input device having a single image in which the unit values are arranged, and providing a coded corresponding value encrypted in the specific part. The method of claim 12, The authentication server, And a specific portion set for each unit value in the password input unit is set smaller than an area allocated to each unit value. The method of claim 13, The user terminal, A password security device for on-line, characterized in that the change is not applied to the pointer even if the pointer on the screen is located in the specific part. The method of claim 11, The user terminal, When the password is input from the user using the password input device, the password input information is displayed on the display screen, and the variable time delay is applied from the time point at which the password is input to the time point at which the password input information is displayed on the display screen. Password security device online, characterized in that. The method of claim 11, The authentication server, Online password security, characterized in that provided to the user terminal by changing and coding the display position information on the screen of the password input unit so that the absolute position of the password input unit on the user screen is changed each time a password input is requested from the user terminal. Device. The method of claim 11, The user terminal, And a user is selected whether or not to receive the password by selection of a pointer on a screen. The method of claim 17, The user terminal, The password security device of claim 1, wherein if the connected keyboard is a USB type, the user is informed to select to input a password by selecting a pointer on the screen.

Images