KR20090096258A - user authentication method and system using detour network based on the one time password - Google Patents

Abstract

An authentication method and a system supporting the same by using a temporary password using bypass network blocking the attack of the hacker are provided to reinforce security by performing authentication about composition element. A system supporting an authentication method of a temporary password base using a bypass network comprises a client terminal(100), a service server(200), an OTP certificate server(300), an SMS or an ARS server(400), a wire/wireless terminal(500) and an OTP generator(600). According to the service server is the service offer request of the client terminal, the contents relating to service is provided. The OTP certificate server generates the challenge of temporary password. The SMS or the ARS server receives the transmitted OTP information. The wire/wireless terminal is used in order to transmit the OTP information. The OTP generator altogether includes a response mode and the time synchronization mode in order to produce the temporary password.

Description

One-time password based authentication method using bypass network and system supporting it {user authentication method and system using detour network based on the one time password}

The present invention relates to a one-time password-based user authentication method and system in an environment where a client and a service server are connected.

In general, one time password (OTP) systems may be classified into a challenge-response type and a time synchronized type. In order to use an OTP, it is common to use an OTP generator. The OTP generator is a portable device that can be carried by the user. In the case of the challenge-response method, the OTP generator is configured to derive the response (one-time password) by inputting the challenge of the server. Is displayed.

In the challenge-response one-time password (OTP), when a client terminal requests a connection to a server, the server transmits a challenge of several bytes to the client terminal, and the client terminal is shared with the authentication server together with the challenge. By combining the OTP generator serial number and organization code, a hash function is used to derive a response of several bytes. This response is a disposable password (OTP).

Challenge-response disposable password generation method:

Where H () is a one-way hash function, C is a challenge, S is a serial number shared with the OTP generator and the server, and is given at the time of issuing the OTP generator. R is an organization code and other reservation code. In addition, A | B indicates that the data blocks A and B are connected to each other to form one data block. The hash function is a one-way function that outputs data of a predetermined size (usually 128 to 160 bits) for a large sized input data. The hash functions widely used include MD5, SHA, and SHA1. If necessary, a new type of hash function can be implemented, but since it takes a lot of time for security and performance evaluation, it is stable to use a proven hash function.

If the response value derived for the challenge is sent to the server through a one-time password (OTP) by the user requesting access, the server authenticates the client terminal if the received response value is equal to the response value derived by the server. Subsequent service proceeds.

Unlike the challenge-response method, the time-synchronous one-time password (OTP) continuously generates the one-time password (OTP) for authentication according to a certain time period by sharing the synchronized time information between the server and the one-time password generator. That's the way it is. The time-synchronous one-time password (OTP) is derived as follows.

How to create a one-time password for time synchronization

Where T is the time shared with the server, S is the OTP generator and serial number shared with the server, and R is the institution code and reservation code.

In the challenge-response method, the time error between the server and the OTP generator does not affect the authentication, but the process of receiving the response from the server is added. In the time-synchronous method, the password is acquired and authenticated without receiving the challenge. There is an advantage in that it can be received, but there is a disadvantage in that a time width for valid authentication can be denied when time error with the server is accumulated.

One-time password (OTP) is a method that improves the weakness of the static password, which has a high chance of being exposed from the third party between the server and the user PC due to the long password replacement cycle. It is recognized as an essential means of containment.

One-time password generator (OTP) is a portable device that is independent of the client terminal.It is equipped with a hash function algorithm for generating one-time password on the user's mobile phone to support one-time password generation. Recently introduced.

An authentication method using a one-time password is used as an authentication means in financial transactions, including access control of a security system, and internet banking. Taking the Internet banking service as an example, the flow of a service related to an authentication system using a conventional OTP is as follows.

When user PC sends user ID and password to service internet banking server and logs in, general service such as inquiry can be received. When requesting a service with a high security level such as account transfer, the Internet banking server requests the OTP authentication server to generate a challenge, and the OTP authentication server generates a challenge and sends it to the service server ( In the case of time synchronization, the step of generating and transmitting a challenge may be omitted). The internet banking server sends this challenge to the user's PC. The user enters the challenge into an OPT generator (sometimes implemented as a standalone handheld device or a mobile phone) and then derives a response. The user PC receives the response from the user and sends it to the Internet banking server. The Internet banking server sends the response back to the one time password (OTP) authentication server. The one time password (OTP) authentication server derives the response and the received response. In the same case, it notifies the internet banking server of authentication success and provides high security service requested by the user.

Recent techniques related to disposable passwords are disclosed in Korean Patent Publication No. 10-2007-0077569 (prior art document 1) and US Patent Publication No. US2006 / 0136739 (prior art document 2).

Prior Art Document 1 relates to a one-time password service system and method using a mobile phone. When an OTP authentication server generates a challenge, it transmits it to a mobile phone through an SMS server and uses a one-time password generator implemented in the mobile phone to respond, that is, one-time password ( OTP) is derived and the one-time password is transmitted to the server through the user PC to authenticate the user. This method makes it easy for the user to receive the challenge and derive the response, and has some security enhancements.

In addition, the prior art document 2 relates to a method and apparatus for generating a one-time password in a portable mobile device, receives a response for generating a one-time password from the global authentication server, generates a one-time password using it and transmits it through a business client PC By performing the user authentication (see page 2) as a core configuration, the core configuration is similar to the prior art document 1. These prior art documents are more secure in terms of the complex use of wireless and wired networks, and can be said to be more advanced than the technology of transmitting and receiving a single-use password only through a single network connected to a client PC. .

Despite such technical progress, the authentication method of the service server using the conventional one-time password (OTP) proposed by the prior art document 1-2 provides a relatively strong security, but the Trojan (the hackers injected into the user's PC) Recently, it has been known that such a one-time encryption system can be incapacitated when a Taojan Horse) hacking tool is installed and secured. The hacker who guides the Trojan-type hacking tool to be installed on the user's PC intercepts the one-time password (OTP) input by the user through kernel hooking or keyboard hooking. Thereafter, before the user inputs, the OTP of the user's PC is modulated to another value so that the disposable password input on the user PC has failed. After that, within the validity period of the one-time password (usually set to 1 minute), the hacker transmits the one-time password that he intercepted to the service server and receives the one-time password authentication to proceed with the desired service. This flow is not merely theoretical, but recent news reports show that these attacks have been carried out by Chinese hackers several times, with multiple users being transferred from their accounts to third-party accounts they have no idea.

When such a Trojan-type hacking tool is planted, both the challenge-response method and the time-synchronized one-time password (OTP) have the same vulnerability. Even if it receives a challenge using a mobile phone as in the prior art document 1-2, it is necessary to intercept the hacker who is taking control of the user PC, which is because the user must eventually enter the disposable password into the user PC. Therefore, the OTP-related authentication system proposed so far is meaningless to authenticate using OTP when a hacking tool in the form of a Trojan horse takes control of the user's PC.

When a Trojan-type hacking tool is planted in a client terminal, both the challenge-response method and the time-synchronized one-time password (OTP) have the same weakness, and receive the challenge using a mobile phone as in the prior art document 1-2. However, in the end, the one-time password must be entered into the user's PC, so it has to be intercepted by a hacker who takes control of the user's PC. It becomes pointless. Therefore, it is time for a new technology that can fundamentally solve the problem of the OTP authentication system.

Therefore, the present invention is derived to block the hacker's attack using the Trojan-type hacking tool, and the generated one-time password (OTP) is not transmitted through the network to which the client terminal is connected, but through a bypass network prepared separately. If there is a hacker who controls the client's PC by using a Trojan horse type hacking tool by sending it, the attacker's attack is possible by transmitting and authenticating the one time password through the bypass network bypassing this control. Configure to contain. This method is a generator for generating one-time passwords, a bypass network for sending one-time passwords to SMS or ARS, a wired network for wireless networks and landlines, and an SMS or ARS server for their connection, and received one-time passwords. It is configured using OTP authentication server for authenticating.

By sending a one-time password to the OTP authentication server through a heterogeneous bypass network instead of the network to which the client terminal is connected, an authentication system that can be attacked by a Trojan-type hacking tool such as internet banking and phone banking using a wired / wireless telephone network Hacker's attack on the back can be blocked.

In addition, integrated authentication of all the components participating in the authentication phase by having the user authentication re-return back to the one-time authentication server, server server, user PC, wireless mobile terminal or wired telephone, SMS server or ARS server, and one-time password authentication server. This greatly enhances security.

According to the present invention, the challenge-response method and the time synchronization OTP system can be integrated and operated as one, thereby increasing convenience and security.

Components constituting the present invention is a client terminal 100, as shown in Figure 1, the service server 200 providing content related to the service according to the service provision request of the client terminal, the challenge of generating a one-time password and received OTP authentication server 300 that checks the response, that is, one-time password-In case of using a time-synchronous one-time password system may authenticate the password received from the one-time password based on time without generating a challenge-, the transmitted OTP SMS or ARS server 400 for receiving information, wired or wireless terminal 500 for transmitting OTP information, and OTP generator 600 for generating disposable passwords-includes both the challenge-response method and time synchronization method described above. do-.

The most typical application of the present invention is in the authentication method of the Internet banking system. As an example, the specific implementation of the present invention will be described. The authentication method for a one time password according to the present invention is configured as follows.

(a) a client terminal transmitting a user's login information through a network and requesting a service from a server;

(b) if the user login information is authenticated, the service server transmitting OTP authentication preparation information to the OTP authentication server and receiving OTP authentication preparation information;

(c) generating, by the service server, the OTP request information and transmitting it to the client terminal;

(d) transmitting the OTP information generated by the OTP generator based on the OTP request information to the OTP authentication server through the bypass network;

(e) OTP authentication server receives and authenticates the OTP information and transmits the authentication information to the service server. One-time password-based user authentication method using a bypass network.

In the step (a), the client terminal 100 is generally a user PC and includes a laptop or PDA connected to the wireless Internet. The user transmits his login information to the service server 200, that is, the Internet banking server for Internet banking. The login information is generally composed of a user ID and a password, and the user ID and password may be represented by several bytes or tens of bytes of data, respectively. The internet banking server (service server) receiving the login information grants the permission to access the account and perform basic inquiry such as account information and usage history.

In step (b), the OTP authentication preparation information is a step in which the service server requests the OTP authentication server for OTP authentication preparation information for authenticating the one-time password (OTP) for the client terminal connected to the OTP authentication preparation information as follows. It is composed.

Configuration of OTP authentication preparation information transmitted from service server to OTP authentication server

,

,

Here, the session ID is a serial number for uniquely identifying the client terminal and is issued by the service server and stored in the user information DB. Other reservation codes are optional and are reserved for extensibility and are used when cremation or additional information exchange is required.

The OTP authentication preparation completion information is information that informs the service server that the OTP call authentication server is ready for authentication.

Composition of OTP authentication completion information transmitted from OTP human server to service server

,

,

Here, the challenge is a random number prepared for the challenge-response disposable password (6-10 digits is common), and when implementing the one-time password in a time-synchronous manner, the challenge is not required. It is expressed as a time synchronous method by expressing a challenge = 0x000000 '. The session ID is a unique serial number used to distinguish client terminals and is issued by the service server. When the client terminal requests a high security service such as a transfer service, the Internet banking server (service server) transmits OTP request information to the client terminal. When using a challenge-response one-time password, the Internet banking server transmits the corresponding user ID to the one-time password server, receives the challenge value, and generates OTP request information based on the challenge value. OTP request information is composed as follows.

In step (c), the service server generates the OTP request information and transmits it to the client terminal. The OTP request information is configured as follows.

Composition of OTP request information transmitted by service server to client terminal

In step (d), the client terminal receiving the OTP request information generates a response, that is, a one-time password (OTP) using the disposable password generator 500. As described above, in the case of the challenge response method, the challenge must be input to the disposable password generator, and in the case of the time synchronous method, the challenge does not exist and thus there is no need to input the challenge. The disposable password consists of:

Composition of OTP information transmitted to OTP authentication server through wired or wireless terminal

,

,

Here, the session ID may be replaced by a user's mobile number, social security number, etc., but in this case, convenience may be increased, but security may be reduced. Therefore, the method of generating and assigning a server server is most preferable.

In step (d), the OTP information is transmitted to the SMS server / ARS 500 server using the wired / wireless terminal 600. This information is sent directly to the OTP authentication server 300.

In step (e), the OTP authentication server checks the client terminal with the session ID in the OTP information using the hash function as described above, and authenticates the one time password. If the authentication is successful, the OTP authentication server approves the authentication to the service server and the service server receiving the service server provides the server to the client terminal. If not approved, the client terminal's

Requests for service offer will be denied.

Table 1 and Table 2 below show examples of user log table and one-time password authentication table maintained by the service server and OTP authentication server for OTP authentication.

Example implementation of user log table on service server User ID Password Session ID etc hwp99 0xabd35e1234 21345671 park21 0xabcd56245e 123468 Kim21 0x3326bca234 NULL ...

In Table 1, the current session ID of user ID hwp99 is '21345671', and the user ID and session ID are primary keys. The password is a field where static passwords are stored and is usually stored after hashing. Therefore, to authenticate this, the transmitted password is hashed and compared before authentication. The session ID of user ID 'kim21' is set to 'NULL', which indicates that the session was not created because the client terminal is not currently connected to the service server.

Example of One-Time Password Authentication Table of OTP Authentication Server Session ID challenge OTP Challenge creation time etc 21345671 345678 546727 2008.01.11.16.2343 1234568 234562 838476 2008.01.11.16.2134 3213223 0x000000 463278 ...

In Table 2, session ID is the one that service server issues. This session ID is the only information sent by the service server. The OTP authentication server authenticates this session ID. The challenge is a random number issued at the time of challenge creation, and the challenge of session ID '3213223' is '0x000000' indicates that authentication will be performed using time-synchronous OTP.

According to the present invention, when a client terminal requests a service requiring higher security from an Internet banking server, the Internet banking server may request an OTP server for the corresponding authentication process, and the one-time password received through the bypass network according to the request. The user authentication is completed by the OTP authentication server authenticating (OTP). The technical idea of generating a one-time password using a challenge received through a bypass network and transmitting it through a client terminal is described in the prior art document 1-2, but the prior art document is used only as a means for receiving a challenge.

This existing configuration is easily broken by the Trojan-type attack tool as described above. The essential difference of the present invention is to form a closed loop authentication loop by receiving the challenge to the client terminal and sending the generated one-time password together with the session ID through the bypass network that cannot be controlled by the attacker. It is possible to completely block the service request of the unauthorized unauthorized person.

1 illustrates a user authentication method according to an embodiment of the present invention. The configuration of transmitting a one time password using a heterogeneous bypass network (such as SMS of a wireless telephone network or ARS of a wired telephone network) rather than a network to which a client terminal is connected has been described.

Figure 2 shows in detail the configuration of the present invention and the core configuration of the present invention is the one-time password transmission through the bypass network. In this way, even if the third party takes complete control of the client terminal, the user authentication is performed through a separate bypass network to block the attack of the unauthorized user who seizes and monitors the client terminal.

Claims (9)

In the one-time password authentication method of the network for providing a service consisting of a client terminal and a server, (a) a client terminal transmitting a user's login information through a network and requesting a service from a server; (b) if the user login information is authenticated, the service server transmitting OTP authentication preparation information to the OTP authentication server and receiving OTP authentication preparation information; (c) generating, by the service server, the OTP request information and transmitting it to the client terminal; (d) transmitting the OTP information generated by the OTP generator based on the OTP request information to the OTP authentication server through the bypass network; (e) OTP authentication server receives and authenticates the OTP information and transmits the authentication information to the service server. One-time password-based user authentication method using a bypass network. The method of claim 1, wherein steps (d) and (e) each comprise the following more specific steps: (d1) inputting the OTP information to a wired or wireless terminal; (d2) receiving an OTP information from an SMS or ARS server and transmitting the received OTP information to the OTP authentication server; And (e1) the OTP authentication server authenticating the one time password and transmitting the result along with the session ID to the server server; (e2) the service server receiving the session ID and the authentication from the OTP authentication server and providing a service according to the authentication result; each one-time password based using a bypass network, characterized in that replaced by How to authenticate users.  In the one-time password authentication method of the network consisting of a wired terminal and the ARS service server providing a service, (a) the wired terminal transmitting the user's login information through the ARS and requesting access to the ARS service server; (b) when the user login information is authenticated, the ARS service server transmitting OTP authentication preparation information to the OTP authentication server and receiving OTP authentication preparation information; (c) transmitting, by the ARS service server, OTP request information to transmit the one time password via SMS when the user login information is authenticated; (d) transmitting the OTP information generated by the OTP generator based on the OTP request information to the OTP authentication server through the wireless terminal and the SMS server; (e) OTP authentication server receives and authenticates the OTP information and transmits the authentication to the ARS service server. User authentication based on One Time Password. In the one-time password authentication method of a network consisting of a wireless terminal and a wireless Internet service server providing a service, (a) the wireless terminal transmitting the user's login information through the wireless internet and requesting access to the wireless internet service server; (b) if the user login information is authenticated, the wireless Internet service server transmitting OTP authentication preparation information to the OTP authentication server and receiving OTP authentication preparation information; (c) transmitting, by the wireless Internet service server, OTP request information to the wireless terminal to transmit the one time password through the ARS when the user login information is authenticated; (d) transmitting the OTP information generated by the disposable password generator based on the OTP request information to the OTP authentication server through the wired terminal and the ARS server; (e) OTP authentication server receives and authenticates the OTP information and transmits the authentication to the wireless Internet service server. One time password based user authentication method using a bypass network. The method according to any one of claims 1 to 4, wherein the OTP authentication preparation information includes a session ID for confirming access information of the client terminal, and the OTP authentication preparation information includes a session ID and a challenge. In the case of time synchronization, the challenge is omitted or set to a predetermined value. The OTP request information includes a session ID and a challenge, and the OTP information includes a session ID and a response (OTP). One time password based user authentication using bypass network. In the user authentication system using a one-time password, A client terminal comprising means for connecting to a user via a network and transmitting authentication information; A service server comprising means for receiving a service request from a client terminal, content DB storing service content, and means for generating OTP authentication preparation information, including user information DB, and means for transmitting to the OTP authentication server; An OTP authentication server including means for receiving OTP authentication preparation information, means for generating a challenge for authentication of a client terminal, a DB for storing OTP authentication preparation completion information including a session ID, and means for authenticating the received one time password; An SMS server / ARS server including a wired / wireless terminal for transmitting OTP information through a wireless network or a wired telephone network, means for receiving OTP information, and means for transmitting the OTP information to an OTP authentication server; OTP generator of a time-synchronous or challenge-response method for generating a one-time password, which is an independent portable terminal, including the case that is implemented as a mobile phone. The method of claim 6, wherein the OTP authentication preparation information includes a session ID for confirming access information of a client terminal, and the OTP authentication preparation information includes a session ID and a challenge. The OTP request information is configured to include a session ID and a challenge, and the OTP information is based on a one-time password using a bypass network, wherein the OTP information includes a session ID and a response. User authentication system. A computer-readable recording medium having recorded thereon a program for performing a one time password based user authentication method using the bypass network according to any one of claims 1 to 4. A computer-readable recording medium recording a program for performing a one time password based user authentication method using a bypass network of claim 5.

Images